// Loads real dev secrets from apps/api/.env (gitignored — never committed).
// Falls back to apps/api/.env-development (git-tracked shared dev creds) for
// anything .env doesn't override, matching how apps/api itself resolves config.
const path = require('path');
require('dotenv').config({ path: path.join(__dirname, '../../api/.env') });
require('dotenv').config({ path: path.join(__dirname, '../../api/.env-development') });

const APP_URL = process.env.E2E_APP_URL || 'http://localhost:5173';
const API_URL = process.env.E2E_API_URL || 'http://localhost:3024/api';

const JWT_REFRESH_SECRET = process.env.JWT_REFRESH_SECRET;
if (!JWT_REFRESH_SECRET || JWT_REFRESH_SECRET.startsWith('CHANGE_ME')) {
  throw new Error('JWT_REFRESH_SECRET missing/placeholder — check apps/api/.env has real dev secrets.');
}

// Known test accounts. user_id is intentionally NOT hardcoded here — these
// accounts get recreated over time (see chibistar/automation/starr/config.cjs
// history) which silently breaks hardcoded ids. helpers/session.js looks the
// id up by email at call time instead.
const USERS = {
  admin: {
    email: process.env.E2E_ADMIN_EMAIL || 'k80308392@gmail.com',
    password: process.env.E2E_ADMIN_PASSWORD || 'Test123@',
    acc_type: 'admin',
  },
  seedClient: {
    // Synthetic, no real owner — safe default for read-only/client-facing checks.
    email: process.env.E2E_SEED_CLIENT_EMAIL || 'veronica.castro@example.com',
    acc_type: 'user',
  },
};

module.exports = { APP_URL, API_URL, JWT_REFRESH_SECRET, USERS };