# ─────────────────────────────────────────────────────────────────────────
# boha-app-ts environment template. Copy to `.env` (dev) / `.env.test` (tests).
# Required vars throw at boot if missing; optional vars show their defaults.
# ─────────────────────────────────────────────────────────────────────────

# ── Required ──────────────────────────────────────────────────────────────
DATABASE_URL=mysql://user:password@localhost:3306/app
# Auth — MUST regenerate for production: openssl rand -hex 32
JWT_SECRET=REPLACE_WITH_64_CHAR_HEX_STRING_RUN_openssl_rand_hex_32
# TOTP — MUST regenerate for production: openssl rand -hex 32
TOTP_ENCRYPTION_KEY=REPLACE_WITH_64_CHAR_HEX_STRING_RUN_openssl_rand_hex_32

# ── Server ────────────────────────────────────────────────────────────────
PORT=3001                       # production port (dev is hardcoded to 3050)
HOST=127.0.0.1
APP_ENV=local                   # local | production — controls CSP/CORS/HSTS
APP_URL=                        # base URL used in email links
# TRUST_PROXY=127.0.0.1,::1     # comma-separated trusted proxy IPs

# ── Tokens (seconds) ──────────────────────────────────────────────────────
ACCESS_TOKEN_EXPIRY=900
REFRESH_TOKEN_SESSION_EXPIRY=3600
REFRESH_TOKEN_REMEMBER_EXPIRY=2592000

# ── TOTP / 2FA (optional, sensible defaults) ──────────────────────────────
# TOTP_ALGORITHM=SHA1
# TOTP_DIGITS=6
# TOTP_PERIOD=30
# LOGIN_TOKEN_EXPIRY_MINUTES=5

# ── Rate limiting (optional) ──────────────────────────────────────────────
# RATE_LIMIT_MAX=300
# RATE_LIMIT_WINDOW=1 minute
# RATE_LIMIT_LOGIN=20
# RATE_LIMIT_TOTP=5
# RATE_LIMIT_REFRESH=10

# ── File storage (NAS network shares) ─────────────────────────────────────
NAS_PATH=Z:/02_PROJEKTY
# NAS_INVOICES=                  # invoice PDFs — {base}/Vydané|Přijaté/YYYY/MM/ (falls back to NAS_FINANCIALS_PATH if unset)
# NAS_ORDERS=                    # issued-order PDF archival — {base}/Vydané/YYYY/MM/ (off until set)
# NAS_OFFERS_PATH=
MAX_UPLOAD_SIZE=52428800        # 50 MB

# ── Email ─────────────────────────────────────────────────────────────────
CONTACT_EMAIL_TO=
CONTACT_EMAIL_FROM=
SMTP_FROM=
# SMTP_FROM_NAME=
LEAVE_NOTIFY_EMAIL=
# INVOICE_ALERT_EMAIL=          # set to enable the daily 08:00 invoice-alert cron
# Optional SMTP transport (defaults to local sendmail when SMTP_HOST is unset):
# SMTP_HOST=
# SMTP_PORT=587
# SMTP_SECURE=false
# SMTP_USER=
# SMTP_PASS=

# ── CORS (production only, comma-separated) ───────────────────────────────
CORS_ORIGINS=

# ── AI assistant "Odin" (optional; feature self-hides when unset) ─────────
# ANTHROPIC_API_KEY=