# =============================================================================
# Africa Alert PWA — environment template
# Copy this file to `.env` (server) and fill in real values.
# NEVER commit `.env` itself.
# =============================================================================

# --- Runtime ----------------------------------------------------------------
NODE_ENV=development                 # 'development' | 'production'
PORT=3001                            # tenant API — see PORTS.md
DB_PATH=./data/school.db

# --- Auth & CORS (REQUIRED in production) -----------------------------------
# Generate JWT_SECRET with: `node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"`
JWT_SECRET=change-me-to-a-real-secret
# Comma-separated list of origins allowed to call the API.
# In dev, the server falls back to allowing any origin; in prod this is enforced.
ALLOWED_ORIGINS=http://localhost:3000

# --- Offline client minting (default: true in dev, false in prod) ------------
# When true, /api/auth/login response includes `offline_jwt_secret` so the
# client can mint JWTs when the server is offline. Set to false in production
# unless you specifically need offline auth.
ALLOW_CLIENT_OFFLINE_MINT=true

# --- Sync (optional) ---------------------------------------------------------
SUPABASE_URL=https://api.next_gen.techarvest.co.zw
SUPABASE_KEY=
SYNC_INTERVAL=30000

# --- Paynow (optional) -------------------------------------------------------
PAYNOW_INTEGRATION_ID=
PAYNOW_INTEGRATION_KEY=
PAYNOW_RETURN_URL=http://localhost:3000/fees
PAYNOW_BLOCKING_URL=http://localhost:3000/api/payments/webhook

# --- SuperAdmin licensing (ed25519 trust anchor + heartbeat) ----------------
# Placeholder — replace with the matching SuperAdmin public key. Preserve
# literal `\n` escapes when setting in environment variables.
SUPERADMIN_PUBLIC_KEY=-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAGB9...REPLACE_ME...\n-----END PUBLIC KEY-----
SUPERADMIN_HEARTBEAT_URL=
LICENSE_HEARTBEAT_INTERVAL_MS=300000
LICENSE_CLOCK_DRIFT_MS=300000
# Optional — service auto-detects absence and uses LRU cache only.
REDIS_URL=