# =============================================================================
# Formeleon - Multi-tenant Form Generator
# Author: Björn Runden <br@runden.net>
# File: .env.example
# Description: Environment configuration template. Copy to .env and customize.
# =============================================================================

# =============================================================================
# APPLICATION SETTINGS
# =============================================================================

# Flask Environment: development, production, testing
FLASK_ENV=development

# Secret Key for Flask session management
# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
SECRET_KEY=your-secret-key-change-in-production

# Enable/Disable Debug Mode
FLASK_DEBUG=true

# Development Mode - enables fake auth and mocking
DEV_MODE=true

# Mock Authentication Mode
# When MOCK_AUTH=true AND DEV_MODE=true, uses local mock users instead of Zitadel OIDC
# Useful for local development without external dependencies
MOCK_AUTH=false

# Application name
APP_NAME=formeleon

# Application port (default: 5000)
PORT=5000

# =============================================================================
# MOCK USER SETTINGS (used when MOCK_AUTH=true and DEV_MODE=true)
# =============================================================================

# Mock user credentials (only used in mock auth mode)
MOCK_USER_ID=mock_user_001
MOCK_USER_ROLE=admin
MOCK_USER_NAME=Mock Admin
MOCK_USER_EMAIL=mock@formeleon.local
MOCK_TENANT_ID=mock_tenant_001

# =============================================================================
# DEVELOPMENT USER SETTINGS (used when DEV_MODE=true but MOCK_AUTH=false)
# =============================================================================

# Dev Mode User Role (admin, tenant_admin, user, viewer)
DEV_USER_ROLE=admin

# Dev Mode Tenant ID
DEV_TENANT_ID=tenant_dev_123

# Dev Mode User Name
DEV_USER_NAME="Dev Admin"

# Dev Mode User Email
DEV_USER_EMAIL=dev@formeleon.local
# =============================================================================
# DATABASE SETTINGS
# =============================================================================

# SQLite (default for development)
# SQLALCHEMY_DATABASE_URI=sqlite:///instance/formeleon.db

# PostgreSQL
# SQLALCHEMY_DATABASE_URI=postgresql://username:password@localhost/formeleon

# MySQL
# SQLALCHEMY_DATABASE_URI=mysql+pymysql://username:password@localhost/formeleon

# Enable SQL query logging
SQLALCHEMY_ECHO=false

# =============================================================================
# ZITADEL OIDC SETTINGS
# =============================================================================

# Zitadel Issuer URL (OIDC Provider)
# Example: https://your-zitadel-instance.zitadel.cloud
ZITADEL_ISSUER=

# OIDC Client ID from Zitadel
ZITADEL_CLIENT_ID=

# OIDC Client Secret from Zitadel
ZITADEL_CLIENT_SECRET=

# Redirect URI for OIDC callback
# Default: http://localhost:5000/auth/callback
ZITADEL_REDIRECT_URI=http://localhost:5000/auth/callback

# OIDC Scopes (comma-separated)
# ZITADEL_SCOPES=openid,profile,email

# =============================================================================
# RECAPTCHA SETTINGS
# =============================================================================

# Google reCAPTCHA v3 Site Key (for client-side)
RECAPTCHA_SITE_KEY=

# Google reCAPTCHA v3 Secret Key (for server-side validation)
RECAPTCHA_SECRET_KEY=

# Minimum score threshold (0.0 - 1.0, default: 0.5)
RECAPTCHA_THRESHOLD=0.5

# Mock score for development mode (default: 0.9)
MOCK_RECAPTCHA_SCORE=0.9

# =============================================================================
# CORS SETTINGS
# =============================================================================

# Enable CORS (default: true)
ENABLE_CORS=true

# Allowed Origins (comma-separated, default: *)
ALLOWED_ORIGINS=*

# =============================================================================
# SESSION SETTINGS
# =============================================================================

# Session Cookie Secure (HTTPS only, default: false for development)
SESSION_COOKIE_SECURE=false

# Session Cookie SameSite (Lax, Strict, None)
SESSION_COOKIE_SAMESITE=Lax

# Session lifetime in seconds (default: 3600 = 1 hour)
PERMANENT_SESSION_LIFETIME=3600

# =============================================================================
# FILE UPLOAD SETTINGS
# =============================================================================

# Maximum upload size in bytes (default: 16MB = 16 * 1024 * 1024)
MAX_CONTENT_LENGTH=16777216

# Upload folder
UPLOAD_FOLDER=/tmp/formeleon_uploads

# Allowed file extensions (comma-separated)
# ALLOWED_EXTENSIONS=png,jpg,jpeg,gif,pdf,txt

# =============================================================================
# EMAIL SETTINGS (for notifications)
# =============================================================================

# SMTP Server
# SMTP_SERVER=localhost
# SMTP_PORT=587
# SMTP_USERNAME=
# SMTP_PASSWORD=
# SMTP_USE_TLS=true
# EMAIL_FROM=formeleon@yourdomain.com

# =============================================================================
# LOGGING SETTINGS
# =============================================================================

# Log Level: DEBUG, INFO, WARNING, ERROR, CRITICAL
# LOG_LEVEL=INFO

# =============================================================================
# PRODUCTION SETTINGS
# =============================================================================

# Default page size for paginated responses
DEFAULT_PAGE_SIZE=20

# Maximum page size for paginated responses
MAX_PAGE_SIZE=100

# =============================================================================
# NOTES FOR PRODUCTION
# =============================================================================

# For production deployment:
# 1. Set FLASK_ENV=production
# 2. Set FLASK_DEBUG=false
# 3. Set DEV_MODE=false
# 4. Set MOCK_AUTH=false
# 5. Set SESSION_COOKIE_SECURE=true
# 6. Set SESSION_COOKIE_SAMESITE=Strict
# 7. Configure proper ZITADEL_* settings
# 8. Configure proper RECAPTCHA_* settings
# 9. Use a production-ready database (PostgreSQL, MySQL)
# 10. Generate a strong SECRET_KEY
# 11. Restrict ALLOWED_ORIGINS to your specific domains
# 12. Set up proper HTTPS/TLS

# For local development without external services:
# 1. Set DEV_MODE=true
# 2. Set MOCK_AUTH=true (optional, for pure local mocking)
# 3. Optionally configure ZITADEL_* settings if you have a local Zitadel instance