<?php

return [
    'cache_store' => env('ADMIN_SMS_CACHE_STORE', 'redis'),
    // Empty means all source IPs are allowed; configure trusted office/VPN IPs to restrict access.
    'allowed_ips' => array_values(array_filter(array_map('trim', explode(',', env('ADMIN_SMS_ALLOWED_IPS', ''))))),
    'challenge_ttl' => 300,
    'challenge_max_failures' => 5,
    'phone_failure_window' => 600,
    'phone_max_failures' => 5,
    'account_lock_seconds' => 900,
    'account_max_failures' => 5,
    'ip_failure_window' => 600,
    'ip_max_failures' => 30,
    'send_minute_window' => 60,
    'send_daily_window' => 86400,
    'send_daily_limit' => 10,
];