# athena-auth HTTP listen URL (no NEXT_PUBLIC_ — used only by the Next.js API proxy).
# Next.js receives browser calls at /api/auth/* and forwards them to this origin root (/).
# Must be a concrete URL. Wildcards are NOT supported here.
ATHENA_AUTH_ORIGIN=http://localhost:3000

# Optional host-pattern override map for multi-domain deployments.
# Format: <incoming-host-glob>=<upstream-url>,<incoming-host-glob>=<upstream-url>
# Example:
# ATHENA_AUTH_ORIGIN_MAP=athena-auth-*-suits-finance.vercel.app=https://auth.athena-cluster.com

# Optional: call this origin directly from the browser instead of using the proxy (needs CORS).
# NEXT_PUBLIC_AUTH_BASE_URL=http://localhost:4000

# Browser should call auth through Next.js at /api/auth.
NEXT_PUBLIC_AUTH_BASE_PATH=/api/auth

# Optional cookie names used by the proxy to forward tenant context upstream.
ATHENA_AUTH_TENANT_COOKIE_NAME=athena_auth_tenant
ATHENA_AUTH_TENANT_HEADER_COOKIE_NAME=athena_auth_tenant_header

# CORS/CSRF trusted origins used by both:
# 1) this Next.js proxy preflight guard
# 2) the Rust athena-auth server (set the same value in root .env)
# Supports wildcard globs with `*`, for example:
# TRUSTED_ORIGINS=http://localhost:3001,http://localhost:3000,https://app.formations.company,https://speedrun-formations.vercel.app,https://suits-finance-*-athena-auth.vercel.app,https://*.vercel.app
TRUSTED_ORIGINS=http://localhost:3001,http://localhost:3000,https://app.formations.company,https://speedrun-formations.vercel.app

# Social OAuth providers shown in the demo UI.
# Add "apple" (and any others) to enable their sign-in buttons.
# NEXT_PUBLIC_AUTH_SOCIAL_PROVIDERS=google,apple,github,discord
# NEXT_PUBLIC_AUTH_SOCIAL_CALLBACK_PATH=/session

# Google OAuth credentials (server-side readiness check only — values never sent to browser)
# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=

# Apple OAuth credentials (server-side readiness check only — values never sent to browser)
# The client ID is your Apple Services ID (e.g. com.example.myapp.service).
# The client secret must be a signed JWT; see docs/oauth-preconfigured-providers.md.
# APPLE_CLIENT_ID=
# APPLE_CLIENT_SECRET=

# GitHub OAuth credentials (server-side readiness check only — values never sent to browser)
# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=

# Discord OAuth credentials (server-side readiness check only — values never sent to browser)
# DISCORD_CLIENT_ID=
# DISCORD_CLIENT_SECRET=
