# ==============================================================================
# BetterShift Environment Configuration
# ==============================================================================
# Copy this file to .env and configure according to your needs
# Some values are pre-filled with defaults, others require your input


# ==============================================================================
# DATABASE
# ==============================================================================

DATABASE_URL=file:./data/sqlite.db


# ==============================================================================
# APPLICATION SETTINGS
# ==============================================================================

# Node.js environment (NOT supported in Docker)
NODE_ENV=production
HOSTNAME=0.0.0.0

# Internationalization
DEFAULT_LOCALE=en  # Options: en, de, it
TZ=Europe/Berlin   # Application timezone


# ==============================================================================
# AUTHENTICATION SYSTEM
# ==============================================================================
# Note: Auth is enabled by default for better security

# Core Auth Configuration
AUTH_ENABLED=true  # Set to false to disable authentication

# REQUIRED if AUTH_ENABLED=true:
BETTER_AUTH_SECRET=  # Generate with: npx @better-auth/cli secret
BETTER_AUTH_URL=http://localhost:3000  # Your application URL

# Security
# BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000,https://yourdomain.com  # Comma-separated list of allowed origins for CORS

# Access Control
ALLOW_USER_REGISTRATION=true   # Enable/disable new user signups
ALLOW_GUEST_ACCESS=false        # Allow viewing calendars without login

# Session Management (server-side only)
# SESSION_MAX_AGE=604800    # Session lifetime: 7 days (seconds)
# SESSION_UPDATE_AGE=86400  # Session refresh interval: 1 day (seconds)


# ==============================================================================
# OAUTH PROVIDERS
# ==============================================================================
# Note: CLIENT_IDs are exposed to client for UI detection
#       CLIENT_SECRETs remain server-only
# Callback URLs: {BETTER_AUTH_URL}/api/auth/callback/{provider}

# Google OAuth
# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=

# GitHub OAuth
# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=

# Discord OAuth
# DISCORD_CLIENT_ID=
# DISCORD_CLIENT_SECRET=


# ==============================================================================
# CUSTOM OIDC PROVIDER
# ==============================================================================
# Note: Client IDs are exposed to client for UI detection
#       Client Secrets remain server-only
# Callback URL: {BETTER_AUTH_URL}/api/auth/oauth2/callback/custom-oidc

# CUSTOM_OIDC_ENABLED=false
# CUSTOM_OIDC_NAME=Custom SSO  # Display name on login button
# CUSTOM_OIDC_CLIENT_ID=
# CUSTOM_OIDC_CLIENT_SECRET=
# CUSTOM_OIDC_ISSUER=https://sso.example.com/.well-known/openid-configuration
# CUSTOM_OIDC_SCOPES=openid profile email  # Space-separated list


# ==============================================================================
# GITHUB INTEGRATION
# ==============================================================================
# Used for version information endpoint

GITHUB_REPO_OWNER=panteLx
GITHUB_REPO_NAME=BetterShift

# Optional: Increases API rate limit from 60 to 5000 requests/hour
# GITHUB_TOKEN=


# ==============================================================================
# RATE LIMITING
# ==============================================================================

# All settings are optional - defaults shown in comments

# Authentication
# RATE_LIMIT_AUTH_REQUESTS=5 # Per IP
# RATE_LIMIT_AUTH_WINDOW=60  # 1 minute

# RATE_LIMIT_REGISTER_REQUESTS=3 # Per IP
# RATE_LIMIT_REGISTER_WINDOW=600  # 10 minutes

# RATE_LIMIT_PASSWORD_CHANGE_REQUESTS=3 # Per user
# RATE_LIMIT_PASSWORD_CHANGE_WINDOW=3600  # 1 hour

# Account Management
# RATE_LIMIT_ACCOUNT_DELETE_REQUESTS=1 # Per user
# RATE_LIMIT_ACCOUNT_DELETE_WINDOW=3600  # 1 hour

# RATE_LIMIT_UPLOAD_AVATAR_REQUESTS=5 # Per user
# RATE_LIMIT_UPLOAD_AVATAR_WINDOW=300  # 5 minutes

# Calendar Operations
# RATE_LIMIT_CALENDAR_CREATE_REQUESTS=10 # Per user
# RATE_LIMIT_CALENDAR_CREATE_WINDOW=3600  # 1 hour

# RATE_LIMIT_EXTERNAL_SYNC_REQUESTS=5  # Per calendar
# RATE_LIMIT_EXTERNAL_SYNC_WINDOW=300  # 5 minutes

# Export Features
# RATE_LIMIT_EXPORT_PDF_REQUESTS=10 # Per user
# RATE_LIMIT_EXPORT_PDF_WINDOW=600  # 10 minutes
# RATE_LIMIT_EXPORT_ICS_REQUESTS=20 # Per user
# RATE_LIMIT_EXPORT_ICS_WINDOW=600  # 10 minutes

# Calendar Access Tokens (Share Links)
# RATE_LIMIT_TOKEN_VALIDATION_REQUESTS=10 # Per IP
# RATE_LIMIT_TOKEN_VALIDATION_WINDOW=60  # 1 minute
# RATE_LIMIT_TOKEN_CREATION_REQUESTS=10 # Per calendar
# RATE_LIMIT_TOKEN_CREATION_WINDOW=3600  # 1 hour

# Admin Panel (per admin user)
# RATE_LIMIT_ADMIN_USER_MUTATIONS=10 # User ban/unban/delete/edit
# RATE_LIMIT_ADMIN_USER_MUTATIONS_WINDOW=60  # 1 minute
# RATE_LIMIT_ADMIN_PASSWORD_RESET=5 # Password reset for users
# RATE_LIMIT_ADMIN_PASSWORD_RESET_WINDOW=300  # 5 minutes
# RATE_LIMIT_ADMIN_BULK_OPERATIONS=3 # Bulk delete/transfer calendars
# RATE_LIMIT_ADMIN_BULK_OPERATIONS_WINDOW=300  # 5 minutes
# RATE_LIMIT_ADMIN_CALENDAR_MUTATIONS=10 # Calendar delete/transfer/edit
# RATE_LIMIT_ADMIN_CALENDAR_MUTATIONS_WINDOW=60  # 1 minute