<?php

/**
 * API Security Report — KiyoHR
 */

return [
    'versioning' => 'Unversioned /api prefix (payroll/v2 redirects only)',
    'auth' => 'Sanctum Bearer tokens; auth:sanctum on protected group',
    'middleware_stack' => [
        'auth:sanctum',
        'tenant.user',
        'tenant',
        'tenant.subscription',
        'tenant.permission',
        'tenant.module',
        'tenant.2fa',
        'throttle:api',
    ],
    'public_endpoints' => [
        'POST /api/auth/login (throttled)',
        'POST /api/hrms/login (throttled)',
        'POST /api/face/login (throttled; feature-flagged)',
        'POST /api/integrations/zkteco/attendance (device Basic auth)',
        'POST /api/integrations/razorpay/webhook (HMAC signature)',
        'Password reset / 2FA challenge routes (throttled)',
    ],
    'controls' => [
        'rate_limiting' => true,
        'cors_allowlist' => true,
        'fail_closed_permissions' => true,
        'sensitive_fields_hidden' => true,
        'face_templates_redacted_from_sync' => true,
    ],
    'recommendations' => [
        'Introduce /api/v1 prefix for future breaking changes',
        'API Resources for consistent output shaping',
        'Shorten Sanctum token TTL for mobile if policy requires',
        'Add request ID correlation in API logs',
    ],
];