# Copy to .env and fill in. NEVER commit .env.

NODE_ENV=development
PORT=3000

# Local MongoDB, or an Atlas connection string
MONGODB_URI=mongodb+srv://<crownprincejustin_db_user>:<DFCpn5O21APAgmDf>@cluster0.klzjsqq.mongodb.net/lasued-connect?retryWrites=true&w=majority

# At least 32 random characters. Generate with:
#   node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))"
JWT_ACCESS_SECRET=msgPPG19vpUhkWjMI2kH7LMrwYfHNKR8sA0nB8MmVPeVR_d0SX_SCrzkIDW6zb85

# Where the React app runs (used in email links)
CLIENT_URL=https://justice.florintechdevs.com
# Comma-separated list of origins allowed to call this API (CORS + CSRF check)
CLIENT_ORIGINS=https://justice.florintechdevs.com

# lax works when the frontend and API share a site (e.g. localhost:5173 + localhost:5000).
# Use "none" in production if the frontend and API are on different domains (needs HTTPS).
COOKIE_SAMESITE=lax

# Number of reverse proxies in front of the API (0 locally, usually 1 in production)
TRUST_PROXY=0

RESEND_API_KEY=re_XF2ARnFe_E4rJfFDqRbKCJWH2kMz5UtQz   
EMAIL_FROM=LASUED Connect <onboarding@resend.dev>

# Block passwords found in known breaches (Have I Been Pwned, k-anonymity)
HIBP_ENABLED=true
STORAGE_DRIVER=auto
CLOUDINARY_CLOUD_NAME=lasued-connect-server
CLOUDINARY_API_KEY=366398335151634
CLOUDINARY_API_SECRET=2424fsfd2434fr22se656sr22rrygd2rrf7er336
