# OAuth 2.1 Configuration Example
# Copy this to .env and update with your Google OAuth credentials

# Required: Google OAuth 2.0 Client Credentials
# Note: OAuth 2.1 will automatically use GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET
# if OAUTH2_CLIENT_ID and OAUTH2_CLIENT_SECRET are not set

GOOGLE_OAUTH_CLIENT_ID="your-google-client-id"
GOOGLE_OAUTH_CLIENT_SECRET="your-google-client-secret"

# Development Settings (set to true for localhost testing)
OAUTH2_ALLOW_INSECURE_TRANSPORT=false
OAUTH2_ENABLE_DEBUG=false

# Legacy Compatibility (recommended during migration)
OAUTH2_ENABLE_LEGACY_AUTH=true

# ---------------------------------------------------------------------------
# FastMCP OAuth Proxy Token Lifetime Tuning (OAuth 2.1, optional)
#
# These settings mitigate client refresh-token races by making client-facing
# access-token refreshes less frequent and refreshing Google's upstream access
# token shortly before expiry. They do not add a grace period to FastMCP's
# one-time-use client refresh tokens.
#
# Leave both unset to preserve FastMCP's defaults. Invalid or out-of-range values
# are ignored with a warning.
#
# Refresh Google's upstream access token early. Allowed range: 0-300 seconds.
# A small value such as 30-120 seconds is recommended; values near Google's
# access-token lifetime would otherwise cause a refresh on every request.
# WORKSPACE_MCP_OAUTH_PROXY_TOKEN_EXPIRY_THRESHOLD_SECONDS=60
#
# Client-facing FastMCP access-token lifetime. Allowed range: 1-2592000 seconds
# (30 days). A longer lifetime reduces client refreshes but also lengthens the
# replay window if a FastMCP bearer token is stolen. 86400 (24 hours) is a
# conservative starting point for clients that race hourly refreshes.
# WORKSPACE_MCP_OAUTH_PROXY_ACCESS_TOKEN_EXPIRY_SECONDS=86400
#
# ---------------------------------------------------------------------------
# FastMCP OAuth Proxy Storage Backends (OAuth 2.1)
#
# Storage backend for OAuth proxy state. Options: memory, disk, valkey
# Default: FastMCP's built-in default (disk on Mac/Windows, memory on Linux)
#
# WORKSPACE_MCP_OAUTH_PROXY_STORAGE_BACKEND=memory|disk|valkey
#
# ---------------------------------------------------------------------------
# Memory Storage (default on Linux)
# - Fast, no persistence, data lost on restart
# - Best for: development, testing, stateless deployments
#
# WORKSPACE_MCP_OAUTH_PROXY_STORAGE_BACKEND=memory
#
# ---------------------------------------------------------------------------
# Disk Storage (default on Mac/Windows)
# - Persists across restarts, single-server only
# - Best for: single-server production, persistent caching
#
# WORKSPACE_MCP_OAUTH_PROXY_STORAGE_BACKEND=disk
# WORKSPACE_MCP_OAUTH_PROXY_DISK_DIRECTORY=~/.fastmcp/oauth-proxy
#
# ---------------------------------------------------------------------------
# Valkey/Redis Storage
# - Distributed, multi-server support
# - Best for: production, multi-server deployments, cloud native
#
# WORKSPACE_MCP_OAUTH_PROXY_STORAGE_BACKEND=valkey
# WORKSPACE_MCP_OAUTH_PROXY_VALKEY_HOST=localhost
# WORKSPACE_MCP_OAUTH_PROXY_VALKEY_PORT=6379
# WORKSPACE_MCP_OAUTH_PROXY_VALKEY_USE_TLS=false
# WORKSPACE_MCP_OAUTH_PROXY_VALKEY_DB=0
# WORKSPACE_MCP_OAUTH_PROXY_VALKEY_USERNAME=
# WORKSPACE_MCP_OAUTH_PROXY_VALKEY_PASSWORD=
# WORKSPACE_MCP_OAUTH_PROXY_VALKEY_REQUEST_TIMEOUT_MS=5000
# WORKSPACE_MCP_OAUTH_PROXY_VALKEY_CONNECTION_TIMEOUT_MS=10000
#
# ---------------------------------------------------------------------------
# Encryption:
# - Disk and Valkey storage are encrypted with Fernet.
# - Key derived from FASTMCP_SERVER_AUTH_GOOGLE_JWT_SIGNING_KEY if set,
#   otherwise from GOOGLE_OAUTH_CLIENT_SECRET.
# - For stable decryption across client-secret rotations, set
#   FASTMCP_SERVER_AUTH_GOOGLE_JWT_SIGNING_KEY explicitly.
#
# ---------------------------------------------------------------------------
# OAuth Consent Page Branding (optional)
#
# FastMCP's OAuth proxy renders the consent screen from the server's name, icon,
# and website. These env vars set those fields; unset leaves FastMCP's defaults
# (its name and logo). The icon accepts a hosted URL or an inline data: URI and is
# displayed at 64px wide — provide a ~64px image (or ~128px for retina sharpness).
#
# WORKSPACE_MCP_BRAND_NAME="My Workspace MCP"
# WORKSPACE_MCP_BRAND_ICON_URL=https://example.com/logo.png   # shown at 64px wide
# WORKSPACE_MCP_BRAND_WEBSITE_URL=https://example.com