framework:
    secret: '%env(APP_SECRET)%'
    http_method_override: false
    error_controller: 'twig.controller.exception::showAction'

    # langue par défaut
    default_locale: fr

    session:
        handler_id: null
        cookie_secure: auto
        cookie_samesite: lax

    php_errors:
        log: true

    mailer:
        dsn: '%env(MAILER_DSN)%'
        message_bus: null

    # ──────── RATE-LIMITERS ────────
    rate_limiter:

        # ➊ Tentatives de connexion (login form)
        login:
            policy: sliding_window
            limit: 5            # 5 essais maxi
            interval: '60 seconds'

        # ➋ Formulaire “Mot de passe oublié”
        reset_password:
            policy: token_bucket
            limit: 3            # capacité (3 jetons max)
            rate:
                amount:   1     # +1 jeton
                interval: '10 minutes'
