NODE_ENV=development
PORT=5002
BASE_PATH=/api/v1
APP_ORIGIN=http://localhost:3000
CORS_ORIGINS=http://localhost:3000,http://localhost:3001,app.upharm.co.uk,app.upharm.co.uk
BACKEND_URL=http://localhost:5002

# SQLite. Relative paths resolve from the prisma/ folder, so this creates app_backend/data/upharm.db.
# In production use an absolute path outside the public web root, e.g. file:/home/<user>/upharm-data/upharm.db
DATABASE_URL="file:../data/upharm.db"

JWT_SECRET=replace-with-a-long-random-secret
JWT_EXPIRES_IN=15m
JWT_REFRESH_SECRET=replace-with-a-different-long-random-secret
JWT_REFRESH_EXPIRES_IN=30d

# Optional social login. Leave these empty when OAuth is not enabled.
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_REDIRECT_URI=http://localhost:3000/api/backend/api/v1/auth/oauth/google/callback
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=
MICROSOFT_TENANT_ID=common
MICROSOFT_REDIRECT_URI=/api/v1/auth/oauth/microsoft/callback

# Transactional email through Resend. Verify the sender domain in Resend first.
# Without RESEND_API_KEY, development logs email content instead of making a network request.
RESEND_API_KEY=re_4v6Az2Ze_AYqjuF8kdwaS1j7ekPShtfhT
NOREPLY_EMAIL=noreply@upharm.co.uk
SUPPORT_EMAIL=support@upharm.co.uk
MARKETING_EMAIL=updates@upharm.co.uk
EMAIL_REPLY_TO=support@upharm.co.uk
ORGANIZATION_NAME=Upharm
ORGANIZATION_EMAIL=info@upharm.co.uk
ORGANIZATION_ADDRESS=United Kingdom
EMAIL_BRAND_COLOR="#69C4B6"
EMAIL_ACTION_COLOR="#397F73"
# Optional public PNG URL. When empty, emails use the resilient text wordmark.
EMAIL_LOGO_URL=

# Billing. Keep enforcement off until existing Stripe customers and hasAccess values are reconciled.
SUBSCRIPTION_ENFORCEMENT_ENABLED=false
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
STRIPE_PRICE_QUARTERLY=
STRIPE_PRICE_SEMI_ANNUALLY=
STRIPE_PRICE_ANNUALLY=
