NODE_ENV=development
PORT=3001
# Max JSON body size (bytes). Default 25MB if unset — needed for event create with base64 logo/banner.
# PAYLOAD_MAX_BYTES=26214400
# Max size per form file upload after base64 decode (default 10MB)
# FORM_SUBMISSION_MAX_FILE_BYTES=10485760
MONGODB_URI=mongodb://localhost:27017/eventbuzz
JWT_SECRET=your-super-secret-jwt-key-change-this
JWT_REFRESH_SECRET=your-refresh-secret-key-change-this
JWT_EXPIRES_IN=15m
JWT_REFRESH_EXPIRES_IN=7d
# Allowed browser origins for cookies + CORS (must match the dashboard URL exactly: scheme + host + port).
# Comma-separated if you have several (e.g. staging + prod).
# Production example: CORS_ORIGIN=https://console.eventbuzz.live
# If this list does not include your dashboard origin, login/XHR will fail with "not allowed by Access-Control-Allow-Origin".
# eventbuzz Vite app often runs on :5174 — include it when NODE_ENV=production.
# In NODE_ENV!==production, http://localhost:* and http://127.0.0.1:* are also allowed automatically (production is whitelist-only).
FRONTEND_URL=http://localhost:5173
CORS_ORIGIN=http://localhost:5173,http://localhost:5174
# Optional: comma-separated origins for the GrapesJS microsite builder (iframe) calling the API
# WEBSITE_BUILDER_CORS_ORIGINS=http://localhost:5173,https://builder.example.com

# Google Sign-In (dashboard). Web client ID(s), comma-separated if multiple.
# Frontend: VITE_GOOGLE_CLIENT_ID must match the same OAuth Web client.
GOOGLE_CLIENT_ID=

# Email
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=your-email@gmail.com
SMTP_PASS=your-app-password

# Optional IANA timezone for the daily subscription-expiry job (node-cron). Default: server local time.
# CRON_TZ=Asia/Kolkata

# Payment — platform Razorpay (subscriptions / platform checkout). Either pair works:
# RAZORPAY_PLATFORM_KEY_ID / RAZORPAY_PLATFORM_KEY_SECRET (preferred)
# or RAZORPAY_KEY_ID / RAZORPAY_KEY_SECRET (alias; same as resolver fallback)
# Optional webhook verify: RAZORPAY_PLATFORM_WEBHOOK_SECRET
# You can also store keys in DB via super_admin → platform payment settings and set enabled there.
RAZORPAY_PLATFORM_KEY_ID=
RAZORPAY_PLATFORM_KEY_SECRET=
RAZORPAY_KEY_ID=
RAZORPAY_KEY_SECRET=

AWS_ACCESS_KEY_ID=AKIAWY2EEQXF5K4LDCI2
AWS_SECRET_ACCESS_KEY=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
AWS_DEFAULT_REGION=ap-south-1
AWS_BUCKET=rapportapp
AWS_URL=https://did94hhhcgq1d.cloudfront.net
# Amazon Bedrock (AI event quick-create). Uses Converse API.
# 1) Bedrock console → Model access (ap-south-1): enable Meta Llama 3 8B / 70B.
# 2) IAM user/role needs bedrock:InvokeModel + bedrock:Converse on those foundation models.
#    See bedrock-iam-policy.example.json — attach to the same user as AWS_ACCESS_KEY_ID (e.g. rapport_upload).
# ap-south-1 model IDs: meta.llama3-8b-instruct-v1:0, meta.llama3-70b-instruct-v1:0
BEDROCK_MODEL_ID=meta.llama3-8b-instruct-v1:0
# Use only AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY here, OR AWS_PROFILE in your shell — not both (SDK warning).
# Optional: region override (defaults to AWS_DEFAULT_REGION). For Llama 3.1: BEDROCK_REGION=us-east-1
# BEDROCK_REGION=ap-south-1
# Optional: comma-separated extra model IDs to try if the primary is invalid
# BEDROCK_MODEL_FALLBACKS=meta.llama3-70b-instruct-v1:0
# Bedrock embeddings for WhatsApp concierge knowledge base (enable Titan Embeddings in Bedrock console)
# ap-south-1: prefer v2; v1 is 1536-dim, v2 default is 1024-dim — re-sync knowledge after switching models
# BEDROCK_EMBED_MODEL_ID=amazon.titan-embed-text-v2:0
# BEDROCK_EMBED_DIMENSIONS=1024
# BEDROCK_EMBED_MODEL_FALLBACKS=amazon.titan-embed-text-v1:0,amazon.titan-embed-text-v1

# Redis + BullMQ (WhatsApp concierge ingest / inbound workers in chatbot/)
# Local: redis://127.0.0.1:6379
# DigitalOcean Managed Redis: use rediss://...:25061 or REDIS_TLS=true with redis:// URL
# REDIS_URL=redis://127.0.0.1:6379
# REDIS_TLS=true
# CONCIERGE_QUEUE_PREFIX=eventbuzz:concierge:
# Concierge URL crawl (multi-page ingest for knowledge sources)
# CONCIERGE_CRAWL_MAX_PAGES=50
# CONCIERGE_CRAWL_MAX_ASSETS=20
# CONCIERGE_CRAWL_MAX_DEPTH=5
# CONCIERGE_CRAWL_TIMEOUT_MS=30000
# CONCIERGE_CRAWL_DELAY_MS=200
# CONCIERGE_CRAWL_MAX_ASSET_BYTES=15728640

# HMAC secret for public form captcha tokens (falls back to JWT_SECRET if unset)
# FORM_CAPTCHA_SECRET=

MICROSITE_API_BASE_URL=http://localhost:3001/api
# Public web app (forms, registration, default microsites)
# EVENTBUZZ_PUBLIC_URL=https://web.eventbuzz.live
# Registration link template for microsite/emailer CTAs: {eventId} and {formId} placeholders
# MICROSITE_REGISTRATION_URL_TEMPLATE=https://web.eventbuzz.live/event/{eventId}/register
# Published microsite folder base (custom microsite static HTML)
# MICROSITE_PUBLIC_BASE_URL=https://web.eventbuzz.live

# --- Microsite V2 (Handlebars static microsites on S3 + subdomain) ---
# S3 key prefix for template and published site objects (default: eventbuzz/microsite-v2)
# MICROSITE_V2_S3_PREFIX=eventbuzz/microsite-v2
# Public URL pattern for event subdomains; {subdomain} is replaced at runtime
# MICROSITE_V2_PUBLIC_BASE_URL=https://{subdomain}.eventbuzz.live
# Infra: wildcard DNS *.eventbuzz.live → CloudFront; map Host header to
# s3://{AWS_BUCKET}/{MICROSITE_V2_S3_PREFIX}/sites/{subdomain}/index.html
# Dev fallback: open published HTML via CloudFront URL of index.html key directly.
# Seed bundled microsite templates: npm run seed:global-microsite-v2-templates
# Or one template: npm run seed:eventify-template / npm run seed:eventre-template
#
# Published-site target: s3 (default) | ec2. When ec2, rendered index.html +
# config.json are uploaded via SFTP to {REMOTE_ROOT}/{subdomain}/ on the EC2 box.
# Template HTML/schema/assets are still loaded from S3 regardless of this setting.
# MICROSITE_V2_PUBLISH_TARGET=ec2
# MICROSITE_V2_EC2_HOST=15.207.15.52
# MICROSITE_V2_EC2_USER=ubuntu
# MICROSITE_V2_EC2_PORT=22
# Path to the SSH private key ON THE API SERVER (chmod 600). Not your laptop path.
# MICROSITE_V2_EC2_KEY_PATH=/secure/path/VirtualEngage.pem
# MICROSITE_V2_EC2_REMOTE_ROOT=/var/www/eventbuzz
# MICROSITE_V2_EC2_CONNECT_TIMEOUT_MS=20000

# Comma-separated CORS origins (include console + public web app)
# CORS_ORIGIN=https://console.eventbuzz.live,https://web.eventbuzz.live
# Public routes under /api/public/* also echo the request Origin (any domain) when the API is up.
# Browser "access control checks" errors on api.eventbuzz.live often mean nginx 502 (Node not running), not CORS config.

# Firebase Realtime Database (optional — quiz/poll sync). Paths relative to backend/ when starting the API from backend/
FIREBASE_DATABASE_URL=https://eventbuzz-live-default-rtdb.firebaseio.com
GOOGLE_APPLICATION_CREDENTIALS=./eventbuzz-live-firebase-adminsdk-fbsvc-bb3dcfd679.json
# Or if JSON lives in repo root: ../eventbuzz-live-firebase-adminsdk-fbsvc-bb3dcfd679.json
# Or: FIREBASE_SERVICE_ACCOUNT_PATH= / FIREBASE_SERVICE_ACCOUNT_JSON= (see firebase.js)

# Encrypted storage for organisation SMTP passwords (32-byte key: hex 64 chars or base64)
# SMTP_ENCRYPTION_KEY=

# Queue workers (email, WhatsApp, badge batches) run inside the API by default.
# Set EMBEDDED_QUEUE_WORKERS=false and run npm run email-worker / whatsapp-worker / badge-batch-worker separately if needed.
# EMBEDDED_QUEUE_WORKERS=true
# EMBEDDED_QUEUE_WORKER_POLL_MS=3000

# Standalone worker tuning (npm run email-worker, whatsapp-worker, badge-batch-worker)
# EMAIL_WORKER_POLL_MS=2000
# EMAIL_WORKER_MAX_ATTEMPTS=3
# WHATSAPP_WORKER_POLL_MS=2000
# WHATSAPP_WORKER_MAX_ATTEMPTS=3
# Min delay between Graph /messages calls (rate limiting)
# WHATSAPP_WORKER_MIN_INTERVAL_MS=400
# BADGE_BATCH_WORKER_POLL_MS=3000

# WhatsApp Cloud API (Meta Graph) — optional org-level config in Settings; these override when set:
# META_GRAPH_API_VERSION=v21.0
# Log every Meta Graph request + response to the server console (tokens shown as ***; large JSON truncated — see META_WHATSAPP_LOG_MAX_CHARS):
# META_WHATSAPP_DEBUG=1
# or: META_WHATSAPP_LOG=true
# Optional: max characters per logged JSON block (default 250000)
# META_WHATSAPP_LOG_MAX_CHARS=250000
# Meta App ID (numeric) — required for IMAGE header templates: sample URLs are uploaded via Graph resumable upload.
# META_WHATSAPP_APP_ID=
# or: META_APP_ID=
# Optional cap for header sample download size (bytes). Default 5MB.
# META_WHATSAPP_HEADER_UPLOAD_MAX_BYTES=5242880
# META_WHATSAPP_DEFAULT_WABA_ID=
# META_WHATSAPP_ACCESS_TOKEN=
# Must be a phone number id from GET /{WABA_ID}/phone_numbers on the *same* WABA as above (otherwise templates return Meta #132001).
# META_WHATSAPP_DEFAULT_PHONE_NUMBER_ID=
# Only if you must bypass GET /{waba-id}/phone_numbers validation (token cannot list phones but send is known-good):
# META_WHATSAPP_SKIP_PHONE_WABA_CHECK=1
# Cron: sync pending template statuses (default every 12 minutes)
# WHATSAPP_TEMPLATE_SYNC_CRON=*/12 * * * *
# Optional future webhook (template status updates from Meta):
# META_WHATSAPP_WEBHOOK_VERIFY_TOKEN=

# One-time fee (INR) org pays per event to unlock manual UPI checkout — recorded under Settings → Billing → invoices.
# EVENT_TICKETING_MANUAL_ENABLEMENT_FEE_INR=500