# Application
BASE_URL=http://localhost:3069 PORT=3000 NODE_ENV=development

# Database (PostgreSQL)
DATABASE_URL=postgresql://user:password@localhost:5432/Database?shema=public

# Authentik (OIDC discovery base)
# Used by OIDC discovery and token exchange (AuthService)
AUTHENTIK_URL=https://auth.raylab.site

# Authentik Admin API (provisioning identities & groups)
# Example: https://auth.raylab.site/api
AUTHENTIK_API_BASE=https://auth.raylab.site/api

# Bearer token for Authentik Admin API (admin service account)
AUTHENTIK_API_TOKEN=changeme_admin_api_token

# Default group name format: RL-{object}
# RayLab will use this group to gate access (default RL-RayLab-Users)
AUTHENTIK_DEFAULT_GROUP=RL-RayLab-Users

# OIDC / JWKS / Issuer settings for verifying Authentik tokens (if needed)
AUTHENTIK_JWKS_URI=https://auth.raylab.site/.well-known/jwks.json AUTHENTIK_ISSUER=https://auth.raylab.site/application/o/ray-lab-core/ AUTHENTIK_AUDIENCE=ray-lab-core

# OIDC client credentials (used when RayLab needs to call token endpoint)
AUTHENTIK_CLIENT_ID=raylab-client AUTHENTIK_CLIENT_SECRET=raylab-client-secret

# RayLab internal JWT (used to sign internal tokens)
RAYLAB_JWT_SECRET=replace_with_a_long_random_secret

# Token lifetime in seconds
RAYLAB_JWT_EXPIRES_IN=3600

# Sync / reconciliation
# Interval in seconds for reconciler to retry PENDING/FAILED syncs
AUTH_RECONCILE_INTERVAL_SECONDS=3600

# Auth / sync behavior
# Disable auto-creation of users on login (must remain false per design)
AUTH_AUTO_CREATE_USER=false AUTH_SYNC_EMAIL=true AUTH_SYNC_USERNAME=false

# Test accounts for integration tests (must exist in Authentik and RayLab DB before tests,
# or be provisioned via RayLab Admin endpoints during test run)
ADMIN_USERNAME=admin@example.com ADMIN_PASSWORD=changeme_admin_password

OWNER_USERNAME=owner@example.com OWNER_PASSWORD=changeme_owner_password

EMPLOYEE_USERNAME=employee@example.com EMPLOYEE_PASSWORD=changeme_employee_password

# Optional: integration test user (overrides defaults used by tests)
TEST_USER_EMAIL=test-integration@example.com TEST_USER_USERNAME=test-integration TEST_USER_PASSWORD=StrongP@ssw0rd!

# Optional: adjust logging or other runtime flags
LOG_LEVEL=info

SWAGGER_ENABLED=true