env.example

# ALLOWED_ORIGINS=

# Database configuration
# For SQLite (default):
DATABASE_URL="file:./dev.db"
# For MySQL:
# DATABASE_URL="mysql://user:password@localhost:3306/heimdall"
# For PostgreSQL (e.g. Vercel Postgres):
# DATABASE_URL="postgres://user:password@host/dbname"

AUTH_MODE="LDAP"   # Choose strictly "LDAP" or "SSO"

# Disable mock mode
MOCK_LDAP="false"

# The literal connection string to your LDAP server
LDAP_URL="ldap://myldap.example.com:389"

# The secure Service Account credentials allowing the system to query AD initially.
LDAP_BIND_DN=""
LDAP_BIND_PASSWORD=""

# The overarching domain directory where it should scope its searches.
LDAP_SEARCH_BASE_DNS=""

# The attribute standard matching the username query (Optional, defaults to 'uid' in this mode)
LDAP_USERNAME_ATTRIBUTE="sAMAccountName"

# (Optional) If you have a highly complex filter you need to inject for the AD search logic (e.g. limiting to specific ObjectClasses), you can add the raw string filter here.
# Place `{{username}}` exactly where the login string should be dynamically replaced during execution!
LDAP_SEARCH_FILTER="(|(sAMAccountName=%s)(userPrincipalName=%s))"

# OpenID Connect (OIDC) Configurations (Google, Keycloak, etc.)
OAUTH_CLIENT_ID=""
OAUTH_CLIENT_SECRET=""
OAUTH_AUTH_URL="https://accounts.google.com/o/oauth2/v2/auth"
OAUTH_TOKEN_URL="https://oauth2.googleapis.com/token"
OAUTH_REDIRECT_URI="http://localhost:3000/api/auth/callback"

# List of users with approver access (comma-separated)
APPROVERS="aguel.wijaya,admin1"