# YPMS local development environment
#
# Copy this file to .env for local runs. Do NOT commit .env.
# Production values live in Azure Key Vault (Phase 1+).

# ---- Database ----
# Local (host) → Postgres exposed on 5433 to avoid clashing with OWC on 5432
DATABASE_URL=postgresql+psycopg://ypms:ypms@localhost:5433/ypms

# ---- JWT ----
# >= 32 bytes (HS256, RFC 7518 §3.2); the app refuses to start otherwise.
JWT_SECRET=dev-jwt-secret-change-me-32-bytes-min
JWT_ALG=HS256
ACCESS_TOKEN_TTL_MINUTES=60
REFRESH_TOKEN_TTL_DAYS=14

# ---- App-layer column encryption ----
# Phase 0: local key material only. Phase 1 swaps to Azure Key Vault.
# Any 32-byte value in dev. Never use this string in staging/prod.
COLUMN_ENCRYPTION_KEY=dev-col-enc-key-change-me-32bytes-______

# ---- Logging + environment ----
LOG_LEVEL=INFO
ENV=dev

# ---- CORS (dev only) ----
# Comma-separated origins allowed to hit the API from a browser.
CORS_ORIGINS=http://localhost:5173,http://127.0.0.1:5173