# Port the server listens on (also the host-side port exposed by docker-compose)
PORT=3000

# Absolute path inside the container where slateflow.db is stored.
# /data is mapped to the slateflow-data Docker volume for persistence.
DATABASE_PATH=/data/slateflow.db

# Secret key used to sign JWT auth tokens. REQUIRED in production — the server
# refuses to start without it when NODE_ENV=production.
# Generate one with: openssl rand -hex 32
JWT_SECRET=change-me-in-production

FEATURE_AI=false
FEATURE_AUTO_TEST_CASE_GENERATION_AI=false
FEATURE_AUTO_STORY_GENERATION_AI=false
FEATURE_RETROSPECTIVE=false
FEATURE_CALENDAR=false

# ── Card attachments (feature-gated) ─────────────────────────────────────────
# FEATURE_CARD_ATTACHMENTS=false     # Enables file uploads on story cards
# UPLOADS_DIR=./uploads              # Storage dir; /data/uploads in Docker

# ── MCP tools for AI assistants (feature-gated, per capability) ──────────────
# FEATURE_READ_MCP=false             # list/get operations
# FEATURE_CREATE_MCP=false           # create operations
# FEATURE_UPDATE_MCP=false           # update/move operations
# FEATURE_DELETE_MCP=false           # delete operations (separate safety gate)
# FEATURE_REPORT_MCP=false           # reporting tools (velocity, cycle time, …)

# ── Login methods (feature-gated) ────────────────────────────────────────────
# Each FEATURE_AUTH_* env var is the hard ceiling: 'false' disables that login
# method outright. Leaving it unset lets a super_admin toggle it from the
# Admin → Settings panel. Default: only password login is on.
FEATURE_AUTH_PASSWORD=true
FEATURE_AUTH_GOOGLE=false
FEATURE_AUTH_GITHUB=false

# OAuth client credentials. Only required when the matching FEATURE_AUTH_* flag
# is enabled. Configure the redirect URI in the provider console as:
#   <OAUTH_REDIRECT_BASE_URL>/api/auth/<provider>/callback
OAUTH_REDIRECT_BASE_URL=http://localhost:3000

# Origin to send the browser to after a successful OAuth login. Leave unset
# if the frontend is served from the same origin as the API (default). Set
# when the frontend is on a different host (e.g. Vercel) than the API.
OAUTH_FRONTEND_URL=

OAUTH_GOOGLE_CLIENT_ID=
OAUTH_GOOGLE_CLIENT_SECRET=
OAUTH_GITHUB_CLIENT_ID=
OAUTH_GITHUB_CLIENT_SECRET=

# AI settings — set FEATURE_AI=true to enable
# AI_PROVIDER=claude        # claude | gemini | openai | azure | ollama
# AI_MODEL=claude-sonnet-4-6
# AI_API_KEY=your-api-key-here
# AI_BASE_URL=              # optional; required for azure (full deployment URL)

# ── GitHub integration (feature-gated) ───────────────────────────────────────
# FEATURE_GITHUB_INTEGRATION=false   # Hard ceiling; leave unset to let admin toggle
# GITHUB_WEBHOOK_SECRET=             # HMAC-SHA256 secret configured in GitHub webhook settings
# GITHUB_TOKEN=                      # Optional; PAT for fetching metadata from private repos

# ── GitLab integration (feature-gated) ───────────────────────────────────────
# FEATURE_GITLAB_INTEGRATION=false   # Hard ceiling; leave unset to let admin toggle
# GITLAB_WEBHOOK_SECRET=             # Secret token for X-Gitlab-Token header verification
# GITLAB_TOKEN=                      # Optional; PAT for fetching metadata from private repos

# ── Email notifications (feature-gated) ──────────────────────────────────────
FEATURE_EMAIL_NOTIFICATIONS=false
# SMTP_HOST=                         # SMTP server hostname (enables email sending when set)
# SMTP_PORT=587
# SMTP_SECURE=false                  # Set to true for port 465
# SMTP_USER=
# SMTP_PASS=
# SMTP_FROM=SlateFlow <noreply@example.com>  # From address for outbound emails