# OpenClaw M365 Access Broker configuration
# Copy to .env and fill in. With no real credentials the broker runs in DRY_RUN mode.

# Set to "false" to call real Microsoft Graph. Defaults to true (mock Graph, no network).
BROKER_DRY_RUN=true

# MSAL / Entra app registration (single-tenant, delegated auth recommended)
MS_TENANT_ID=
MS_CLIENT_ID=
# Authorization Code + PKCE does not require a secret for public clients.
MS_CLIENT_SECRET=
MS_REDIRECT_URI=http://localhost:3000/auth/callback

# Local broker HTTP server
BROKER_PORT=8787
# Agent credential (x-broker-key) for read/draft/execute calls.
# Host-UI credential (x-approver-key) for minting approvals — keep separate so
# the agent cannot grant its own approval. If either is empty the server
# generates an ephemeral key at startup and prints it (no "no auth" mode).
BROKER_KEY=
BROKER_APPROVER_KEY=

# Audit log path (JSON lines). Must be relative to the repo root.
BROKER_AUDIT_LOG=audit.log

# Required for live (BROKER_DRY_RUN=false) client-credentials Graph.
# App-only tokens cannot call /me — set the Entra user object id.
BROKER_GRAPH_USER_ID=

# ── Server hardening ──────────────────────────────────────────────────────────
# Maximum request body size in bytes (default 1 MB = 1048576).
BROKER_MAX_BODY_BYTES=1048576

# Rate limiting: fixed-window per-IP.
# Window size in milliseconds (default 60000 = 60 seconds).
BROKER_RATE_LIMIT_WINDOW_MS=60000
# Max requests per window per IP (default 120).
BROKER_RATE_LIMIT_MAX=120
# Extra requests allowed in a burst (default 30).
BROKER_RATE_LIMIT_BURST=30

# CORS: comma-separated list of allowed origins.
# Empty = no CORS headers (loopback-only; browser cross-origin requests blocked).
# Example: BROKER_CORS_ORIGINS=http://localhost:3000,https://my-ui.example.com
BROKER_CORS_ORIGINS=

# Graceful shutdown: how long to wait for in-flight requests in milliseconds.
BROKER_SHUTDOWN_TIMEOUT_MS=10000