# ═══════════════════════════════════════════════════════════════════════════════
#  $APP_NAME — Environment Variables Template (LOCAL DEVELOPMENT)
#  Points at the team's shared dev infra (CockroachDB Cloud, Garage, Google
#  OAuth, PayPal Sandbox, Gmail) — nothing to stand up locally. The only
#  CHANGE_ME values left are the 4 per-machine secrets (JWT*/SESSION_SECRET,
#  auto-generated by new_starr_setup's wizard) and the optional Chibisafe block.
#
#  Local development setup:
#    1. cp .env-development .env
#    2. Fill in the remaining CHANGE_ME values below (or let the setup wizard do it)
#    3. npm install
#    4. npm run dev        (nodemon, auto-restarts on file change)
#
#  For a production / self-hosted deployment (Docker Compose, Redis, TLS),
#  use .env-production instead — see docker-compose.yml.
#
#  Generate random secrets with:
#    node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# ═══════════════════════════════════════════════════════════════════════════════

# ── App ───────────────────────────────────────────────────────────────────────
APP_NAME=starr
NODE_ENV=development
ORIGIN_GUARD_DISABLED=true   # allows Postman/curl in dev; hard-locked false when NODE_ENV=production
PORT=3024
APP_URL=http://localhost:3024
APP_LOGO_URL=https://cq5as7pc73.ufs.sh/f/pHNnzIw3VjcgjEJ1kFubDgYdvnt1cCAMyRjfOIGiUXPmZF3W
FRONTEND_URL=http://localhost:5173

# ── Database (PostgreSQL) ─────────────────────────────────────────────────────
#  Shared team CockroachDB Cloud cluster — SSL is on by default (see
#  config/db.config.js: useSSL is true unless DB_SSL=false is set explicitly).
DB_HOST=philproperties-16426.j77.aws-ap-southeast-1.cockroachlabs.cloud
DB_PORT=26257
DB_NAME=star-philpro
DB_USER=lash
DB_PASSWORD=K5mXTLyL_FrVGOHLHpzU4g
DB_FORCE_SYNC=false   # never drop tables — even in dev, unless you mean it

# ── Cache driver ──────────────────────────────────────────────────────────────
#  memory → no Redis/Valkey needed. Safe default for a single local process.
#  Rate limit counters and CSRF sessions reset on restart — fine for dev.
CACHE_DRIVER=memory

# ── JWT ───────────────────────────────────────────────────────────────────────
#  Per-machine secrets — never reuse across fields or share between devs.
#  new_starr_setup's wizard auto-generates fresh values for these on first run;
#  if filling this in by hand instead, generate each independently:
#    node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
JWT_SECRET=CHANGE_ME_32_BYTE_HEX
MEDIA_JWT_SECRET=CHANGE_ME_32_BYTE_HEX
JWT_EXPIRES_IN=15m
JWT_REFRESH_SECRET=CHANGE_ME_32_BYTE_HEX
JWT_REFRESH_EXPIRES_IN=7d

# ── CSRF & Cookies ────────────────────────────────────────────────────────────
#  Also per-machine — auto-generated by the setup wizard, see note above.
SESSION_SECRET=CHANGE_ME_32_BYTE_HEX

# ── Google OAuth ──────────────────────────────────────────────────────────────
#  Shared team OAuth client (console.cloud.google.com → Credentials).
GOOGLE_CLIENT_ID=379154949440-atchm4lurp9c1k23vbsjvgnqod2o9s5c.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=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
GOOGLE_CALLBACK_URL=http://localhost:3024/api/auth/google/callback

# ── PayPal ────────────────────────────────────────────────────────────────────
#  Shared team Sandbox app: developer.paypal.com → Sandbox tab.
PAYPAL_CLIENT_ID=AYjb-DmhvvCagQM0SZxw-sfz30Qb8D-dBPr-wmvq80zOKmfxUrKykv-h85Kzp_Z5YmCX4T06DlaH2-zK
PAYPAL_CLIENT_SECRET=EDkmLa47T0H5QtKdO8VfKdEDh--tuzP0Q2c_RFKASvdIJvs2j051v7j2hW0f8JxNDpjW8XyixE4JCxV4
PAYPAL_ENV=sandbox

# ── Email (Gmail API — OAuth2, over HTTPS) ────────────────────────────────────
#  Reuses the same OAuth client as GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET above.
#  Shared team refresh token — same value the deployed app uses.
GMAIL_REFRESH_TOKEN=1//0ebfPPkFoe9piCgYIARAAGA4SNwF-L9IrsTIWK1dWFRa2dmc33jd94_u5IA-LpTKQweSi3NODT78UhX91OH25ewE_riCT-DjaQg8
EMAIL_FROM=services.philpro@gmail.com

OTP_EXPIRY_MINUTES=10

# ── S3-compatible Storage (Garage) ────────────────────────────────────────────
#  Shared team Garage instance. Uses the public HTTPS endpoint here (not a
#  loopback/WireGuard address) so it works on a fresh machine with no tunnel.
S3_ENDPOINT=https://media.star-philpro-media.space
S3_REGION=garage
S3_ACCESS_KEY=GK1c811a656fafd5ae444eea7b747c4869
S3_SECRET_KEY=76001b32d753375bd1fc22c9389b590021143b6fbe9d1688d8ed4dba5f004965
S3_BUCKET=philproperties
S3_PUBLIC_URL=https://media.star-philpro-media.space

# ── Chibisafe (optional — used alongside S3 for some asset types) ────────────
CHIBISAFE_BASE_URL=CHANGE_ME
CHIBISAFE_API_KEY=CHANGE_ME
CHIBISAFE_ALBUM_AVATARS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_IMAGES=CHANGE_ME_UUID
CHIBISAFE_ALBUM_VIDEOS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_THUMBNAILS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_DOCUMENTS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_ARCHIVED=CHANGE_ME_UUID

# ── CORS ──────────────────────────────────────────────────────────────────────
ALLOWED_ORIGINS=http://localhost:5173,http://localhost:3024