# ─────────────────────────────────────────────
# Server
# ─────────────────────────────────────────────
NODE_ENV=development
PORT=3001
BACKEND_URL=http://localhost:3001
FRONTEND_URL=http://localhost:3000,http://localhost:3001
PROJECT_NAME=SSO VietProDev
PROJECT_VERSION=1.0.0

# ─────────────────────────────────────────────
# Database - PostgreSQL (SECRETS - keep in .env)
# ─────────────────────────────────────────────
# Main DB: SSO server reads + writes here.
DB_HOST=localhost
DB_PORT=5432
DB_USER=postgres
DB_PASSWORD=postgres
DB_NAME=sso
# Connection string (optional: use instead of individual DB_HOST/DB_USER/DB_PASSWORD)
DB_CONNECTION_STRING=
# Backup / HA DB: used for failover and (Phase 3) read-only fallback.
# MultiPoolService auto-loads this when SSO_LOGIN_BACKUP_URL is set.
SSO_LOGIN_BACKUP_URL=
# Read-only fallback block (consumed by MultiPoolService.getReadPool()).
DB_READ_HOST=
DB_READ_PORT=5433
DB_READ_USER=postgres
DB_READ_PASSWORD=postgres
DB_READ_NAME=sso_backup
DB_POOL_MAX=50
DB_POOL_MIN=5
DB_POOL_ACQUIRE=30000
DB_POOL_IDLE=10000
DB_POOL_EVICT=60000

# ─────────────────────────────────────────────
# MongoDB - Audit Logging (SECRETS - keep in .env)
# ─────────────────────────────────────────────
MONGODB_AUDIT_URL=mongodb://localhost:27017
MONGODB_AUDIT_DATABASE=sso_audit

# ─────────────────────────────────────────────
# Redis (SECRETS - keep in .env)
# ─────────────────────────────────────────────
REDIS_ENABLED=true
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=
REDIS_DB=0
REDIS_CONNECT_TIMEOUT=10000
REDIS_COMMAND_TIMEOUT=5000
REDIS_MAX_RETRIES=3
REDIS_IP_FAMILY=4

# Redis A (for clustering/special use)
REDIS_A_ENABLED=false
REDIS_A_HOST=localhost
REDIS_A_PORT=6379
REDIS_A_PASSWORD=
REDIS_A_CLUSTER=false
REDIS_A_CLUSTER_NODES=

# Redis B (for caching/special use)
REDIS_B_HOST=localhost
REDIS_B_PORT=6380
REDIS_B_PASSWORD=
REDIS_B_DB=0

# ─────────────────────────────────────────────
# Authentication & Security (SECRETS - keep in .env)
# ─────────────────────────────────────────────
JWT_SECRET=change_this_to_strong_secret_min_32_chars
JWT_SECRET_PREVIOUS=old_secret_1,old_secret_2
JWT_REFRESH_SECRET=change_this_to_strong_refresh_secret_min_32_chars
JWT_REFRESH_SECRET_PREVIOUS=old_refresh_secret_1,old_refresh_secret_2
JWT_EXPIRES_IN=1h
JWT_REFRESH_EXPIRES_IN=7d
TOKEN_ENCRYPTION_KEY=change_this_to_exactly_32_chars
TOKEN_ENCRYPTION_KEY_PREVIOUS=old_encryption_key_1,old_encryption_key_2
DEFAULT_PASSWORD=Vietpro@123
BCRYPT_ROUNDS=12
PASSWORD_MIN_LENGTH=8
PASSWORD_MAX_LENGTH=128
INCLUDE_TOKENS_IN_RESPONSE=false
SKIP_SENSITIVE_CONFIRM=false
ENABLE_REGISTER=true

# ─────────────────────────────────────────────
# OIDC Provider (SECRETS - keep in .env)
# ─────────────────────────────────────────────
OIDC_ISSUER=http://localhost:3001
OIDC_ACCESS_TOKEN_TTL=900
OIDC_REFRESH_TOKEN_TTL=2592000
OIDC_COOKIE_KEYS=change_this_cookie_key_at_least_32_chars,another_cookie_key_for_rotation

# ─────────────────────────────────────────────
# Cookie Settings
# ─────────────────────────────────────────────
COOKIE_DOMAIN=.localhost
COOKIE_CROSS_SITE=false
FORCE_SECURE_COOKIES=false
DEV_SAMESITE_LAX=true

# ─────────────────────────────────────────────
# Upload Settings
# ─────────────────────────────────────────────
UPLOAD_PATH=./storage/uploads
MAX_FILE_SIZE=10485760
STORAGE_IMAGES_PATH=/storage/uploads/images
STORAGE_VIDEOS_PATH=/storage/uploads/videos
STORAGE_FILES_PATH=/storage/uploads/files

# ─────────────────────────────────────────────
# Storage (MinIO/S3)
# ─────────────────────────────────────────────
STORAGE_PROVIDER=local
PUBLIC_BASE_URL=http://localhost:3001
LOCAL_STORAGE_ROOT=./storage/uploads
MINIO_ENDPOINT=localhost
MINIO_PORT=9000
MINIO_USE_SSL=false
MINIO_ACCESS_KEY=minioadmin
MINIO_SECRET_KEY=minioadmin123
MINIO_BUCKET=uploads
MINIO_REGION=us-east-1

# ─────────────────────────────────────────────
# Email (SECRETS - keep in .env)
# ─────────────────────────────────────────────
EMAIL_HOST=smtp.example.com
EMAIL_PORT=587
EMAIL_USER=
EMAIL_PASS=
EMAIL_FROM=noreply@yourdomain.com

# ─────────────────────────────────────────────
# Notifications & Queue
# ─────────────────────────────────────────────
QUEUE_CONCURRENCY=10
WORKER_CONCURRENCY=20
JOB_ATTEMPTS=3
JOB_BACKOFF_DELAY=2000
MAX_LOGIN_ATTEMPTS=5
LOCKOUT_DURATION_MINUTES=15
PERM_CACHE_TTL=300
SESSION_CACHE_TTL=900
REUSE_WINDOW_SECONDS=30

# ─────────────────────────────────────────────
# CSRF Protection
# ─────────────────────────────────────────────
CSRF_ORIGIN_VALIDATION=true
CSRF_DOUBLE_SUBMIT=true
CSRF_HTTPONLY=true

# ─────────────────────────────────────────────
# Zalo (SECRETS - keep in .env)
# ─────────────────────────────────────────────
ZALO_APP_ID=
ZALO_SECRET_KEY=
ZALO_OA_ACCESS_TOKEN=
ZALO_ZNS_ACCESS_TOKEN=
ZALO_ZNS_TEMPLATE_ID=

# ─────────────────────────────────────────────
# OneSignal (SECRETS - keep in .env)
# ─────────────────────────────────────────────
ONESIGNAL_APP_ID=
ONESIGNAL_API_KEY=

# ─────────────────────────────────────────────
# VAPID (SECRETS - keep in .env)
# ─────────────────────────────────────────────
VAPID_SUBJECT=mailto:admin@yourdomain.com
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=

# ─────────────────────────────────────────────
# Idempotency & Circuit Breaker
# ─────────────────────────────────────────────
IDEMPOTENCY_KEY_TTL=86400
CIRCUIT_BREAKER_ERROR_RATE=0.3
CIRCUIT_BREAKER_MIN_REQUESTS=100
CIRCUIT_BREAKER_TIMEOUT=300000
PARTITION_RETAIN_MONTHS=12

# ─────────────────────────────────────────────
# Virus Scan (ClamAV)
# ─────────────────────────────────────────────
VIRUS_SCAN_ENABLED=true
VIRUS_SCAN_FAIL_OPEN=false
CLAM_HOST=127.0.0.1
CLAM_PORT=3310
CLAM_SOCKET=
CLAM_SCAN_TIMEOUT_MS=15000

# ─────────────────────────────────────────────
# Logging (Environment-specific)
# ─────────────────────────────────────────────
LOG_LEVEL=info
LOG_URL=./storage/logs
LOG_MODE=both
LOG_TIMEOUT=5000

# ─────────────────────────────────────────────
# CORS
# ─────────────────────────────────────────────
DEV_CORS_DISABLE=false

# ─────────────────────────────────────────────
# Debug
# ─────────────────────────────────────────────
LOG_CONFIG_SOURCES=false
