# ==============================================================================
# PRODUCTION ENVIRONMENT CONFIGURATION (.env)
# ==============================================================================
# SETUP INSTRUCTIONS:
# 1. Do NOT commit secrets or sensitive credentials to version control.
# 2. In production, configure environment variables in your deployment platform
#    (e.g., Docker, AWS ECS, Kubernetes, Render, Railway, or EC2 systemd).
# 3. For local development, copy your personal values into '.env.local', which is
#    automatically loaded and overrides values in this file.
# ==============================================================================

# ------------------------------------------------------------------------------
# SERVER & CORS
# ------------------------------------------------------------------------------
# Port on which the NestJS backend HTTP server listens.
PORT=8080

# Allowed client origin for CORS requests (MUST match production frontend URL).
# No default fallback is permitted in production code.
CORS_ORIGIN=https://hannah.ilike999.games

# ------------------------------------------------------------------------------
# MYSQL DATABASE
# ------------------------------------------------------------------------------
# MySQL server host / cluster endpoint
DB_HOST=localhost
DB_PORT=3306
DB_USER=ilikcpfz_hannah_admin
DB_PASSWORD="Super@hannah#55"
DB_NAME=ilikcpfz_hannah_userdetails

# In production, ALWAYS set DB_SYNCHRONIZE=false.
# Schema changes must be applied via versioned migrations, not auto-sync.
DB_SYNCHRONIZE=false

# ------------------------------------------------------------------------------
# JWT AUTHENTICATION
# ------------------------------------------------------------------------------
# Cryptographically secure 256-bit secret keys.
# Generate strong production secrets via:
#   openssl rand -base64 32
JWT_ACCESS_SECRET=325f911e3533356426aed22881d2a6be
JWT_REFRESH_SECRET=bcc0b97fa63d501e60ad497dad592c1d

# Token Expirations
# Access token validity (e.g. 900s / 15m)
JWT_ACCESS_EXPIRATION=900s
# Refresh token validity (e.g. 7d)
JWT_REFRESH_EXPIRATION=7d

# Cookie Security: In production over HTTPS, COOKIE_SECURE MUST be true.
COOKIE_SECURE=true
# Cookie SameSite policy: MUST be 'none' when frontend and backend are on different subdomains (amy.ilike999.games & api.amy.ilike999.games) with COOKIE_SECURE=true.
COOKIE_SAME_SITE=none

# ------------------------------------------------------------------------------
# EMAIL NOTIFICATIONS (SMTP)
# ------------------------------------------------------------------------------
# SMTP Server settings for sending password reset verification codes.
# For Gmail SMTP:
# 1. Enable 2-Step Verification in Google Account.
# 2. Go to Security -> App Passwords and generate a 16-character App Password.
MAIL_HOST=smtp.gmail.com
MAIL_PORT=587
MAIL_USER=haridahannah02@gmail.com
MAIL_PASS=hxokgqwpeqhzujzx
MAIL_FROM=haridahannah02@gmail.com

# ------------------------------------------------------------------------------
# RATE LIMITING & SECURITY LIMITS
# ------------------------------------------------------------------------------
# Cooldown in seconds between successive OTP requests for the same email
RATE_LIMIT_OTP_COOLDOWN_SECONDS=60

# Max OTP requests allowed per email per hour
RATE_LIMIT_MAX_OTP_PER_EMAIL_HOUR=5

# Max OTP requests allowed per IP per hour
RATE_LIMIT_MAX_OTP_PER_IP_HOUR=10

# Max allowed failed OTP verifications before temporary lockout
RATE_LIMIT_MAX_VERIFY_FAILURES=5

# Time window in minutes for tracking failed verify attempts
RATE_LIMIT_VERIFY_WINDOW_MINUTES=15

# Global maximum requests across all forgot-password endpoints per IP per hour
RATE_LIMIT_GLOBAL_IP_MAX_HOUR=30

# Validity in minutes for the single-use reset token issued after OTP verification
RESET_TOKEN_VALIDITY_MINUTES=10


# Intercom Messenger Identity Verification Key
INTERCOM_SECRET_KEY=Jb8ML6SeAo9eEF5rPiFj7RqDxv6uA00EVb_Kcrz12rA

# Google OAuth2
GOOGLE_CLIENT_ID=1073537571906-28t3qpl6muce133j23angtlupeepousv.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=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
GOOGLE_CALLBACK_URL=https://api.hannah.ilike999.games/api/v1/auth/google/callback

# Frontend origin (used to redirect the browser after Google OAuth)
FRONTEND_URL=https://hannah.ilike999.games
