# === ServChan Environment Variables (All Secrets) ===
# Copy this file to .env and fill in the real values.
# Never commit the real .env file.
#
# The application now loads ALL secrets exclusively from environment variables.
# config/config.json should no longer contain any credentials.

# --- Required for core bot operation ---
WEBEX_BOT_TOKEN=your-production-or-dev-bot-token
SC_CLIENT_ID=your-servicechannel-client-id
SC_CLIENT_SECRET=your-servicechannel-client-secret
SC_USERNAME=your-servicechannel-username
SC_PASSWORD=your-servicechannel-password

# --- xAI (Grok) ---
XAI_TOKEN=your-xai-api-key
XAI_MODEL=grok-4-1-fast-reasoning

# --- Optional / Integration specific ---
WEBEX_BASE_URL=https://webexapis.com/v1
WEBEX_BOT_PERSON_ID=your-bot-person-id          # Used by space cleanup (see note below)
# CollabSupport (collabFinder) HTTP API — required for /woSummary, /woHistory,
# /avStatus, and /woAttachments.
#
# Host / smoke tests (public URL behind nginx):
CS_API_BASE=https://bot.joesjavajoint.com/CollabSupport
#
# Docker (set in docker-compose — do not put in .env unless overriding):
#   CS_API_BASE_INTERNAL=http://collabfinder:1800
# Requires collabFinder running and servchan-bot on network collabfinder_collabnet.

# RED, Meraki, Atlas, Optisign — only needed if you use the related features
# RED_CLIENT_ID=...
# RED_API_KEY=...
# RED_COMPANY_IDS=...
# MERAKI_API_KEY=...
# MERAKI_ORG_ID=...
# ATLAS_AUTH_KEY=...
# OPTISIGN_API_KEY=...

# --- Space cleanup (optional) ---
# Webex room for daily consolidated close-out digest and /confirmed ops notifications.
# COMPLETED_OPERATIONS_ROOM_ID=Y2lzY29zcGFyazovL3VzL1JPT00vNjdmZmYxZTAtZmM3Ny0xMWYwLWE2MzUtZGY0ZmQ4NWUwMGMz
# Days after any non-terminal COMPLETED status before including in the daily digest.
# Auto-remove still applies only to COMPLETED/CONFIRMED, COMPLETED/CANCELLED, and COMPLETED/NO CHARGE.
# Only work orders for this service provider are included in cleanup (default: Pro-Motion).
# SPACE_CLEANUP_PROVIDER_NAME=Pro-Motion Technology Group, LLC
# SPACE_CLEANUP_PROVIDER_ID=2000002215
# SPACE_CLEANUP_REMINDER_DAYS=60
# Cron for daily consolidated digest (default 14:00 UTC). Digest only — no auto-delete.
# SPACE_CLEANUP_REMINDER_CRON=0 0 14 * * *

# --- Admin endpoints (/cleanup-test, /stale-workorders, /track-backfill) ---
# Required in production. If unset in NODE_ENV=production the endpoints refuse
# requests with 503. In dev (NODE_ENV!=production) unset means "allow" with a
# warning in the log.
ADMIN_TOKEN=change-me-to-a-long-random-string

# --- Webhook authentication (optional, off by default) ---
# ServiceChannel signs every webhook per their docs:
#   https://developer.servicechannel.com/guides/wh/receive-events-and-respond/
#   Sign-Type: HMACSHA256
#   Sign-Data: <base64(HMAC-SHA256(rawBody, signingKey))>
#
# Setup:
#   1. Fetch the Signing Key with:
#        GET /v3/NotificationSubscriptions/SigningKey
#      or copy it from the ServiceChannel UI.
#   2. Paste it into SC_WEBHOOK_SIGNING_SECRET below and set
#        SC_WEBHOOK_AUTH_MODE=log
#      to observe verification results without rejecting anything.
#   3. Once the log shows repeated OK lines for real webhooks, flip to
#        SC_WEBHOOK_AUTH_MODE=enforce
#
# See src/server/webhookAuth.js for full docs.

SC_WEBHOOK_AUTH_MODE=off                        # off | log | enforce
# SC_WEBHOOK_SIGNING_SECRET=paste-the-servicechannel-signing-key-here

# The defaults below match ServiceChannel's format exactly — for SC you should
# NOT need to override any of them. They exist for other webhook sources.
# SC_WEBHOOK_SIGNATURE_HEADER=sign-data         # SC's default: "Sign-Data"
# SC_WEBHOOK_SIGNATURE_ENCODING=base64          # SC uses base64; auto also works
# SC_WEBHOOK_SIGNATURE_ALGO=sha256              # SC uses HMAC-SHA256
# SC_WEBHOOK_SIGNATURE_PREFIX=                  # SC has no prefix; leave empty

# Alternative to HMAC signing: a static shared-secret header. Not used by
# ServiceChannel — only relevant if you're proxying webhooks through something
# else that adds a bearer-style token.
# SC_WEBHOOK_TOKEN=some-long-random-value
# SC_WEBHOOK_TOKEN_HEADER=x-webhook-token

# --- Proposal approval (optional) ---
# RejectReasonCodeId used when auto-rejecting a superseded approved proposal.
# Fetch valid values via GET /proposals/RejectionReasons in ServiceChannel.
# If unset, ServChan picks the first reason matching "revised"/"superseded"/etc.
# SC_PROPOSAL_REJECT_REASON_ID=7

# SPACE_CLEANUP_REMINDER_CRON=0 0 14 * * *

# --- FedEx shipment tracking (optional) ---
# Register at https://developer.fedex.com → create project → add Track API v1.
# Sandbox: FEDEX_API_BASE=https://apis-sandbox.fedex.com
# Production: FEDEX_API_BASE=https://apis.fedex.com
# FEDEX_CLIENT_ID=your-api-key
# FEDEX_CLIENT_SECRET=your-secret-key
# FEDEX_ACCOUNT_NUMBER=your-fedex-account-number
# FEDEX_API_BASE=https://apis.fedex.com
# SHIPMENT_TRACKING_ENABLED=true
# Every 2 hours 8am–6pm Eastern (override cron/timezone if needed)
# SHIPMENT_TRACKING_CRON=0 0 8,10,12,14,16,18 * * *
# SHIPMENT_TRACKING_TIMEZONE=America/New_York

# --- Attachment auto-post (optional) ---
# When true (default), ServChan posts SC photos/invoices to the Webex WO room
# on room creation and when WorkOrderNoteAdded webhooks include AttachmentIds.
# Set to false to disable automatic posting (manual /woAttachments still works).
# AUTO_POST_ATTACHMENTS=true

# --- Runtime configuration (non-secret) ---
DB_PATH=./data/webex_sc_mappings.db
# Directory for daily *.log files. Every logger in the app resolves to this
# single location (structured logs, webhook payload archive, cleanup cron).
# In Docker the container's WORKDIR is /app, so ./logs → /app/logs, which is
# where docker-compose mounts the host ./logs volume. Change this only if
# you're intentionally routing logs elsewhere (e.g. /var/log/servchan).
LOG_DIR=./logs
PORT=1458
NODE_ENV=production