.env.example

NODE_ENV=development
PORT=4000
DATABASE_URL=postgresql://earnproof:earnproof@localhost:5432/earnproof
REDIS_URL=redis://localhost:6379

# Target for the PostgreSQL integration suite (npm run test:integration).
# Deliberately separate from DATABASE_URL, and refused unless the database name
# contains "test": the harness creates, truncates and drops databases derived
# from this name. The named database is never itself connected to — it supplies
# the prefix for <name>_template and <name>_w<worker>.
# See docs/integration-testing.md.
TEST_DATABASE_URL=postgresql://earnproof:earnproof@localhost:5432/earnproof_test

# ───────────────────────────────────────────────────────────────────────────
# APPLICATION URLS
# ───────────────────────────────────────────────────────────────────────────
APP_URL=http://localhost:3000
API_URL=http://localhost:4000

# ───────────────────────────────────────────────────────────────────────────
# STELLAR NETWORK
# ───────────────────────────────────────────────────────────────────────────
STELLAR_NETWORK=testnet
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
STELLAR_NETWORK_PASSPHRASE=Test SDF Network ; September 2015

# ───────────────────────────────────────────────────────────────────────────
# SECRETS (REQUIRED, never logged or exposed in error messages)
# ───────────────────────────────────────────────────────────────────────────
# Must be at least 8 characters. Used for signing session tokens.
SESSION_SECRET=replace_me

# Must be at least 8 characters. Used for verifying credential signatures.
CREDENTIAL_SIGNING_SECRET=replace_me

# Payment encryption key: 32 bytes as hex (64 chars) or base64
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
PAYMENT_ENCRYPTION_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=

# ───────────────────────────────────────────────────────────────────────────
# AUTHENTICATION RATE LIMITING
# ───────────────────────────────────────────────────────────────────────────
# Configurable limits to prevent abuse of challenge creation and verification
# Limits are per hashed wallet identifier and hashed client metadata (no raw IP storage)
AUTH_RATE_LIMIT_MAX_CHALLENGE_CREATIONS=10
AUTH_RATE_LIMIT_CHALLENGE_CREATION_WINDOW_MS=900000
AUTH_RATE_LIMIT_MAX_VERIFICATIONS=5
AUTH_RATE_LIMIT_VERIFICATION_WINDOW_MS=900000

# Challenge retention: how long to keep used/expired challenges before cleanup
AUTH_CHALLENGE_RETENTION_DAYS=7
# Auth audit event retention: how long to keep auth audit events
AUTH_AUDIT_RETENTION_DAYS=90

# Cron expressions for cleanup jobs (optional, have sensible defaults)
# Sessions: midnight every day
AUTH_SESSION_CLEANUP_CRON=0 0 * * *
# Challenges: 2 AM every day
AUTH_CHALLENGE_CLEANUP_CRON=0 2 * * *
# Audit: 3 AM every day
AUTH_AUDIT_CLEANUP_CRON=0 3 * * *

# ───────────────────────────────────────────────────────────────────────────
# CONTRACT ANCHORING (Optional feature)
# ───────────────────────────────────────────────────────────────────────────
CONTRACT_ANCHORING_ENABLED=false
CONTRACT_ANCHORING_REQUIRED=false
STELLAR_CLI_PATH=stellar
STELLAR_CLI_SOURCE=
PROOF_REGISTRY_CONTRACT_ID=
EARNPROOF_ISSUER_ADDRESS=
EARNPROOF_SCHEMA_VERSION=1

# ───────────────────────────────────────────────────────────────────────────
# GLOBAL API RATE LIMITING
# ───────────────────────────────────────────────────────────────────────────
# "default" applies to every route not covered by a stricter tier.
# "strict" covers expensive operations (proof creation, payment sync).
# "verification" covers the public proof-verification lookup.
RATE_LIMIT_DEFAULT_TTL_MS=60000
RATE_LIMIT_DEFAULT_LIMIT=100
RATE_LIMIT_STRICT_TTL_MS=60000
RATE_LIMIT_STRICT_LIMIT=10
RATE_LIMIT_VERIFICATION_TTL_MS=60000
RATE_LIMIT_VERIFICATION_LIMIT=30
# Authenticated callers receive this multiplier across every tier above.
RATE_LIMIT_AUTHENTICATED_MULTIPLIER=3

# ───────────────────────────────────────────────────────────────────────────
# ISSUER REGISTRY (Optional feature)
# ───────────────────────────────────────────────────────────────────────────
ISSUER_REGISTRY_ENABLED=false
ISSUER_REGISTRY_CONTRACT_ID=

# ───────────────────────────────────────────────────────────────────────────
# VERIFICATION EVENT PRIVACY CONFIGURATION
# ───────────────────────────────────────────────────────────────────────────
# VERIFICATION_EVENT_RETENTION_DAYS: How long to retain privacy-safe verification events before deletion
# This controls the retention window for aggregate analytics on proof verification outcomes.
# All PII (IP, user agent, credentials) is redacted and replaced with non-identifying metadata hashes.
# Default: 90 days. Must be 1–3650 days.
VERIFICATION_EVENT_RETENTION_DAYS=90

# Verification Event Hash Salt Rotation
# VERIFICATION_HASH_SALT_VERSION: Versioned salts for hashing verification metadata
# Salt rotates every 30 days (saltVersion = floor(daysSinceEpoch / 30))
# Different versions produce different hashes for same input, reducing long-term linkability
# This field controls which version is active; see also VERIFICATION_HASH_SALT_V* vars
VERIFICATION_HASH_SALT_VERSION=0

# ───────────────────────────────────────────────────────────────────────────
# DATA RETENTION (all durations in days, 1–3650 range enforced)
# ───────────────────────────────────────────────────────────────────────────
# Retention durations in days, per record class. See docs/data-retention.md for
# the full table: purpose, owner, and disposal behaviour for each class.
#
# Every class has a safe default, so leaving these unset never means "keep
# forever". An invalid or out-of-range value causes that class to fail rather
# than silently falling back to the default.
#
# Bounds: minimum 1 day, maximum 3650 days (10 years).
RETENTION_WALLET_CHALLENGE_DAYS=7
RETENTION_AUTH_SESSION_DAYS=30
RETENTION_WEBHOOK_DELIVERY_DAYS=30
RETENTION_AUDIT_LOG_DAYS=365
RETENTION_FAILED_ANCHORING_DAYS=90

# Cleanup schedule. Retention is measured in days, so running more often adds
# database contention without shortening anything.
RETENTION_CLEANUP_CRON=0 3 * * *

# Report what would be removed without deleting anything. Enable after changing
# a retention duration, read the counts, then disable.
RETENTION_DRY_RUN=false

# Proof credentials, revocation evidence, and anchoring state are preserved and
# have no override: they are never swept automatically. See docs/data-retention.md.

# ───────────────────────────────────────────────────────────────────────────
# HEALTH CHECKS
# ───────────────────────────────────────────────────────────────────────────
# Health probe timeout in milliseconds. Must stay below orchestrator timeout (30s typical).
HEALTH_PROBE_TIMEOUT_MS=2000
# Cache TTL for health probe results (milliseconds)
HEALTH_CACHE_TTL_MS=5000

# ───────────────────────────────────────────────────────────────────────────
# INTEGRATION TESTING (only used by npm run test:integration)
# ───────────────────────────────────────────────────────────────────────────
# Whether to keep test databases after tests complete (for debugging)
INTEGRATION_KEEP_DATABASES=false
# Integration test timeout in milliseconds
INTEGRATION_TEST_TIMEOUT_MS=30000

# ───────────────────────────────────────────────────────────────────────────
# SEEDING
# ───────────────────────────────────────────────────────────────────────────
# Allow demo seed data in non-production environments (used by npm run seed:demo)
ALLOW_SYNTHETIC_SEED=true