# ═══════════════════════════════════════════════════════════════════════════════
#  $APP_NAME — Environment Variables Template (LOCAL DEVELOPMENT)
#  Copy to .env and fill in the CHANGE_ME values before running `npm run dev`.
#
#  Local development setup:
#    1. cp .env-development .env
#    2. Fill in every CHANGE_ME value below
#    3. npm install
#    4. npm run dev        (nodemon, auto-restarts on file change)
#
#  For a production / self-hosted deployment (Docker Compose, Redis, TLS),
#  use .env-production instead — see docker-compose.yml.
#
#  Generate random secrets with:
#    node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# ═══════════════════════════════════════════════════════════════════════════════

# ── App ───────────────────────────────────────────────────────────────────────
APP_NAME=starr
NODE_ENV=development
ORIGIN_GUARD_DISABLED=true   # allows Postman/curl in dev; hard-locked false when NODE_ENV=production
PORT=3024
APP_URL=http://localhost:3024
APP_LOGO_URL=https://your-cdn.com/logo.png
FRONTEND_URL=http://localhost:5173

# ── Database (PostgreSQL) ─────────────────────────────────────────────────────
#  Local Postgres install — no SSL needed.
DB_HOST=127.0.0.1
DB_PORT=5432
DB_NAME=CHANGE_ME
DB_USER=CHANGE_ME
DB_PASSWORD=CHANGE_ME
DB_SSL=false
DB_FORCE_SYNC=false   # never drop tables — even in dev, unless you mean it

# ── Cache driver ──────────────────────────────────────────────────────────────
#  memory → no Redis/Valkey needed. Safe default for a single local process.
#  Rate limit counters and CSRF sessions reset on restart — fine for dev.
CACHE_DRIVER=memory

# ── JWT ───────────────────────────────────────────────────────────────────────
#  Generate each secret independently — never reuse across fields.
JWT_SECRET=CHANGE_ME_32_BYTE_HEX
MEDIA_JWT_SECRET=CHANGE_ME_32_BYTE_HEX
JWT_EXPIRES_IN=15m
JWT_REFRESH_SECRET=CHANGE_ME_32_BYTE_HEX
JWT_REFRESH_EXPIRES_IN=7d

# ── CSRF & Cookies ────────────────────────────────────────────────────────────
SESSION_SECRET=CHANGE_ME_32_BYTE_HEX

# ── Google OAuth ──────────────────────────────────────────────────────────────
#  console.cloud.google.com → Credentials → OAuth 2.0 Client ID
#  Add http://localhost:3024/api/auth/google/callback to Authorized redirect URIs
GOOGLE_CLIENT_ID=CHANGE_ME
GOOGLE_CLIENT_SECRET=CHANGE_ME
GOOGLE_CALLBACK_URL=http://localhost:3024/api/auth/google/callback

# ── PayPal ────────────────────────────────────────────────────────────────────
#  Use Sandbox credentials for local testing: developer.paypal.com → Sandbox tab.
PAYPAL_CLIENT_ID=CHANGE_ME
PAYPAL_CLIENT_SECRET=CHANGE_ME
PAYPAL_ENV=sandbox

# ── Email (SMTP) ──────────────────────────────────────────────────────────────
#  Gmail: enable 2FA → generate an App Password at myaccount.google.com/apppasswords
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=CHANGE_ME@gmail.com
SMTP_PASS=CHANGE_ME_APP_PASSWORD
EMAIL_FROM=CHANGE_ME@gmail.com

OTP_EXPIRY_MINUTES=10

# ── S3-compatible Storage (Garage, run locally — bare-metal) ─────────────────
#  Run Garage directly on your machine (the docker-compose.yml Garage service
#  is set up for the production stack). See:
#  https://garagehq.deuxfleurs.fr/documentation/quick-start/
S3_ENDPOINT=http://127.0.0.1:3900
S3_REGION=garage
S3_ACCESS_KEY=CHANGE_ME
S3_SECRET_KEY=CHANGE_ME
S3_BUCKET=CHANGE_ME
S3_PUBLIC_URL=http://127.0.0.1:3900

# ── Chibisafe (optional — used alongside S3 for some asset types) ────────────
CHIBISAFE_BASE_URL=CHANGE_ME
CHIBISAFE_API_KEY=CHANGE_ME
CHIBISAFE_ALBUM_AVATARS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_IMAGES=CHANGE_ME_UUID
CHIBISAFE_ALBUM_VIDEOS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_THUMBNAILS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_DOCUMENTS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_ARCHIVED=CHANGE_ME_UUID

# ── CORS ──────────────────────────────────────────────────────────────────────
ALLOWED_ORIGINS=http://localhost:5173,http://localhost:3024