# ==============================================================================
# Frontend (Vite) — exposed to the browser bundle, never put secrets here
# ==============================================================================
# VITE_API_BASE_URL=https://your-backend-domain.example.com/api
VITE_API_BASE_URL=http://localhost:8000/api
VITE_MIDTRANS_CLIENT_KEY=Mid-client-xxxxxxxxxxxxxxxx

VITE_MIDTRANS_ENV=sandbox
VITE_LOG_LEVEL=info
VITE_PAYMENT_GATEWAY_MODE=snap

VITE_ENABLE_BANK_TRANSFER=true
VITE_ENABLE_CREDIT_CARD=true
VITE_ENABLE_GOPAY=true
VITE_ENABLE_CSTORE=true
VITE_ENABLE_CPAY=false

# ==============================================================================
# Midtrans (server-side)
# ==============================================================================
MIDTRANS_SERVER_KEY=Mid-server-xxxxxxxxxxxxxxxx
MIDTRANS_CLIENT_KEY=Mid-client-xxxxxxxxxxxxxxxx
MIDTRANS_IS_PRODUCTION=false

# ==============================================================================
# Core payment method toggles (server-side)
# ==============================================================================
ENABLE_BANK_TRANSFER=true
ENABLE_CREDIT_CARD=true
ENABLE_GOPAY=true
ENABLE_CSTORE=true

# ==============================================================================
# Logging
# ==============================================================================
LOG_LEVEL=info
LOG_TO_FILE=true
LOG_TO_CONSOLE=true
# Max number of recent log entries kept in memory for GET /api/logs
LOG_BUFFER_SIZE=1000

# Exposes GET /api/logs, /api/logs/files, /api/logs/files/:filename, /api/logs/view,
# and registers the LOG_EXPOSE_API-only dev/test endpoints (/api/echo, /api/echo2,
# /api/test/notify-erp). Does NOT affect /openapi.json or /docs (those are gated only
# by LOG_BASIC_AUTH_USER/PASS below). Defaults to false (closed) when unset.
LOG_EXPOSE_API=false
# Required in production to protect the log endpoints (HTTP Basic Auth, browser-native prompt).
# Leaving these empty only works in non-production NODE_ENV.
LOG_BASIC_AUTH_USER=
LOG_BASIC_AUTH_PASS=
# Delete LOGS_*.log files older than this many days
LOG_RETENTION_DAYS=30

# ==============================================================================
# ERP integration
# ==============================================================================
ERP_NOTIFICATION_URL=https://erp.example.com/callback/
# Optional: multiple ERP endpoints, comma-separated. Overrides ERP_NOTIFICATION_URL if set.
# ERP_NOTIFICATION_URLS=https://erp1.example.com/callback/,https://erp2.example.com/callback/
# Used both as the client identifier AND (via fallback) the HMAC secret for ERP notification
# signatures — set ERP_CLIENT_SECRET separately only if your ERP uses a different signing key.
ERP_CLIENT_ID=changeme-erp-client-id
# ERP_CLIENT_SECRET=
ERP_ENABLE_NOTIF=true

# ==============================================================================
# Payment link signing & external API access
# ==============================================================================
# Required by /createtransaksi and POST /api/payment-links (X-API-KEY header). Generate with:
# node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
EXTERNAL_API_KEY=changeme-generate-a-strong-random-key
# HMAC secret that signs shareable payment link tokens. Generate with:
# node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))"
PAYMENT_LINK_SECRET=changeme-generate-a-strong-random-secret
# Base URL the generated payment links point to (your frontend's /pay route)
# PAYMENT_LINK_BASE=https://your-frontend-domain.example.com/pay
PAYMENT_LINK_BASE=http://localhost:5173/pay
PAYMENT_LINK_TTL_MINUTES=1440

# ==============================================================================
# CORS — comma-separated list of allowed frontend origins.
# Leaving this unset allows all origins (fine for local dev, NOT recommended in production).
# ==============================================================================
# CORS_ALLOWED_ORIGINS=https://your-frontend-domain.example.com

# ==============================================================================
# Rate limiting for /createtransaksi, /api/payment-links, /api/payments/charge,
# /api/payments/snap/token
# ==============================================================================
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_MAX=20

# ==============================================================================
# Server
# ==============================================================================
NODE_ENV=development
PORT=8000