"""
Security constants — shared configuration values.
"""

# MFA
TOTP_DIGITS = 6
TOTP_INTERVAL_SECONDS = 30
BACKUP_CODE_COUNT = 10

# Sessions
SESSION_DURATION_HOURS = 24
REFRESH_TOKEN_DURATION_DAYS = 30
INACTIVITY_TIMEOUT_MINUTES = 30
MAX_ACTIVE_SESSIONS = 5

# Rate Limiting
LOGIN_MAX_ATTEMPTS = 5
LOGIN_BLOCK_SECONDS = 900  # 15 minutes
API_MAX_ATTEMPTS = 100
API_BLOCK_SECONDS = 3600  # 1 hour