APP_NAME="Audit Firm v2"
ENV="dev"
DEBUG=true

# IMPORTANT: change in production
SECRET_KEY="change-me-to-a-long-random-string"

# Cookie/security
COOKIE_SECURE=false
COOKIE_SAMESITE="lax"         # lax|strict|none
COOKIE_SESSION_NAME="af2sid"

# DB backend
DB_BACKEND="sqlite"           # sqlite|postgres

SQLITE_COMMON_PATH="./data/common.db"

ERP_PUBLIC_BASE_URL=http://localhost:8000
DEV_AUTH_OTP_PRINT=false

# Postgres placeholders (later)
PG_HOST="127.0.0.1"
PG_PORT=5432
PG_USER="postgres"
PG_PASSWORD="postgres"
PG_DB_COMMON="audit_common"

# Defaults (context fallback)
DEFAULT_TENANT_CODE="default"
DEFAULT_BRANCH_CODE="main"
DEFAULT_YEAR_CODE="2025-26"
DEFAULT_TIMEZONE="Asia/Kolkata"

# Security hardening: do not trust browser/client supplied context headers in public deployment.
# Keep false for production unless an internal proxy/test runner is explicitly trusted.
TRUST_CONTEXT_HEADERS=false
TRUST_CONTEXT_HEADER_HOSTS="127.0.0.1,localhost,::1"
# Optional shared secret for trusted internal callers. If set, caller must send
# X-AuditFirm-Context-Secret with this value before context headers are accepted.
CONTEXT_HEADER_SECRET=""

# Bootstrap admin (seeded if users table is empty)
BOOTSTRAP_ADMIN_EMAIL="admin@auditfirm.local"
BOOTSTRAP_ADMIN_PASSWORD="ChangeMe@123"

# JWT for API clients (mobile/apps/integrations)
JWT_ISSUER="audit_firm_v2"
JWT_AUDIENCE="audit_firm_clients"
JWT_ACCESS_MINUTES=15
JWT_REFRESH_DAYS=30

# Coolify API integration for System Admin domain sync
# Enable API in Coolify first and create a token with write permission.
COOLIFY_API_BASE_URL="https://coolify.example.com/api/v1"
COOLIFY_API_TOKEN=""
COOLIFY_ERP_APPLICATION_UUID=""
COOLIFY_VERIFY_TLS=true