# ===============================================
# IDO Backend Environment Variables
# ===============================================
# Copy this file to .env and fill in your values
# DO NOT commit .env to version control
# ===============================================

# CORS allowed origins (comma-separated) - the frontend origin(s). Keep in sync with
# the "Authorized JavaScript origins" on your Google OAuth client.
# Example: http://localhost:3000,https://your-frontend.vercel.app
ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000

# Storage path for temporary files (optional)
STORAGE_PATH=./storage

# Future: ML Model settings
# SPACY_MODEL=en_core_web_sm
# ENABLE_TOPIC_MODELING=true

# Google Data Portability (enables the "Connect Google" flow)
#
# TWO OAuth clients are required, because Google forbids mixing data-portability scopes
# with any other scope in one request (and each client auto-includes its previously
# granted scopes). Create two Web application clients at
# https://console.cloud.google.com/apis/credentials and add your frontend origin as an
# authorised JavaScript origin on BOTH. Only the client IDs are needed -- the browser
# holds the tokens, the backend never does, so there are no client secrets here.
#
# 1. GOOGLE_CLIENT_ID        - authorises ONLY the Data Portability scope
#                              (.../auth/dataportability.myactivity.youtube), used for the
#                              export initiate/poll/download.
# 2. GOOGLE_OAUTH_CLIENT_ID  - authorises openid + .../auth/youtube.readonly, used for
#                              identity (saving Wrappeds) and subscriptions.
GOOGLE_CLIENT_ID=
GOOGLE_OAUTH_CLIENT_ID=

# Storage for saved Wrapped cards (only generated cards, never uploaded data)
# REQUIRED - Supabase (Postgres) only, no SQLite fallback. Used identically in local
# development and production.
#
# Supabase: Project Settings -> Database -> Connection string -> URI.
# Use the "Transaction pooler" URI (port 6543) for containers/serverless; the code
# already disables prepared statements so pgbouncer is happy.
# Remember to URL-encode any special characters in the password.
#
# For tests that exercise the store, set TEST_DATABASE_URL (falls back to DATABASE_URL).
# Only fixed test-user rows are ever cleaned; real users are untouched.
DATABASE_URL=postgresql://postgres.<ref>:<password>@aws-0-<region>.pooler.supabase.com:6543/postgres?sslmode=require

# YouTube Data API v3 key (optional).
# Enables real names for taste worlds and the niche_meter card.
# Quota: channels.list costs 1 unit per 50 channels, against 10,000/day.
# Without it, taste worlds fall back to channel-name labels and niche_meter is hidden.
YOUTUBE_API_KEY=

# OpenRouter API key (optional) for naming taste worlds.
# Only used when the user ticks the consent box on the upload screen.
# Sends at most 5 channel names per cluster plus their YouTube topic categories -
# never watch history, timestamps, video titles, or anything identifying.
# Without it, taste worlds are labelled with their own top channel names.
OPENROUTER_API_KEY=
# OPENROUTER_MODEL=openrouter/free