# Sonr Auth - Environment Configuration

# ==============================================================================
# Bridge URL Configuration
# ==============================================================================

# Bridge service URL (backend Go service)
# Production: https://api.sonr.id
# Development: http://localhost:8080
NEXT_PUBLIC_API_URL=http://localhost:8080

# ==============================================================================
# OpenID Connect Provider Configuration
# ==============================================================================

# OIDC Issuer URL (must be publicly accessible)
# This URL will be used in discovery documents and token validation
# Production: https://auth.sonr.id
# Development: http://localhost:3000
OIDC_ISSUER=http://localhost:3000

# Public URL for OIDC provider (if different from issuer)
# Used for external references and redirects
OIDC_PUBLIC_URL=http://localhost:3000

# Private key path for JWT token signing (PEM format)
# Generate with: openssl ecparam -genkey -name prime256v1 -noout -out oidc-signing.pem
OIDC_SIGNING_KEY_PATH=./keys/oidc-signing.pem

# Private key path for JWT token encryption (optional)
# Generate with: openssl ecparam -genkey -name prime256v1 -noout -out oidc-encryption.pem
OIDC_ENCRYPTION_KEY_PATH=./keys/oidc-encryption.pem

# ==============================================================================
# WebAuthn Configuration
# ==============================================================================

# Relying Party ID (usually the domain)
# Must match the domain where WebAuthn is used
# Production: sonr.id
# Development: localhost
WEBAUTHN_RP_ID=localhost

# Relying Party Name (displayed to users)
WEBAUTHN_RP_NAME=Sonr Identity Platform

# WebAuthn timeout in milliseconds
WEBAUTHN_TIMEOUT=60000

# ==============================================================================
# JWT Configuration
# ==============================================================================

# Secret key for JWT token generation and validation
# Use a strong, random string in production
# Generate with: openssl rand -base64 32
JWT_SECRET=highway-ucan-secret-key

# ==============================================================================
# Redis Configuration (for session storage)
# ==============================================================================

# Redis connection string
# Production: Use Redis cluster or managed Redis service
# Development: Local Redis instance
REDIS_ADDR=127.0.0.1:6379

# Redis password (if required)
# REDIS_PASSWORD=your-redis-password

# Redis database number
# REDIS_DB=0

# ==============================================================================
# OIDC Client Configuration
# ==============================================================================

# Default client ID for self-issued tokens
OIDC_CLIENT_ID=sonr-auth

# Allowed redirect URIs (comma-separated)
# Add all domains that will use this OIDC provider
OIDC_ALLOWED_REDIRECT_URIS=http://localhost:3000/callback,http://localhost:3001/callback,https://localhost:3000/callback,https://localhost:3001/callback

# Supported scopes (comma-separated)
OIDC_SUPPORTED_SCOPES=openid,profile,email,did,vault,offline_access

# ==============================================================================
# Development Configuration
# ==============================================================================

# Enable debug logging
DEBUG=false

# Log level (error, warn, info, debug)
LOG_LEVEL=info

# Enable CORS for development
CORS_ENABLED=true

# CORS allowed origins (comma-separated)
CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3001,https://localhost:3000,https://localhost:3001

# ==============================================================================
# Production Configuration
# ==============================================================================

# Domain for secure cookies
# COOKIE_DOMAIN=.sonr.id

# Secure cookie settings (true for HTTPS)
# COOKIE_SECURE=true

# SameSite cookie attribute (strict, lax, none)
# COOKIE_SAME_SITE=lax

# Session timeout in milliseconds (default: 1 hour)
# SESSION_TIMEOUT=3600000

# Refresh token TTL in milliseconds (default: 7 days)
# REFRESH_TOKEN_TTL=604800000

# ==============================================================================
# Optional Integrations
# ==============================================================================

# IPFS configuration (if using decentralized storage)
# IPFS_API_URL=http://localhost:5001

# Blockchain RPC endpoint (if direct blockchain interaction is needed)
# BLOCKCHAIN_RPC_URL=http://localhost:26657

# Analytics configuration
# ANALYTICS_ENABLED=false
# ANALYTICS_API_KEY=your-analytics-key