# Default configuration for "XCartBundle"
x_cart:

  #
  # X-Cart 5 HTTP & HTTPS host, web directory where cart installed and allowed domains
  #
  # NOTE:
  # You should put here hostname ONLY without http:// or https:// prefixes.
  # Do not put slashes after the hostname.
  # Web dir is the directory in the URL, not the filesystem path.
  # Web dir must start with slash and have no slash at the end.
  # The only exception is when you configure for the root of the site,
  # in which case you should leave the option empty.
  # Domains should be listed separated by commas.
  #
  # WARNING: Do not set the "$" sign before the parameter names!
  #
  # EXAMPLE 1:
  # http_host: 'www.yourhost.com'
  # https_host: 'www.securedirectories.com/yourhost.com'
  # web_dir: '/shop'
  # domains: 'www.yourhost2.com, yourhost3.com'
  #
  # will result in the following URLs:
  #
  # http://www.yourhost.com/shop
  # https://www.securedirectories.com/yourhost.com/shop
  #
  # EXAMPLE 2:
  # http_host: 'www.yourhost.com'
  # https_host: "www.yourhost.com"
  # web_dir: ''
  #
  # will result in the following URLs:
  #
  # http://www.yourhost.com
  # https://www.yourhost.com
  host_details:
    http_host: '%env(string:XCART_HOST_DETAILS_HTTP_HOST)%' # Example: www.yourhost.com
    https_host: '%env(string:XCART_HOST_DETAILS_HTTPS_HOST)%' # Example: www.yourhost.com
    admin_host: '%env(string:XCART_HOST_DETAILS_ADMIN_HOST)%' # Example: www.yourhost.com

    # Web dir is the directory in the URL, not the filesystem path.
    # Web dir must start with slash and have no slash at the end.
    web_dir: '%env(remove_trailing_slash:string:XCART_HOST_DETAILS_WEB_DIR)%' # Example: /shop
    domains: '%env(csv:XCART_HOST_DETAILS_DOMAINS)%' # Example: 'www.yourhost2.com,yourhost3.com'
    admin_self: '%env(string:XCART_HOST_DETAILS_ADMIN_SELF)%' # Example: admin/
    cart_self: '%env(string:XCART_HOST_DETAILS_CART_SELF)%' # Example: /
    force_https: '%env(bool:XCART_HOST_DETAILS_FORCE_HTTPS)%' # Example: true
  clean_urls:

    # Is use urls like domain.com/LG for languages
    # Changing this setting requires to re-deploy your store
    use_language_url: true

    # String with one or more chars.
    # It will be used to autogenerate clean URLs.
    # By default, only the '-' or '_' characters are allowed.
    # Empty string is also allowed.
    default_separator: '-' # Example: '-'

    # Get clean URLs capitalized for every starting letter of a word
    capitalize_words: false

    # Allow non latin symbols for autogenerated clean URLs
    use_unicode: false

    # canonical_product
    # Canonical product Clean URL’s format
    # possible values:
    #  domain/product_clean_url
    #  domain/main_category_clean_url/product_clean_url
    #
    # category
    # Category Clean URL’s format
    # possible values:
    #  domain/parent/goalcategory/
    #  domain/goalcategory/
    #  domain/parent/goalcategory.html
    #  domain/goalcategory.html
    #
    # Changing this setting will not affect existing url's
    # and requires to re-deploy your store
    #
    # product
    # Product Clean URL’s format
    # possible values:
    #  domain/goalproduct
    #  domain/goalproduct.html
    #
    # Changing this setting will not affect existing url's
    # and requires to re-deploy your store
    formats:

      # Defaults:
      canonical_product: domain/product_clean_url
      category: domain/parent/goalcategory/
      product: domain/goalproduct

    # to define your own alias add line below as:
    # target: 'clean-url'
    aliases:

      # Default:
      contact_us: contact-us

  #
  # Default image settings
  #
  images:
    default_image: images/no_image.png
    default_image_width: 110
    default_image_height: 110
    make_progressive: true
    generate_retina_images: true

    # Installation path of Image Magick executables:
    # for example:
    # image_magick_path: 'C:\Program Files\ImageMagick-6.7.0-Q16\'   (in Windows)
    # image_magick_path: '/usr/local/imagemagick/' (in Unix/Linux )
    # You should consult with your hosting provider to find where Image Magick is installed
    # If you leave it empty then PHP GD library will be used.
    image_magick_path: '%env(string:XCART_IMAGES_IMAGE_MAGICK_PATH)%' # Example: /usr/local/imagemagick/

  #
  # Installer authcode.
  # A person who do not know the auth code can not access the installation script.
  # Installation authcode is created authomatically and stored in this section.
  #
  installer_details:
    auth_code: '%env(string:XCART_INSTALLER_DETAILS_AUTH_CODE)%'
    shared_secret_key: '%env(string:XCART_INSTALLER_DETAILS_SHARED_SECRET_KEY)%'

  #
  # Logging details
  #
  log_details:
    suppress_errors: '%env(bool:XCART_LOG_DETAILS_SUPPRESS_ERRORS)%'
    suppress_log_errors: '%env(bool:XCART_LOG_DETAILS_SUPPRESS_LOG_ERRORS)%'

  #
  # Error handling options
  #
  error_handling:

    # Template for error pages
    page: public/error.html
    page_customer: public/customer/error.html

    # Template for maintenance pages
    maintenance: public/maintenance.html

  #
  # Marketplace
  #
  marketplace:
    url: '%xcart.marketplace.url%'
    appstore_url: '%xcart.marketplace.appstore_url%'
    upgrade_step_time_limit: '%xcart.marketplace.upgrade_step_time_limit%'
    banner_url: '%xcart.marketplace.banner_url%'
    editions_url: '%xcart.marketplace.editions_url%'
    segment_url: '%xcart.marketplace.segment_url%'
    addon_images_url: '%xcart.marketplace.addon_images_url%'
    xb_host: '%xcart.marketplace.xb_host%'

  #
  # Installation parameters
  #
  installation:
    installation_lng: '%xcart.installation_lng%'

  #
  # HTML Purifier options
  # See http://htmlpurifier.org/live/configdoc/plain.html for more details on HTML Purifier options
  #
  html_purifier:

    # Default options info:
    #
    # List of allowed values for 'target' attribute:
    # Attr.AllowedFrameTargets: [ _blank, _self, _top, _parent ]
    #
    # Allow 'id' attribute:
    # Attr.EnableID: true
    #
    # Allow tricky css like 'display:block;' on images:
    # CSS.AllowTricky: true
    #
    # Allow embed tags:
    # HTML.SafeEmbed: true
    #
    # Allow object tags:
    # HTML.SafeObject: true
    #
    # Allow iframe tags:
    # HTML.SafeIframe: true
    #
    # List of allowed URI (without http:// or https:// part) for iframe tags
    # If there are no allowed URIs specified then any src will be allowed for iframe tags
    # URI.SafeIframeRegexp: []
    #
    # Example: URI.SafeIframeRegexp: ['www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/', 'player.vimeo.com/video/']
    #
    options:

      # Defaults:
      Attr.AllowedFrameTargets:
        - _blank
        - _self
        - _top
        - _parent
      Attr.EnableID: 1
      CSS.AllowTricky: 1
      HTML.SafeEmbed: 1
      HTML.SafeObject: 1
      HTML.SafeIframe: 1
      Output.CommentScriptContents: 0
      URI.SafeIframeRegexp:

    # HTML Purifier additional attributes
    # format:
    # tag: [attribute1:attribute_definition2, attribute2:attribute_definition2]
    #
    # For tag only(if you specified attribute as above - tag will be added automatically):
    # tag: []
    #
    # Attribute definitions:
    # Enum      - as example "Enum#_blank,_self,_target,_top"
    # Bool      - Boolean attribute, with only one valid value: the name of the attribute.
    # CDATA     - Attribute of arbitrary text. (also Text valid)
    # ID        - Attribute that specifies a unique ID
    # Pixels    - Attribute that specifies an integer pixel length
    # Length    - Attribute that specifies a pixel or percentage length
    # NMTOKENS  - Attribute that specifies a number of name tokens, example: the class attribute
    # URI       - Attribute that specifies a URI, example: the href attribute
    # Number    - Attribute that specifies an positive integer number
    attributes:

      # Defaults:
      iframe:
        - allowfullscreen:CDATA
      video:
        - src:URI
        - type:Text
        - width:Length
        - height:Length
        - poster:URI
        - preload:Enum#auto,metadata,none
        - controls:Bool

  #
  # Storefront options
  #
  storefront_options:

    # Do not close target=callback for payments if storefront is closed
    callback_opened: '%env(bool:XCART_STOREFRONT_OPTIONS_CALLBACK_OPENED)%'

    # Works only with 'Aggregate CSS files' option enabled
    optimize_css: '%env(bool:XCART_STOREFRONT_OPTIONS_OPTIMIZE_CSS)%'

    # All the following countries always uses custom state with autocomplete(if available)
    # possible values - country codes ('GB,US,DE' as example), 'All' or empty ''
    autocomplete_states_for_countries:

      # Default:
      - GB

  #
  # Other options
  #
  other:

    # Translation drive code - auto / gettext / db
    translation_driver: '%env(string:XCART_OTHER_TRANSLATION_DRIVER)%'

    # List of trusted domains.
    # This option prevents redirecting to untrusted URLs passed via returnURL parameter.
    trusted_domains: []

    # X-Frame-Options value
    # For possible values see https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options
    # Examples:
    #  x_frame_options: 'disabled'
    #  x_frame_options: 'sameorigin'
    x_frame_options: sameorigin

    # X-XSS-Protection value
    # For possible values see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
    # Examples:
    #  x_xss_protection: 'disabled' prevent X-XSS-Protection header sending
    #  x_xss_protection: '0'
    #  x_xss_protection: '1; mode=block'
    x_xss_protection: '1; mode=block'

    # Content-Security-Policy value
    # For possible values see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
    # Examples:
    #  content_security_policy: 'disabled' prevent Content-Security-Policy header sending
    #  content_security_policy: "default-src 'self'"
    #  content_security_policy: "default-src 'self'; img-src *;"
    content_security_policy: disabled

    # X-Content-Type-Options value
    # For possible values see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
    # Examples:
    #  x_content_type_options: 'disabled' prevent X-Content-Type-Options header sending
    #  x_content_type_options: 'nosniff'
    x_content_type_options: nosniff

    # CSRF token strategy
    # possible values: per-session, per-form
    csrf_strategy: per-session # One of "per-session"; "per-form"

    # Add Content-Security-Policy meta tag with upgrade-insecure-requests
    # For details see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests
    meta_upgrade_insecure: false
    show_initialized_transactions: false

    # Use X-Sendfile and X-Accel-Redirect to download files
    # Note that server should be properly configured
    use_sendfile: '%env(bool:XCART_OTHER_USE_SENDFILE)%'

    # Next-previous order criteria
    # allowed values: orderNumber, date
    next_previous_order_criteria: orderNumber # One of "orderNumber"; "date"

    # SameSite prevents the browser from sending this cookie along with cross-site requests.
    # The main goal is mitigate the risk of cross-origin information leakage. It also provides
    # some protection against cross-site request forgery attacks (https://www.owasp.org/index.php/SameSite)
    # Possible values for the flag are "lax", "strict" or "" (not set)
    cookie_samesite: lax # One of "lax"; "strict"; ""

    # If cookie_hostonly is true, domain attribute won't be sent with set cookie header.
    # That makes cookies of current domain inaccessible in subdomains (https://tools.ietf.org/html/rfc6265#section-5.3)
    cookie_hostonly: true

  authentication:
    # If user enters wrong password [failed_login_attempts_max_count] times,
    # authentication will be locked for [lock_login_duration] seconds
    failed_login_attempts_max_count: 5
    lock_login_duration: 120

  storefront_api:
    # List of additional api tokens that, together with the token from the database, will participate in the authentication check
    additional_storefront_api_keys:
    # test_name: test_key
    # test_name2: test_key2
    configs:
      - name: company_name
        category: Company
      - name: start_year
        category: Company
      - name: location_address1
        category: Company
      - name: location_address2
        category: Company
      - name: location_address3
        category: Company
      - name: location_country
        category: Company
      - name: location_state
        category: Company
      - name: location_custom_state
        category: Company
      - name: location_city
        category: Company
      - name: location_zipcode
        category: Company
      - name: company_phone
        category: Company
      - name: company_fax
        category: Company
      - name: maximal_order_amount
        category: General
      - name: minimal_order_amount
        category: General
      - name: default_purchase_limit
        category: General
      - name: allow_membership_request
        category: General
      - name: weight_unit
        category: Units
      - name: weight_format
        category: Units
      - name: currency_code
        category: Currency
      - name: currency_symbol
        category: Currency
      - name: currency_prefix
        category: Currency
      - name: currency_suffix
        category: Currency

  export_import:

    # Export/Import available encodings list
    # This values should be valid iconv encoding alias and should be listed in iconv -l output
    encodings_list:

      # Defaults:
      - UTF-8
      - ISO-8859-1
      - WINDOWS-1251
      - CSSHIFTJIS
      - WINDOWS-1252
      - GB2312
      - EUC-KR
      - EUC-JP
      - GBK
      - ISO-8859-2
      - ISO-8859-15
      - WINDOWS-1250
      - WINDOWS-1256
      - ISO-8859-9
      - BIG5
      - WINDOWS-1254
      - WINDOWS-874
  shipping_list:

    # Maximum number of shipping options to be shown as a radio button list on the order creation page.
    # If the number of available options exceeds this value, the options will be shown in a drop-down box.
    display_selector_cutoff: 8

  #
  # Trial
  #
  trial:
    end_date: '%env(string:XCART_TRIAL_END_DATE)%'

  #
  # Demo
  #
  demo:
    demo_mode: '%env(bool:XCART_DEMO_DEMO_MODE)%'

  #
  # Some options to optimize the store
  #
  performance:

    # Enable to cache resource paths
    skins_cache: false

    # Enable to consume jobs via worker (php bin/console messenger:consume)
    background_jobs: '%env(bool:BACKGROUND_JOBS_ENABLED)%'
  service:
    is_trial: '%env(bool:XCART_SERVICE_IS_TRIAL)%'
    display_update_notification: '%env(bool:XCART_IS_UPDATE_AVAILABLE)%'
  affiliate:
    id: '%xcart.affiliate_id%'
  modules: []
  transports_data: []
