# ============================================================================
# Website DiDi — variabile de mediu (TEMPLATE)
# Copiaza in .env.production si completeaza. .env.production NU se comite in git.
#
# Stratul de integrare cu backend-ul DiDi e comutabil DOAR din env:
#   - mod DEMO: mock-server-ul din pachetul de integrare (mock-server.js, :4000)
#   - mod REAL: host-urile platformei DiDi (livrate de operatorul platformei)
# Codul ramane neschimbat la comutare.
# ============================================================================

# ── ERPNext ─────────────────────────────────────────────────────────────────
# server-side (DNS docker pe didi-network)
ERPNEXT_API_URL=http://didi-erpnext:8080
# browser-facing (linkuri/PDF directe din browserul userului)
NEXT_PUBLIC_ERPNEXT_URL=http://<HOST>:8080
# generate de didi_custom.setup_website_integration.execute (user website_api@didi-erp.local)
ERPNEXT_API_KEY=<api_key>
ERPNEXT_API_SECRET=<api_secret>

# ── Keycloak / Auth.js (SSO utilizatori) ────────────────────────────────────
# ⚠️ Realm-ul real e `didi-clients` (NU `didi-website` — acela nu exista).
# Client OIDC confidential, livrat de operatorul platformei.
AUTH_KEYCLOAK_ID=didi-website-server
AUTH_KEYCLOAK_SECRET=<client_secret>
AUTH_KEYCLOAK_ISSUER=https://<KEYCLOAK_HOST>/auth/realms/didi-clients
AUTH_SECRET=<genereaza cu: openssl rand -base64 32>
AUTH_TRUST_HOST=true
AUTH_URL=http://<HOST>:3000
# doar pe medii de test cu certificat self-signed; se SCOATE la certificat valid
#NODE_TLS_REJECT_UNAUTHORIZED=0

# ── Backend DiDi (framework + agent) ────────────────────────────────────────
# DEMO:  DIDI_FRAMEWORK_URL=http://localhost:4000
#        DIDI_API_URL=http://localhost:4000/api
DIDI_FRAMEWORK_URL=http://<BACKEND_HOST>:<PORT_FRAMEWORK>
DIDI_API_URL=http://<BACKEND_HOST>:<PORT_AGENT>/api

# ── Cont de serviciu M2M (alocare pachete dupa plata; realm didi-admins) ────
# DEMO:  DIDI_ADMIN_TOKEN_URL=http://localhost:4000/realms/didi-admins/protocol/openid-connect/token
DIDI_ADMIN_TOKEN_URL=https://<KEYCLOAK_HOST>/auth/realms/didi-admins/protocol/openid-connect/token
DIDI_ADMIN_CLIENT_ID=didi-website-m2m
DIDI_ADMIN_CLIENT_SECRET=<client_secret M2M>
# id-urile planurilor din backend pentru abonamente (implicit 3=paid, 6=enterprise)
#DIDI_PLAN_ID_PAID=3
#DIDI_PLAN_ID_ENTERPRISE=6

# ── Stripe ──────────────────────────────────────────────────────────────────
# chei TEST pentru dezvoltare; chei LIVE la productie (dashboard.stripe.com/apikeys)
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...
STRIPE_SECRET_KEY=sk_test_...
# OBLIGATORIU — validarea semnaturii webhook (dashboard.stripe.com/webhooks)
STRIPE_WEBHOOK_SECRET=whsec_...
# price id-urile abonamentelor (Stripe Dashboard > Products)
STRIPE_PRICE_PAID_MONTHLY=price_...
STRIPE_PRICE_PAID_YEARLY=price_...
STRIPE_PRICE_ENTERPRISE_MONTHLY=price_...
STRIPE_PRICE_ENTERPRISE_YEARLY=price_...

# ── Site ────────────────────────────────────────────────────────────────────
NEXT_PUBLIC_SITE_URL=http://<HOST>:3000
NEXT_PUBLIC_DEFAULT_LOCALE=ro