.env.example

# ============================================
# Eventra Frontend Environment Variables
# ============================================
# For full setup details, see docs/ENV_SETUP_GUIDE.md

# Required: Backend API endpoint
# Resolution order (highest to lowest priority):
#   1. BACKEND_URL (used by dev proxy, can override others)
#   2. VITE_API_URL (Vite builds - preferred)
#   3. REACT_APP_API_URL (CRA compatibility)
#
# For local development with local backend:
#   BACKEND_URL=http://localhost:8080
#   VITE_API_URL=http://localhost:8080
#   REACT_APP_API_URL=http://localhost:8080
#
# For local development with deployed backend:
#   BACKEND_URL=https://eventra-backend-springboot-eybhdvaubxcua7ha.centralindia-01.azurewebsites.net
#   VITE_API_URL=https://eventra-backend-springboot-eybhdvaubxcua7ha.centralindia-01.azurewebsites.net
#   REACT_APP_API_URL=https://eventra-backend-springboot-eybhdvaubxcua7ha.centralindia-01.azurewebsites.net
#
# Note: Only set one of these variables. The system will resolve in priority order.
# In development, defaults to http://localhost:8080 if none are set.
# In production, no automatic fallback - configuration must be explicitly set to avoid configuration drift.
BACKEND_URL=http://localhost:8080
VITE_API_URL=http://localhost:8080
REACT_APP_API_URL=http://localhost:8080

# CSP Backend Origin Configuration
# =================================
# The Content-Security-Policy (CSP) in middleware.js dynamically reads backend
# origins from the environment variables above (BACKEND_URL, VITE_API_URL, REACT_APP_API_URL).
# These origins are validated and added to the CSP connect-src directive.
#
# Security Considerations:
# - Only http and https protocols are allowed
# - Invalid URLs are rejected with a warning
# - If no valid backend origin is configured, CSP will not include backend origins
#   (API calls may be blocked, but the application will not crash)
#
# Examples:
# Development:
#   BACKEND_URL=http://localhost:8080
#   VITE_API_URL=http://localhost:8080
#
# Production:
#   BACKEND_URL=https://api.example.com
#   VITE_API_URL=https://api.example.com
#
# Multiple backends (if needed):
# Set multiple environment variables; all valid origins will be added to CSP.
# The middleware checks BACKEND_URL first, then VITE_API_URL, then REACT_APP_API_URL.

# Use real backend API (true) or mock data (false)
# Set to false for frontend-only development without running backend
REACT_APP_USE_REAL_API=false

# Optional: Google OAuth Client ID for Google Sign-In
# Get yours at: https://console.cloud.google.com > APIs & Services > Credentials
REACT_APP_GOOGLE_CLIENT_ID=your_google_client_id_here

# ============================================
# Backend Configuration Notes
# ============================================
# All backend endpoint configuration is centralized in src/config/backendConfig.js
# This module provides:
# - Consistent environment variable resolution
# - URL normalization and validation
# - API and SSE base URLs
# - Clear error messages for misconfiguration
#
# The runtime code (src/config/api.js, src/utils/sseMultiplexer.js, src/utils/certificateUtils.js)
# uses this centralized configuration to ensure consistency.
#
# Note: src/setupProxy.js runs in a Node.js context and uses its own inline resolution
# logic to avoid ESM/CommonJS compatibility issues, but follows the same resolution order.

# Optional: Public repository metadata
REACT_APP_GITHUB_REPO=SandeepVashishtha/Eventra

# Optional: Public base URL used for share links and metadata
REACT_APP_PUBLIC_URL=https://eventra.sandeepvashishtha.tech

# Optional: Web push public key
REACT_APP_VAPID_PUBLIC_KEY=

# Optional: CSP reporting endpoint
REACT_APP_CSP_REPORT_URI=

# Optional: Sentry browser error reporting DSN
# -----------------------------------------------
# Resolution order (env.js checks VITE_ first, then REACT_APP_):
#   1. VITE_SENTRY_DSN      - preferred for Vite builds (inlined at build time)
#   2. REACT_APP_SENTRY_DSN - legacy/deprecated prefix; kept for backward compatibility
#
# Example format: https://public_key@org_id.ingest.de.sentry.io/project_id
VITE_SENTRY_DSN=
# [DEPRECATED] Use VITE_SENTRY_DSN above instead
REACT_APP_SENTRY_DSN=

# Optional: CSRF token enforcement mode
# Values: "strict" - blocks requests when CSRF token is missing (recommended for production)
#         "warning" - logs missing tokens but allows requests (default for development)
#         "disabled" - disables CSRF protection entirely (not recommended)
#
# Default behavior (when not explicitly set):
#   - Production: defaults to "strict" for enhanced security
#   - Development/Test: defaults to "warning" for easier debugging
#
# Recommendation: Use "strict" mode in production deployments to ensure
# CSRF tokens are properly validated. Backend CSRF validation remains the
# primary security boundary, but frontend enforcement provides defense in depth.
#
# Invalid values will log a warning and fall back to the environment-specific default.
VITE_CSRF_ENFORCEMENT_MODE=warning

# ============================================
# Server-side Secrets (set in Vercel Dashboard / .env.local)
# ============================================
# These are read by the Vercel Edge Middleware (middleware.js) and
# serverless functions. NEVER prefix with REACT_APP_ as that would
# expose them to the browser bundle.

# CRITICAL: JWT signing secret for auth token verification in the
# Edge Middleware and SSE mock server. This is MANDATORY - the application
# will NOT start or handle requests without it. There is NO fallback secret.
# Must match the secret used by the backend to sign tokens.
# Generate with: openssl rand -base64 32
JWT_SECRET=

# REQUIRED IN PRODUCTION
# Authentication storage must be persistent. In-memory authentication
# storage is not permitted in production and will cause startup failure.
# Example:
# DATABASE_URL=postgresql://user:password@host:5432/database
DATABASE_URL=

# REQUIRED for GitHub proxy-backed API calls used by contributors/leaderboard data.
# Keep the secret server-side only. Do not expose it in client-side env vars.
# Legacy alias note: some deployments may still refer to GITHUB_API_TOKEN, but
# the current codebase expects GITHUB_TOKEN.
GITHUB_TOKEN=

# REQUIRED IN PRODUCTION for distributed rate limiting
# Redis URL for distributed rate limiting (Redis, Upstash Redis, or Vercel KV with Redis protocol).
# Provision with: vercel kv create <store-name> (for Vercel KV) or use your own Redis instance.
# Format: redis://user:password@host:port or rediss:// for TLS
# SECURITY: In production, if this is missing, rate limiting behavior depends on RATE_LIMIT_FAIL_MODE
RATE_LIMIT_REDIS_URL=

# REQUIRED IN PRODUCTION for persistent ticket storage
# Redis URL for ticket storage (can reuse RATE_LIMIT_REDIS_URL or use a separate instance).
# Ticket storage requires persistence to survive server restarts and support horizontal scaling.
# Format: redis://user:password@host:port or rediss:// for TLS
# SECURITY: In production, if this is missing, the application will fail to start (fail-closed mode).
# Note: You can use the same Redis instance as RATE_LIMIT_REDIS_URL by setting both to the same URL.
TICKET_REDIS_URL=

# Optional: Rate limiting failure mode.
# Controls behavior when distributed storage (Redis/KV) is unavailable.
# Values: "fallback" (default) - Try Redis, fall back to in-memory, then allow requests
#         "open" - Allow all requests when storage fails (no rate limiting during outages)
#         "closed" - Reject all requests when storage fails (fail-closed security mode)
# Recommendation: Use "fallback" for improved resiliency while maintaining rate limiting.
# RATE_LIMIT_FAIL_MODE=fallback

# REQUIRED IN PRODUCTION for session-risk storage
# KV REST API URL and token for distributed session-risk storage (Vercel KV or compatible KV store).
# Provision with: vercel kv create <store-name> (for Vercel KV) or use your own KV instance.
# SECURITY: In production, if these are missing, session-risk behavior depends on SESSION_RISK_FAIL_MODE
KV_REST_API_URL=
KV_REST_API_TOKEN=

# Optional: Session risk failure mode.
# Controls behavior when distributed session-risk storage (KV) is unavailable.
# Values: "fallback" (default) - Try KV, fall back to JWT validation, then allow operations
#         "open" - Allow operations when storage fails (no session-risk enforcement during outages)
#         "closed" - Reject operations when storage fails (fail-closed security mode)
# Recommendation: Use "fallback" for improved resiliency while maintaining session-risk enforcement.
# SESSION_RISK_FAIL_MODE=fallback

# Optional: Rate limiting mode.
# Values: "distributed" (default in production) - requires Redis or KV
#         "memory" (development/test) - in-memory only, not suitable for production
# RATE_LIMIT_MODE=

# Optional: Comma-separated list of ISO 3166-1 alpha-2 country codes to block.
# Requests from these countries will receive HTTP 451 (Unavailable For Legal Reasons).
# Leave empty to allow access from all countries (default behavior).
# Example: BLOCKED_COUNTRIES=CU,IR,KP,SY,RU
# Format: Two-letter country codes, comma-separated, case-insensitive
BLOCKED_COUNTRIES=

# Optional: Comma-separated list of allowed CORS origins for API access.
# This controls which domains can make cross-origin requests to Eventra APIs.
# In development, common localhost origins (3000, 5173) are automatically allowed.
# In production, only explicitly listed origins receive CORS access.
# Example: ALLOWED_ORIGINS=https://eventra.com,https://www.eventra.com,https://api.eventra.com
# Security Note: Never use wildcard (*) in production. Always specify exact origins.
ALLOWED_ORIGINS=

# Optional: Cookie SameSite attribute configuration.
# Controls the SameSite policy for authentication cookies.
# Values: "Strict" (default), "Lax", "None"
# Note: If set to "None", the secure flag is automatically enforced.
# Use "None" when the frontend and backend are hosted on different domains.
VITE_COOKIE_SAME_SITE=Strict