# ==============================================================================
# NEXUS ERP - Environment Variables Template
# ==============================================================================
# ⚠️ IMPORTANT: DO NOT COMMIT REAL SECRETS TO THIS FILE ⚠️
# Copy this file to .env and fill in the values for your local environment.
# ==============================================================================

# ------------------------------------------------------------------------------
# 1. DATABASE CONFIGURATION
# ------------------------------------------------------------------------------
# Example PostgreSQL connection string
# Format: postgresql://USER:PASSWORD@HOST:PORT/DATABASE?schema=public
DATABASE_URL="postgresql://postgres:postgres@localhost:5432/nexuserp?schema=public"

# ------------------------------------------------------------------------------
# 2. NEXT AUTH (Authentication)
# ------------------------------------------------------------------------------
# NextAuth Secret used to encrypt JWT tokens.
# Generate a secure secret using: openssl rand -base64 32
AUTH_SECRET="your_super_secret_auth_string_here_min_32_chars"

# Base URL for the application (required for NextAuth in production)
NEXTAUTH_URL="http://localhost:3000"

# JWT/session lifetime in seconds (default: 86400 = 24h)
JWT_MAX_AGE="86400"

# ------------------------------------------------------------------------------
# 3. ENCRYPTION (Field-Level Encryption at Rest)
# ------------------------------------------------------------------------------
# Used by src/lib/encryption.ts for encrypting PII data (IBAN, TaxId, etc.)
# ENCRYPTION_KEY must be exactly 32 bytes (256-bit) encoded as hex or string
# Generate using: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
ENCRYPTION_KEY="your_32_byte_encryption_key_here_"

# Salt for key derivation
# Generate using: node -e "console.log(require('crypto').randomBytes(16).toString('hex'))"
ENCRYPTION_SALT="your_unique_salt_here"

# After backfilling/encrypting all legacy rows, set this to "true" to CLOSE the
# plaintext fallback: decrypt() will then throw on any unencrypted value instead
# of silently passing it through (KVKK compliance). Leave unset/false during the
# initial migration window.
# ENCRYPTION_STRICT="true"

# ------------------------------------------------------------------------------
# 4. GIB E-INVOICE (e-Fatura Integration - Optional)
# ------------------------------------------------------------------------------
# Gelir İdaresi Başkanlığı (GIB) Test Credentials
GIB_ENVIRONMENT="test"            # "test" | "production"
GIB_USERNAME="gib_test_username"
GIB_PASSWORD="gib_test_password"
GIB_ENDPOINT="https://earsivwstest.efatura.gov.tr/earsivws/earsivWS"
# Mali mühür (P12) — required to digitally sign e-Invoices (see DOM-3 backlog)
# GIB_CERT_PATH="/secrets/mali-muhur.p12"
# GIB_CERT_PASSWORD=""

# ------------------------------------------------------------------------------
# 5. REDIS (Rate Limiting & Caching - Optional)
# ------------------------------------------------------------------------------
# If you are using Redis for rate limiting (BullMQ / Upstash)
REDIS_URL="redis://localhost:6379"

# ------------------------------------------------------------------------------
# 6. SENTRY (Error Tracking - Optional)
# ------------------------------------------------------------------------------
NEXT_PUBLIC_SENTRY_DSN=""
SENTRY_AUTH_TOKEN=""
# Optional trace sampling overrides (defaults: 0.1 in production, 1 in dev)
# SENTRY_TRACES_SAMPLE_RATE="0.1"
# NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE="0.1"