# ─────────────────────────────────────────────────────────────────────────────
# Field Service Work Order Management — environment template
#
# Copy to `.env` and fill in real values:
#     cp .env.example .env
# NEVER commit `.env`. Real secrets must never be committed to the repo.
# ─────────────────────────────────────────────────────────────────────────────

# ── HTTP / runtime ────────────────────────────────────────────────────────────
# Port the Express API listens on (default 4000).
PORT=4000

# development | test | production
NODE_ENV=development

# ── Database ──────────────────────────────────────────────────────────────────
# MongoDB connection string (required).
MONGODB_URI=mongodb://127.0.0.1:27017/workorders

# ── Secrets (REQUIRED) ────────────────────────────────────────────────────────
# HS256 signing secret for the 15-minute access JWT.
# MUST be >= 32 characters and MUST NOT be a placeholder such as "secret",
# "changeme", or "replace-me". Rotating it invalidates issued access tokens.
JWT_SECRET=0123456789abcdef0123456789abcdef0123456789abcdef

# Secret used by cookie-parser to sign cookie values (integrity only).
# MUST be >= 32 characters. It is NOT authentication.
COOKIE_SECRET=fedcba9876543210fedcba9876543210fedcba9876543210

# NOTE: JWT_SECRET and COOKIE_SECRET must each be at least 32 characters and
# must not be placeholder values. Generate real ones with:
#     openssl rand -hex 32
# and never commit them to version control.

# ── CORS / URLs ───────────────────────────────────────────────────────────────
# Comma-separated list of allowed origins. `credentials: true` is set, so "*"
# is rejected. Same-origin deployments only need the SPA origin.
CORS_ORIGIN=http://localhost:5173

# Public SPA origin (used for password-reset links and cookie handling).
APP_URL=http://localhost:5173

# ── Mailer ────────────────────────────────────────────────────────────────────
# Resend API key (https://resend.com/docs/api-reference/emails/send).
# Leave empty to use the log-only mailer (logs a REDACTED reset URL).
RESEND_API_KEY=
# Verified sender. Defaults to Resend's shared onboarding@resend.dev
# (only delivers to the account owner until you verify your own domain).
RESEND_FROM=
SMTP_URL=smtp://user:pass@localhost:1025

# ── Proxy / observability ─────────────────────────────────────────────────────
# Number of trusted reverse-proxy hops. nginx sets X-Forwarded-* in prod;
# keep 0 when the API is reached directly (local dev).
TRUST_PROXY_HOPS=0

# Set to true to return stack traces in 500 responses (dev only, never prod).
DEBUG_ERRORS=false

# pino log level: trace | debug | info | warn | error | fatal
LOG_LEVEL=info

# ── Rate limiting (window in ms, max requests per key) ────────────────────────
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_MAX=300
RATE_LIMIT_LOGIN_MAX=10
RATE_LIMIT_FORGOT_MAX=3

# ── Seed credentials (`npm run seed`, idempotent) ─────────────────────────────
SEED_ADMIN_EMAIL=admin@example.com
SEED_ADMIN_PASSWORD=Admin1234
SEED_USER_EMAIL=user@example.com
SEED_USER_PASSWORD=User1234
SEED_VIEWER_EMAIL=viewer@example.com
SEED_VIEWER_PASSWORD=Viewer1234

# ── Frontend (Vite, consumed at build time) ───────────────────────────────────
# Must match APP_URL.
VITE_APP_URL=http://localhost:5173

# Empty in dev → relative `/api/v1`, proxied by Vite (dev) or nginx (prod).
# Set to the API origin only for a split-origin deployment.
VITE_API_URL=