<?xml version="1.0" encoding="UTF-8"?>
<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
         bootstrap="vendor/autoload.php"
         colors="true"
>
    <testsuites>
        <testsuite name="Arch">
            <directory>tests/Arch</directory>
        </testsuite>
        <testsuite name="Unit">
            <directory>tests/Unit</directory>
        </testsuite>
        <testsuite name="Feature">
            <directory>tests/Feature</directory>
        </testsuite>
    </testsuites>
    <source>
        <include>
            <directory>app</directory>
        </include>
    </source>
    <php>
        <!--
            Every value below carries force="true" on purpose. Without it a
            developer's .env wins and the suite quietly runs against shared
            state, a real queue or the development database (plan chunk1 §1.6).

            Connection details that differ per machine live in .env.testing —
            see .env.testing.example. Secrets are never written here.
        -->
        <!--
            Set here rather than left to each machine's php.ini. The build
            agent shipped with 128M while the development machine had 1G, so
            the architecture tests — which load every class in the codebase —
            passed locally and died on CI (build #689).
        -->
        <ini name="memory_limit" value="1G"/>

        <server name="APP_ENV" value="testing" force="true"/>
        <server name="APP_MAINTENANCE_DRIVER" value="file" force="true"/>
        <server name="BCRYPT_ROUNDS" value="4" force="true"/>
        <server name="CACHE_STORE" value="array" force="true"/>
        <!-- The real driver, not `array`. Each identity domain keeps its own
             session table (chunk5 §5.1.1), and A-2 ("these are my sessions,
             end that one") is a query against it — none of which an in memory
             store exercises. -->
        <server name="SESSION_DRIVER" value="domain" force="true"/>
        <server name="QUEUE_CONNECTION" value="sync" force="true"/>
        <server name="BROADCAST_CONNECTION" value="null" force="true"/>
        <server name="MAIL_MAILER" value="array" force="true"/>

        <!--
            The application must never reach the database as a superuser:
            PostgreSQL lets superusers bypass FORCE ROW LEVEL SECURITY, so an
            RLS test run as one passes no matter what the policy says
            (chunk2 experiment 1). Everything else about the connection —
            host, port, database, password — comes from .env.testing.
        -->
        <server name="DB_CONNECTION" value="pgsql" force="true"/>
        <server name="DB_USERNAME" value="3eegitim_test" force="true"/>

        <server name="PULSE_ENABLED" value="false" force="true"/>
        <server name="TELESCOPE_ENABLED" value="false" force="true"/>
        <server name="NIGHTWATCH_ENABLED" value="false" force="true"/>

        <!-- ⛔ Belgeler testte YEREL diske yazilir. `filesystems.documents`
             varsayilani `s3` ve test ortaminda kova yok; SecureFileStore'a
             tasinan yukleme action'lari (03.08.2026) bu diski gercekten
             kullaniyor, oncesinde kimse dokunmuyordu. -->
        <env name="DOCUMENT_DISK" value="local"/>

        <!-- Sabit bir anahtar: sifreleme yolunun kendisi test ediliyor. -->
        <env name="DOCUMENT_ENCRYPTION_KEY" value="base64:c2VjcmV0LWtleS1mb3ItdGVzdHMtb25seS0zMmJ5dGU="/>
    </php>
</phpunit>
