/**
 * Shared constants for the service-credential auth path (M2).
 * Header names, the BFF system id, and the in-memory cache TTLs.
 */

/** New canonical header carrying a presented service key: `pf_sk_live_<prefix>.<secret>`. */
export const SERVICE_KEY_HEADER = 'x-planfi-service-key';

/** Legacy global key header (kept working behind LEGACY_API_KEY_ENABLED until M6). */
export const LEGACY_API_KEY_HEADER = 'x-api-key';

/** This BFF's system id in the permission matrix (§4.6). Always "bff" here. */
export const BFF_SYSTEM = 'bff';

/** Positive (valid) introspection results are cached this long. Short by design — revocation window (§4 item 4). */
export const SERVICE_CREDENTIAL_POSITIVE_TTL_MS = 60_000; // ~60s

/** Negative (invalid) introspection results are cached briefly to blunt brute-force / retry storms. */
export const SERVICE_CREDENTIAL_NEGATIVE_TTL_MS = 5_000; // ~5s

/** Outbound timeout for the internal /validate call (mirrors MasterApiService's axios timeout scale). */
export const SERVICE_CREDENTIAL_VALIDATE_TIMEOUT_MS = 5_000;