.env.production.example

##
# Production environment template — point at the Catholic OS umbrella's shared
# Zitadel + OpenFGA stack (issue #597).
#
# Usage:
#   1. Copy this file to .env.production.
#   2. Fill in <FROM_HANDOFF_DOC> values from
#      https://github.com/CatholicOS/cdcf-infra/blob/main/auth/handoffs/liturgicalcalendar.md
#   3. Receive OPENFGA_API_TOKEN out-of-band through an encrypted channel —
#      it is NOT in the handoff doc and must NEVER be committed.
#   4. Optionally generate ZITADEL_MACHINE_TOKEN in the umbrella Zitadel
#      console under LiturgicalCalendar Org → Users → create machine user →
#      Personal Access Tokens. Only needed if LitCal makes outbound Zitadel
#      Management API calls (currently it does not, so leave unset).
#
# This file is a PRODUCTION OVERLAY. Settings not listed here inherit from
# .env.example. Anything sensitive (tokens, secrets, hashes) lives only in
# .env.production on the deployed host and is NEVER committed.
##

APP_ENV=production

##
# Zitadel — identity (umbrella production)
##
ZITADEL_ISSUER=https://auth.catholicdigitalcommons.org
ZITADEL_PROJECT_ID=<FROM_HANDOFF_DOC>
ZITADEL_CLIENT_ID=<FROM_HANDOFF_DOC>

# Optional. Personal Access Token for the LiturgicalCalendar Org machine user.
# Only required if LitCal makes outbound Zitadel Management API calls (currently
# limited to RoleCascadeService when revoking roles end-to-end; if that flow is
# not exercised in prod, leave unset and avoid generating the token).
# ZITADEL_MACHINE_TOKEN=<OOB_DELIVERED>

# Not used in the umbrella deployment — Zitadel is reached directly via
# ZITADEL_ISSUER, not via a docker-network internal hostname.
# ZITADEL_INTERNAL_URL=

##
# OpenFGA — authorization (umbrella production)
##
OPENFGA_API_URL=https://authz.catholicdigitalcommons.org
OPENFGA_STORE_ID=<FROM_HANDOFF_DOC>
OPENFGA_MODEL_ID=<FROM_HANDOFF_DOC>

# The umbrella-wide bearer token for the OpenFGA HTTP API. Delivered through
# an encrypted channel separate from the handoff doc. NEVER commit. The
# umbrella refers to this as OPENFGA_PRESHARED_KEY; our code reads it as
# OPENFGA_API_TOKEN.
OPENFGA_API_TOKEN=<OOB_DELIVERED>

##
# Database, JWT, CORS, etc.
#
# These are NOT umbrella-controlled. Configure them per the rest of
# .env.example and your hosting setup. Examples of common production-only
# overrides:
#   - JWT_SECRET                  (32+ chars, generated per-environment)
#   - ADMIN_PASSWORD_HASH         (Argon2id, generated locally — required in prod)
#   - CORS_ALLOWED_ORIGINS        (comma-separated; do NOT use '*' with cookies)
#   - API_BASE_PATH               (e.g. /api/v5)
#   - DB_HOST / DB_PORT / DB_NAME / DB_USER / DB_PASSWORD
##

##
# Post-deploy verification (issue #597). Run these from the deployed host to
# confirm the umbrella switch landed correctly.
##

# 1. OIDC discovery — anyone can hit this; confirms the issuer is reachable.
#    curl -s https://auth.catholicdigitalcommons.org/.well-known/openid-configuration | jq

# 2. JWKS — what OidcAuthMiddleware uses to validate JWTs.
#    curl -s https://auth.catholicdigitalcommons.org/oauth/v2/keys | jq

# 3. OpenFGA store ping. The curl below uses shell expansion of
#    $OPENFGA_API_TOKEN — either export it first
#    (`export OPENFGA_API_TOKEN=<OOB-delivered-key>`) or substitute the
#    literal value inline in the Authorization header. Also replace
#    <store-id> with the value from the handoff doc. 200 with the store
#    body confirms auth works.
#    curl -s -H "Authorization: Bearer $OPENFGA_API_TOKEN" \
#         https://authz.catholicdigitalcommons.org/stores/<store-id> | jq

# 4. End-to-end: hit any authenticated LitCal endpoint with a fresh JWT and
#    verify the OidcAuthMiddleware validates it against the umbrella's JWKS,
#    and PermissionAdminHandler honours OpenFGA's tuples for the user.