/**
 * Host running the CBS backend. Swagger for it is at `/swagger-ui/index.html`.
 *
 * This has to be an address the *phone* can reach, which is not the same thing
 * as one that works in a browser on the dev machine: a VM-only or
 * different-subnet address resolves fine on the laptop and is simply invisible
 * to the handset, and that failure reads like the app being broken. `localhost`
 * is wrong for the same reason — on a device it means the device itself.
 *
 * This is a named host on an internal domain, not an IP, so it resolves only
 * where the DNS that serves `.lincpay` is reachable — the office network or
 * the VPN. A handset on mobile data, or on a guest network without that
 * resolver, fails to resolve it at all and the app looks like the backend is
 * down. Note there is no port here: this host answers on the default 80, unlike
 * the `:8089` LAN addresses this build was aimed at before.
 *
 * Plain HTTP, so it depends on cleartext traffic being allowed for this host
 * specifically. Both platforms gate that by host and neither tells the app why
 * a blocked request failed, so a change here has to be checked against:
 *
 *   - here,
 *   - `android/app/src/main/res/xml/network_security_config.xml`,
 *   - `NSExceptionDomains` in `ios/BankCBS/Info.plist` — a bare IP literal is
 *     already covered there by `NSAllowsLocalNetworking`, but a *named* host
 *     is not and needs its own entry.
 */
const API_ORIGIN = 'http://mobile-banking-backend.lincpay';

export const env = {
  /** CBS backend origin. */
  apiOrigin: API_ORIGIN,
  /** Every documented endpoint lives under this prefix. */
  apiBaseUrl: `${API_ORIGIN}/api/v1`,
  /** Organisation the app is branded for; sent at registration and at sign-in. */
  orgId: '107295',
  /**
   * Modules with no backend behind them yet — cards, loans, insurance, deposits,
   * the dashboard and the agent app — still resolve from fixtures. Registration,
   * sign-in, accounts/MMID and payees always call the live API regardless.
   */
  useMockServer: true,
  /** Server-enforced idle window; any authenticated call refreshes it. */
  sessionTimeoutMs: 300_000,
  /** How long before the idle cut-off the user is warned. */
  sessionWarningMs: 60_000,
};