# Real environment configuration â€” DO NOT COMMIT.
# Loaded at runtime by api/routes/api.php. Web access is denied by api/.htaccess.
# Secrets below are randomly generated and must be unique per deployment.

JWT_SECRET="9cb9eb8767e6faec5ec241a6b70e35bf0a73fde3962799ef52ae1deccb63c9d9"
REG_FILE_KEY="f549a8de401e70fea5925f7fbc8e9316b28234398278dca76fe16d2dda5677ad"

# Application environment. PRODUCTION deployments MUST set:
#   APP_ENV="production"
APP_ENV="production"
APP_URL="https://ctf.sadjad.ac.ir"

# --- Card-to-card payment (Ø¯Ø±Ú¯Ø§Ù‡ Ø®ÙˆØ¯Ø¯Ø§Ø±) ---
CARD_NUMBER="6104337658827041"
CARD_OWNER="دانشگاه سجاد"
CARD_BANK=""
CARD_IBAN=""

# Cookie Secure flag: "off" for local HTTP dev (XAMPP over http://127.0.0.1).
# With the default "on", login sets Secure HttpOnly cookies that browsers refuse
# to send back over plain HTTP -> admin/me & users/me always 401 -> navigation
# bounces to the login page. PRODUCTION (HTTPS) MUST keep "on" (fail-closed).
COOKIE_SECURE="on"

# Database â€” use a dedicated least-privilege account, never root with empty password (K3).
# Local dev uses ctf1405; tests use ctf1405_test (never the same DB).
DB_HOST="localhost"
DB_NAME="ctfsadja_ctf1405"
DB_USER="ctfsadja_ctfapp"
DB_PASS="dx219)7LXvE[xP"

# Directory of the mysql/mysqldump CLI binaries.
DB_CLI_DIR=""

# CORS â€” leave empty to disable cross-origin entirely (safe default).
CORS_ALLOWED_ORIGINS="https://ctf.sadjad.ac.ir"

# Brute-force protection (per-IP + per-account lockout on login) and CSRF double-submit.
RATE_LIMIT="on"
CSRF_PROTECT="on"

# Backup encryption key for encrypted database dumps.
BACKUP_ENCRYPTION_KEY="88f7642302b76c5049e426fcee237f4fb43ff9810c4b4bd882c348827ec9d34e"

# Shared backup directory (relative to project root, or absolute path).
BACKUP_DIR="uploads/backups"

# Timing-safe dummy hash for login (prevents user enumeration via response time).
DUMMY_HASH="$2y$10$gNybXCJXkWHc8xHGWyZLK.lwVZKUCUcZUuy.1eLypPVNHRR1Cqr4i"

# Dedicated 2FA (TOTP) encryption key, independent from JWT_SECRET (F2).
TOTP_SECRET="36ba4fe0e5ce105cadc19fd9927bd707516253fff3dceb404fc0d64248952fd8"

# Force 2FA for ALL admin logins.
MFA_ENFORCED="on"
RESTORE_DB_USER="ctf_restore"
RESTORE_DB_PASS="61c3859dc0bfda6f0c8d78782cc41af0fe3c992d0ebb7444e74668c5e5869bf0"
DB_MIGRATION_USER="ctf_migration"
DB_MIGRATION_PASS="fe045a851952b4352f527a9d8ebcb3e6d2bad04098a12c66777e22bb79d527e3"

# R-026 (deferred): anonymize Ø¨Ù‡â€ŒØµÙˆØ±Øª Ù¾ÛŒØ´â€ŒÙØ±Ø¶ ØºÛŒØ±ÙØ¹Ø§Ù„ Ø§Ø³Øª (ÙØ¹Ø§Ù„â€ŒØ³Ø§Ø²ÛŒ Ø¨Ø§ ØªØµÙ…ÛŒÙ… Û².Û°)
ANONYMIZE_ENABLED="off"

# --- SMS (sms.ir) ---
SMS_ENABLE="true"
SMS_API_KEY="HFiaTSoNSa8x2DjopKmvQOmYzSG3osvs7DWflclYxbQz2skN"
SMS_LINE_NUMBER="30002108040116"
SMS_BASE_URL="https://api.sms.ir/v1"
SMS_OTP_TEMPLATE_ID="667685"
SMS_ADMIN_OTP_TEMPLATE_ID="113477"
SMS_RESEND_OTP_TEMPLATE_ID="321016"
SMS_RESET_TEMPLATE_ID="834964"
SMS_REG_TEMPLATE_ID="234768"
SMS_TEAM_TEMPLATE_ID="615154"
SMS_DISABLED_TEMPLATE_ID="998929"
SMS_CERT_TEMPLATE_ID="908806"
SMS_OTP_TEMPLATE_PARAM="CODE"
SMS_OTP_EXPIRY=300
SMS_API_IP="185.211.56.44"
SMS_OTP_LENGTH=6
SMS_OTP_MAX_ATTEMPTS=5

SMS_DEV_BYPASS_CODE=""
# PII encryption keys (helpers/pii.php) â€” production pair; rotate per docs/runbooks/03-pii-encryption.md
PII_ENCRYPTION_KEY=4b44a0e2dd09fc915568ccc8846f410ce9bd1775f2eadc3288a0709ea081e3ff
PII_INDEX_KEY=84b58a59af4958d4cf6814d26b2e050fc222065fb68d966efd41b1105b6b4922
