# App
PORT=3001

# Optional instance prefix (informational for native dev; isolates Docker when using docker compose).
# Set PORT, VITE_PORT, and APP_URL manually per instance when running multiple copies on one host.
# APP_INSTANCE_PREFIX=
# VITE_PORT=5173
# VITE_API_PORT=3001

# Database (host port must match docker-compose POSTGRES_PORT; avoids clash with local Postgres on 5432)
POSTGRES_PORT=5440
DATABASE_URL=postgresql://postgres:postgres@localhost:5440/roleplay_app

# Scenario cover images (local filesystem; relative to server/ cwd). dev.sh sets this if omitted.
# VITE_API_PORT defaults from PORT when using npm run dev.
MEDIA_DIR=data/media

# Logging: TRACE | DEBUG | INFO | WARN | ERROR (default: INFO)
LOG_LEVEL=INFO

# Rate limiting (DoS protection). Window applies to both global and auth limiters.
# RATE_LIMIT_WINDOW_MS=900000
# RATE_LIMIT_MAX=2000
# AUTH_RATE_LIMIT_MAX=20
# Set when running behind a reverse proxy so limits use the real client IP:
# TRUST_PROXY=1

# Authentication protocol: local | oidc | saml
# If you want OIDC or SAML, set the appropriate variables (OIDC_* or SAML_*)
AUTH_PROTOCOL=local
JWT_SECRET=

# Optional: seed a default admin on init (omit both to use first-run setup UI instead).
# Seeded admins are forced to change their password on first login.
# ADMIN_EMAIL=
# ADMIN_PASSWORD=


# Public URL of the frontend (SPA redirect after SSO sign-in). Also used as a CORS allowlist entry.
APP_URL=http://localhost:5173
# Optional comma-separated extra browser origins allowed by CORS (in addition to APP_URL).
# CORS_ORIGINS=https://admin.example.com,https://app.example.com

# OIDC / SSO — set AUTH_PROTOCOL=oidc
#AUTH_PROTOCOL=oidc
#OIDC_CLIENT_ID=
#OIDC_CLIENT_SECRET=
# Issuer URL or full .well-known/openid-configuration URL
#OIDC_ISSUER_URL=
#OIDC_PROVIDER_NAME=SSO
#OIDC_SCOPES=openid email profile
#OIDC_REDIRECT_URI=http://localhost:5173/api/auth/oidc/callback

# SAML / SSO — set AUTH_PROTOCOL=saml
# Base64-encoded IdP metadata XML (single line). See AUTHENTICATION.md for Google Workspace setup.
# SAML_PROVIDER_NAME=Google
# SAML_IDP_METADATA=
# SAML_SP_ENTITY_ID=
# SAML_ACS_URL=
# SAML_SP_CERT_DIR=data/saml
# Optional: restrict Google account chooser to your Workspace domain
# SAML_GOOGLE_HD=yourcompany.com

# Optional fallback LLM keys (prefer admin UI at /settings/ai)
# OPENAI_API_KEY=
# ANTHROPIC_API_KEY=
# GOOGLE_API_KEY=

# Optional: disable specific feature-gated capabilities without a redeploy.
# Comma-separated, case-insensitive feature keys (e.g. the "leaderboard" gate on
# the homepage leaderboard panel + GET /api/points/leaderboard). Leave unset/empty
# to keep every feature enabled (the default).
# DISABLED_FEATURES=

# Development only: enable fast synthetic grading when the learner types
# "CHEAT MODE: <desired outcome>" in the conversation window (e.g.
# "CHEAT MODE: 81% Silver tier, passed with strong empathy scores").
# CHEAT_MODE=true