# ============================================
# Appspace + Webex Alerts Service
# Copy this file to .env (prod) or .env.dev and fill in real values.
# Never commit real secrets.
# ============================================

# ---- Server ----
PORT=3000
NODE_ENV=production          # or development
PUBLIC_HOST=https://your-public-host.example.com   # used in logs only

# ---- Webex Bot (required) ----
WEBEX_BOT_TOKEN=your-webex-bot-access-token
WEBEX_ROOM_ID=your-webex-room-id

# ---- Appspace Webhook (from Appspace Outbound Webhooks) ----
WEBHOOK_SECRET=your-shared-secret-for-appspace-webhooks   # optional but recommended; checked via x-webhook-secret or x-secret header

# ---- Appspace API (refresh token flow) ----
APPSPACE_INSTANCE_URL=https://your-instance.cloud.appspace.com
APPSPACE_SUBJECT_ID=your-application-subject-id
APPSPACE_REFRESH_TOKEN=your-long-lived-refresh-token
APPSPACE_API_BASE_URL=https://api.cloud.appspace.com     # or your regional API base
APPSPACE_CONSOLE_BASE_URL=https://app3.cloud.appspace.com

# (Legacy / query-offline.js still references this static token style)
APPSPACE_API_TOKEN=your-static-token-if-needed
APPSPACE_BASE_URL=https://api.cloud.appspace.com

# ---- Workspace ONE MDM (for enrichment) ----
WS1_BASE_URL=https://as1991.awmdm.com                    # your WS1 server URL (used for API calls in mdm.js)
WS1_CONSOLE_BASE_URL=https://cn1896.awmdm.com            # console base for per-device links (MUST be the console hostname like cn1896, NOT the API hostname like as1896 — links will be broken otherwise)
WS1_CLIENT_ID=your-oauth-client-id
WS1_CLIENT_SECRET=your-oauth-client-secret
WS1_TENANT_CODE=your-tenant-code

# ---- Debugging (optional) ----
DEBUG=false                  # enables verbose per-request / per-lookup logs (mdm lookups, ignores, command receipts, etc.)
DEBUG_WEBHOOK=false          # set to "true" to log *full* Appspace webhook JSON payloads (avoid in prod - may contain sensitive data)
LOG_FORMAT=json              # set to "json" (or NODE_ENV=production) for structured JSON logs suitable for Docker log aggregation (Loki, CloudWatch, etc.)