.env.example

# SWRMS environment configuration
# Copy this file to .env.local and fill in the values.

# ── Database ───────────────────────────────────────────────────
# MongoDB connection string. Use Atlas free tier for pilot.
MONGODB_URI=mongodb://localhost:27017/swrms

# ── Auth ──────────────────────────────────────────────────────
# next-auth JWT signing secret. Generate with:
#   openssl rand -base64 32
NEXTAUTH_SECRET=
NEXTAUTH_URL=http://localhost:3000

# ── Routing service (Phase 3) ──────────────────────────────────
# OSRM base URL. Defaults to the public demo if unset.
# The public demo is RATE-LIMITED (~1 req/s) and not suitable for
# production. For govt deployment, self-host with India OSM data:
#   https://github.com/Project-OSRM/osrm-backend
# Example for self-hosted: OSRM_BASE_URL=https://osrm.bmc.internal
OSRM_BASE_URL=https://router.project-osrm.org

# ── Live tracking (Phase 4) ────────────────────────────────────
# Maximum metres a worker may stray from the snapped route polyline
# before a deviation alert is fired.
TRACKING_DEVIATION_THRESHOLD_METERS=120

# Minutes a worker must remain stationary (less than 25m of movement)
# during shift before an idle alert is fired.
TRACKING_IDLE_THRESHOLD_MINUTES=10

# Active push notification for idle (stationary) alerts. OFF by default
# because most ops teams find it noisy - workers legitimately stop in
# traffic, take lunch, talk to residents, etc. Set to 1 if your
# department wants every idle window to actively notify supervisors.
# The verification log + inbox row are written either way; this flag
# only controls whether a desktop/phone push is sent.
TRACKING_IDLE_PUSH=

# ── Web Push (Phase 8) ─────────────────────────────────────────
# VAPID keypair for browser push notifications. Generate one with:
#   npm run vapid:generate
# The PUBLIC key is exposed to the browser via /api/push/vapid-key.
# The PRIVATE key never leaves the server.
NEXT_PUBLIC_VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=

# Push notifications are signed with this subject (mailto: or https URL).
# Push services use it to contact the operator when an endpoint misbehaves.
VAPID_SUBJECT=mailto:ops@bmc.example

# Shared secret for /api/cron/* endpoints. Anyone hitting those routes
# must pass this in the `x-cron-secret` header. Generate with:
#   openssl rand -hex 32
CRON_SECRET=

# ── Demo bypass (development / stakeholder walkthroughs only) ──
# Skips the face-registration gate on the staff PWA AND short-circuits
# server-side face comparison to "verified". Lets a demo user log in as
# any seeded staff and hit attendance / photos / tracking without
# walking through camera + face capture each time.
#
# UNSET (or empty) for any production / pilot deployment - the face
# verification is a real anti-fraud layer.
NEXT_PUBLIC_DEMO_BYPASS_FACE=