<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Demo Mode
    |--------------------------------------------------------------------------
    |
    | Turns the deployment into a public demo: the writes described below are
    | refused, and the shared accounts named in "protected_users" cannot be
    | modified. Everything else stays interactive, so the demo still feels
    | like the real application.
    |
    | This is a per deployment switch rather than a setting. Demo mode's main
    | job is blocking settings writes, so a toggle living in the settings store
    | would either be unreachable to you once demo mode is on, or reachable to
    | any visitor signed in on the shared account.
    |
    | Flip it with DEMO_MODE in .env, then run "php artisan config:clear".
    |
    */

    'enabled' => env('DEMO_MODE', false),

    /*
    |--------------------------------------------------------------------------
    | Blocked Routes
    |--------------------------------------------------------------------------
    |
    | Route names, matched with Str::is() so a trailing * covers a whole
    | domain. Only writes are considered, so "settings.*" refuses saving the
    | settings without hiding the settings pages themselves. GET routes that
    | change state belong under "unsafe_reads" below.
    |
    | A slash separated entry is matched against the request path instead,
    | which is how the largely unnamed routes in routes/api.php are covered.
    |
    */

    'blocked' => [
        // Settings are global. One visitor renaming the application or
        // turning registration off breaks the demo for everybody else.
        'settings.*',

        // The role and permission matrix rewrites what every role may do,
        // including the role the demo account itself belongs to.
        'permissions.save',

        // The installer rewrites .env and re-runs the seeders.
        'install.*',

        // Two factor authentication on a shared account locks out every
        // other visitor.
        '2fa.*',
        'user.two-factor.*',
        'two-factor.enable',
        'two-factor.disable',
        'two-factor.confirm',
        'two-factor.regenerate-recovery-codes',

        // The same three concerns over the API, which is unnamed and so has
        // to be matched by path.
        'api/me/2fa',
        'api/me/2fa/*',
        'api/users/*/2fa',
        'api/users/*/2fa/*',
        'api/roles/*/permissions',

        // Announcements are visible to every visitor. Uncomment these if
        // moderating them becomes a chore. The guard is a global middleware,
        // so plugin routes are covered without touching the plugin.
        // 'announcements.store',
        // 'announcements.update',
        // 'announcements.destroy',
    ],

    /*
    |--------------------------------------------------------------------------
    | Unsafe Reads
    |--------------------------------------------------------------------------
    |
    | GET routes that change state, and so are refused despite the verb.
    | Everything else answering a safe verb is left alone, because a demo that
    | cannot be browsed is not a demo.
    |
    | Impersonation is deliberately absent: it is one of the features the demo
    | exists to show off, and it grants nothing. The rules below follow the
    | impersonated identity, so a visitor who takes over a protected account
    | still cannot modify it.
    |
    */

    'unsafe_reads' => [
        // The same controller action as the POST, reachable over GET.
        'install.installation.start',
    ],

    /*
    |--------------------------------------------------------------------------
    | Allowed Routes
    |--------------------------------------------------------------------------
    |
    | Checked before everything else, so these win over "blocked". This is
    | what a visitor needs in order to use the demo at all.
    |
    */

    'allowed' => [
        'login',
        'logout',
        'auth.logout',
        'register',
        'password.email',
        'password.update',
        'verification.resend',

        // The two factor challenge at login, as opposed to enabling two
        // factor authentication on an account.
        'auth.token.validate',
        'two-factor.login.store',

        // Confirms the current password, it does not change it.
        'password.confirm.store',

        'announcements.read',
    ],

    /*
    |--------------------------------------------------------------------------
    | Protected Accounts
    |--------------------------------------------------------------------------
    |
    | Usernames or email addresses of the shared accounts the demo hands out.
    | They cannot be renamed, re-passworded, re-avatared, approved, deleted or
    | have their sessions invalidated, whether the request targets them or is
    | made by them. Matched case insensitively.
    |
    | UserSeeder creates exactly one: admin / admin@example.com.
    |
    */

    'protected_users' => ['admin'],

    /*
    |--------------------------------------------------------------------------
    | Self Service Routes
    |--------------------------------------------------------------------------
    |
    | The routes where the signed in user is the thing being modified. Only
    | these consult the acting user, so a visitor on the shared account can
    | still create users, roles and permissions.
    |
    */

    'self_routes' => [
        'profile.update.*',
        'profile.sessions.*',

        // The API equivalents, matched by path because they are unnamed.
        'api/me/*',
        'api/sessions/*',
    ],

    /*
    |--------------------------------------------------------------------------
    | Default Roles And Permissions
    |--------------------------------------------------------------------------
    |
    | Extends the existing "removable" column from delete to update, so the
    | seeded roles and permissions cannot be renamed either.
    |
    */

    'protect_default_roles' => true,

    /*
    |--------------------------------------------------------------------------
    | Message Override
    |--------------------------------------------------------------------------
    |
    | One message in place of the translated defaults. Rendered as plain text
    | in a toast, so no markup.
    |
    */

    'message' => env('DEMO_MESSAGE'),

];