# ===================================================================
# Behbood Polymer Arman Toos — Commission Management System
# Environment configuration. Copy this file to ".env" and fill values.
# NEVER commit the real .env file to source control.
# ===================================================================

# --- Server ---
NODE_ENV=production
PORT=3000
BASE_URL=https://commission.behboodpolymer.local

# --- SQL Server ---
DB_SERVER=localhost
DB_PORT=1433
DB_NAME=BehboodCommissionDB
DB_USER=sadraa
DB_PASSWORD=1234
DB_ENCRYPT=true
DB_TRUST_SERVER_CERT=false

# --- Sessions ---
SESSION_SECRET=CHANGE_ME_TO_A_LONG_RANDOM_STRING
SESSION_MAX_AGE_MS=3600000

# --- SSO (shared secret with the PHP website) ---
# 32-byte (64 hex char) key used for AES-256-GCM encryption/decryption of SSO tokens.
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SSO_AES_KEY=CHANGE_ME_64_HEX_CHARS
# HMAC secret used to sign the token separately from encryption (defense in depth).
SSO_HMAC_SECRET=CHANGE_ME_LONG_RANDOM_STRING
# How long an SSO token is valid for after issuance, in seconds.
SSO_TOKEN_TTL_SECONDS=120

# --- OTP (Android authenticator app) ---
# Shared TOTP-style secret, provisioned per-user (stored per-user in DB; this is only
# the fallback/system secret used for the default admin account & documentation).
OTP_STEP_SECONDS=1800
OTP_DIGITS=6
OTP_WINDOW_TOLERANCE=1

# --- Security ---
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX=200
BCRYPT_SALT_ROUNDS=12

# --- Default admin bootstrap (used only by database/init.js on first run) ---
DEFAULT_ADMIN_USERNAME=admin
DEFAULT_ADMIN_PASSWORD=admin123
