<?xml version="1.0"?>
<ruleset name="M1 ERP Coding Standard">
    <description>PHP CodeSniffer configuration for M1 ERP</description>

    <!-- Use PSR-12 as base standard -->
    <rule ref="PSR12"/>

    <!-- Paths to check -->
    <file>core</file>
    <file>models</file>
    <file>controllers</file>
    <file>includes</file>

    <!-- Paths to exclude -->
    <exclude-pattern>*/vendor/*</exclude-pattern>
    <exclude-pattern>*/views/*</exclude-pattern>
    <exclude-pattern>*/public/*</exclude-pattern>
    <exclude-pattern>*/uploads/*</exclude-pattern>
    <exclude-pattern>*/tests/*</exclude-pattern>
    <exclude-pattern>*/debug/*</exclude-pattern>
    <exclude-pattern>*/cache/*</exclude-pattern>

    <!-- Show colors in output -->
    <arg name="colors"/>
    
    <!-- Show progress -->
    <arg value="p"/>
    
    <!-- How many files to check simultaneously -->
    <arg name="parallel" value="8"/>

    <!-- Additional rules -->
    <rule ref="Generic.CodeAnalysis.UnusedFunctionParameter"/>
    <rule ref="Generic.Commenting.Todo"/>
    <rule ref="Generic.Commenting.Fixme"/>
    <rule ref="Generic.Files.LineLength">
        <properties>
            <!-- Warn at 120 chars, error at 150 -->
            <property name="lineLimit" value="150"/>
            <property name="absoluteLineLimit" value="200"/>
        </properties>
    </rule>

    <!-- Relaxed rules for legacy code -->
    <rule ref="PSR1.Classes.ClassDeclaration.MissingNamespace">
        <severity>3</severity>
    </rule>

    <!-- Check for security issues -->
    <rule ref="Generic.PHP.ForbiddenFunctions">
        <properties>
            <property name="forbiddenFunctions" type="array">
                <!-- Dangerous functions -->
                <element key="eval" value="null"/>
                <element key="create_function" value="null"/>
                <element key="exec" value="null"/>
                <element key="system" value="null"/>
                <element key="passthru" value="null"/>
                <element key="shell_exec" value="null"/>
                <!-- Use password_hash instead -->
                <element key="md5" value="password_hash"/>
                <element key="sha1" value="password_hash"/>
            </property>
        </properties>
    </rule>
</ruleset>
