# OIDC Server Environment Configuration
# Copy this file to .env and fill in your values
# NEVER commit .env to version control!

# ===========================================
# Flask Configuration
# ===========================================

# Environment: development, testing, production
FLASK_ENV=development

# Secret key for session encryption (REQUIRED for production!)
# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
SECRET_KEY=dev-secret-key-please-change-in-production

# ===========================================
# Database Configuration
# ===========================================

# SQLite (Development)
# DATABASE_URL=sqlite:///oidc.db

# PostgreSQL (Production)
# DATABASE_URL=postgresql://username:password@localhost:5432/oidc_db

# ===========================================
# OIDC Server Configuration
# ===========================================

# OIDC Issuer URL (must match your public URL!)
OIDC_ISSUER=http://localhost:5000

# Client Credentials (will be moved to DB with Multi-Client Support)
OIDC_CLIENT_ID=test-client
OIDC_CLIENT_SECRET=test-secret

# ===========================================
# Token Lifetimes (in seconds)
# ===========================================

# Access Token lifetime (default: 3600 = 1 hour)
ACCESS_TOKEN_LIFETIME=3600

# Authorization Code lifetime (default: 600 = 10 minutes)
AUTHORIZATION_CODE_LIFETIME=600

# ID Token lifetime (default: 3600 = 1 hour)
ID_TOKEN_LIFETIME=3600

# ===========================================
# Optional: Email Configuration (for future use)
# ===========================================

# SMTP_HOST=smtp.gmail.com
# SMTP_PORT=587
# SMTP_USERNAME=your-email@gmail.com
# SMTP_PASSWORD=your-app-password
# SMTP_FROM=noreply@yourdomain.com

# ===========================================
# Optional: Production Settings
# ===========================================

# Number of Gunicorn workers (production)
# WEB_CONCURRENCY=4

# Log Level: DEBUG, INFO, WARNING, ERROR, CRITICAL
# LOG_LEVEL=INFO