<?xml version="1.0" encoding="utf-8"?>
<!--
  web.config cho DYD.Api — ASP.NET Core 10 out-of-process / in-process hosting
  Đặt ở: C:\inetpub\DYD.Api\web.config
  Robocopy /XF web.config để không bị overwrite khi deploy.
-->
<configuration>
  <location path="." inheritInChildApplications="false">
    <system.webServer>
      <handlers>
        <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
      </handlers>
      <aspNetCore processPath="dotnet"
                  arguments=".\DYD.Api.dll"
                  stdoutLogEnabled="true"
                  stdoutLogFile=".\logs\stdout"
                  hostingModel="InProcess"
                  forwardWindowsAuthToken="false">
        <environmentVariables>
          <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Production" />
          <!-- Nếu dùng User Secrets / env var cho JWT key, set ở đây hoặc qua IIS Configuration Editor -->
          <!--
          <environmentVariable name="ConnectionStrings__DefaultConnection" value="Server=..." />
          <environmentVariable name="Jwt__SigningKey" value="..." />
          -->
        </environmentVariables>
      </aspNetCore>

      <!-- Security headers -->
      <httpProtocol>
        <customHeaders>
          <add name="X-Content-Type-Options" value="nosniff" />
          <add name="X-Frame-Options" value="DENY" />
          <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
          <add name="Permissions-Policy" value="geolocation=(), microphone=(), camera=()" />
        </customHeaders>
      </httpProtocol>

      <!-- Gzip compression -->
      <httpCompression>
        <dynamicTypes>
          <add mimeType="application/json" enabled="true" />
          <add mimeType="application/json; charset=utf-8" enabled="true" />
        </dynamicTypes>
      </httpCompression>

      <!-- Larger file upload (cho InitiativeAttachments) -->
      <security>
        <requestFiltering>
          <!-- 50MB = 52428800 bytes -->
          <requestLimits maxAllowedContentLength="52428800" />
        </requestFiltering>
      </security>
    </system.webServer>
  </location>
</configuration>
