# Server
PORT=3001
NODE_ENV=development

# Frontend origin (CORS + post-login redirect target)
FRONTEND_URL=http://localhost:5173

# WorkOS AuthKit — https://dashboard.workos.com
# Configure WORKOS_REDIRECT_URI as a Redirect URI in the WorkOS dashboard.
WORKOS_API_KEY=
WORKOS_CLIENT_ID=
# Must be at least 32 characters. Generate: openssl rand -base64 32
WORKOS_COOKIE_PASSWORD=
WORKOS_REDIRECT_URI=http://localhost:3001/auth/callback

# Optional local-only identity used by Docker/E2E runs when WorkOS credentials
# are intentionally unavailable. Ignored when NODE_ENV=production.
LOCAL_DEV_AUTH_EMAIL=
LOCAL_DEV_AUTH_FIRST_NAME=Guest
LOCAL_DEV_AUTH_LAST_NAME=

# Supabase Postgres connection string (BACKEND ONLY — never expose to the browser).
# Supabase dashboard → Project Settings → Database → Connection string (URI).
# Use the connection pooler URI for serverless / many short connections.
DATABASE_URL=

# GitHub OAuth App — https://github.com/settings/developers (OAuth Apps).
# Set the app's "Authorization callback URL" to GITHUB_REDIRECT_URI.
# The 'repo' scope (used to list private repos) grants broad repo access.
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GITHUB_REDIRECT_URI=http://localhost:3001/api/github/callback

# Secret used to encrypt stored GitHub tokens at rest (any random string).
# Generate: openssl rand -base64 32
APP_ENCRYPTION_KEY=

# Scanner (apps/cli). SCAN_RUNNER: inline (in-process, default for dev — no Docker) |
# docker (run the container locally) | cloudrun (trigger the Cloud Run Job).
SCAN_RUNNER=inline
# Backend URL the scanner POSTs results to (docker/cloudrun modes).
# For docker, use http://host.docker.internal:3001 so the container can reach the host.
SCAN_CALLBACK_URL=http://localhost:3001
# Shared secret for /internal/scan-result (required for docker/cloudrun).
SCAN_CALLBACK_SECRET=
# docker mode: the built scanner image (e.g. cerebrus-scanner).
SCANNER_IMAGE=
# cloudrun mode: the Cloud Run Job to execute.
GCP_PROJECT=
GCP_REGION=us-central1
SCAN_JOB_NAME=cerebrus-scanner

# DeepSeek — the LLM that performs the file-by-file vulnerability analysis + chaining.
# Required for a real scan (docker/cloudrun pass it to the container; inline reads it here).
DEEPSEEK_API_KEY=
DEEPSEEK_MODEL=deepseek-reasoner
DEEPSEEK_BASE_URL=https://api.deepseek.com
# Max files analyzed in parallel (deepseek-reasoner is slow — keep this modest).
DEEPSEEK_CONCURRENCY=4

# Per-scan logs are written to <SCAN_LOG_DIR>/scan-<scanId>.log (host-readable).
SCAN_LOG_DIR=./scan-logs

# Ecosystems for the optional bulk `cve:sync` (on-demand OSV querybatch needs no config).
OSV_ECOSYSTEMS=npm,PyPI,Go,crates.io,Maven,RubyGems

# Auto-fix: after a scan finds vulnerabilities, open a PR on the user's repo applying
# the suggested fixes (uses the user's GitHub token). Set to "false" to disable.
SCAN_AUTOFIX=true