DATABASE_URL="postgresql://USER:PASSWORD@localhost:5432/cfm_manager?schema=public"
PORT="5100"

# Manager-internal session tokens (Person sessions on the Manager app itself — never leave the Manager)
JWT_ACCESS_SECRET="change-me-access-secret"
JWT_REFRESH_SECRET="change-me-refresh-secret"
JWT_ACCESS_TTL="15m"
JWT_REFRESH_TTL="7d"

# RS256 keypair used to sign/verify handoff tokens. Generate once with:
#   openssl genrsa -out manager/keys/handoff-private.pem 2048
#   openssl rsa -in manager/keys/handoff-private.pem -pubout -out manager/keys/handoff-public.pem
# Both files are gitignored. Every company app is given a copy of the PUBLIC key only.
HANDOFF_PRIVATE_KEY_PATH="./keys/handoff-private.pem"
HANDOFF_PUBLIC_KEY_PATH="./keys/handoff-public.pem"
HANDOFF_TOKEN_TTL_SECONDS="90"

TOTP_ISSUER="Cross Financial Manager"

GOOGLE_CLIENT_ID=""
GOOGLE_CLIENT_SECRET=""
GOOGLE_REDIRECT_URI="http://localhost:5100/api/auth/oauth/google/callback"

MICROSOFT_CLIENT_ID=""
MICROSOFT_CLIENT_SECRET=""
MICROSOFT_TENANT="common"
MICROSOFT_REDIRECT_URI="http://localhost:5100/api/auth/oauth/microsoft/callback"

# Where the Manager's own frontend lives, used to build OAuth-return / redirect URLs
MANAGER_WEB_URL="http://localhost:5174"