# ============================================================================
# Athens — environment template
# Copy to `.env` and fill in. NEVER commit the real `.env` (it's in .gitignore).
#
# Two trust zones:
#   [CLIENT/PUBLIC]  safe to ship in Flutter app + Next.js bundle
#   [SERVER/SECRET]  only inside Supabase Edge Functions — never in client
# ============================================================================

# --------------------------------------------------------------------------
# Supabase  (supabase.com → project → Settings → API)
# --------------------------------------------------------------------------
# [CLIENT/PUBLIC]
SUPABASE_URL=https://hgehnwruprjoeewrhbgg.supabase.co
SUPABASE_PUBLISHABLE_KEY=sb_publishable_95DwN8H2geR3HQ-f3ixCsw_iYXhX7A5

# [SERVER/SECRET]  service-role key bypasses RLS. Set it ONLY as a Supabase
# edge-function secret (`supabase secrets set ...`) — never in this client file.
SUPABASE_SECRET_KEY=<service-role-key — edge functions only>

# --------------------------------------------------------------------------
# Spotify  (developer.spotify.com → your app → Settings)
# Owner must have Spotify Premium. Dev mode = max 5 connected users.
# Redirect URIs to register EXACTLY in the dashboard:
#   mobile  -> athens://spotify-callback
#   local   -> http://127.0.0.1:8888/callback
# Required scope: user-read-recently-played
# --------------------------------------------------------------------------
# [CLIENT/PUBLIC]
SPOTIFY_CLIENT_ID=fa42c012e91349908fa86e26b7fdb0d8
SPOTIFY_REDIRECT_URI_MOBILE=athens://spotify-callback
SPOTIFY_REDIRECT_URI_LOCAL=http://127.0.0.1:8888/callback

# [SERVER/SECRET]  used only by the spotify-app-token edge function.
# Do NOT add the Spotify client secret here. Set it server-side:
#   supabase secrets set SPOTIFY_CLIENT_SECRET <value>

# --------------------------------------------------------------------------
# Last.fm  (last.fm/api/account/create)
# --------------------------------------------------------------------------
# [SERVER/SECRET]  proxied by the lastfm-proxy edge function — never bundled.
# Set the API key + shared secret server-side:
#   supabase secrets set LASTFM_API_KEY <value> LASTFM_SHARED_SECRET <value>

# --------------------------------------------------------------------------
# MusicBrainz — no API key, but requires a descriptive User-Agent
# Format: AppName/Version ( contact@email.com )
# Max 1 request/second.
# --------------------------------------------------------------------------
# [CLIENT/PUBLIC]
MUSICBRAINZ_USER_AGENT=Athens/0.1 ( jwhong@postech.ac.kr )