.env.example

# === REQUIRED ===
# GROQ_API_KEY: Required for Groq AI API calls (https://console.groq.com).
GROQ_API_KEY="your_groq_api_key_here"

# DATABASE_URL: PostgreSQL connection string
DATABASE_URL="postgresql://user:password@localhost:5432/studysync"

# JWT_SECRET: Required for authentication. Must be a strong random string (min 32 chars).
JWT_SECRET="replace_with_strong_random_secret_min_32_chars"

# === OPTIONAL ===
# APP_URL: The URL where this app is hosted.
APP_URL="http://localhost:3000"

# PORT: Server port (default: 3000)
PORT=3000

# ALLOWED_ORIGINS: Comma-separated list of allowed CORS origins
ALLOWED_ORIGINS="http://localhost:3000"

# BCRYPT_ROUNDS: Password hashing cost (default: 10, min: 10)
BCRYPT_ROUNDS=10

# === EMAIL (Resend) ===
# RESEND_API_KEY: Get one at https://resend.com/api-keys
# Leave unset in local dev to have emails logged to console instead.
RESEND_API_KEY="re_your_api_key_here"

# MAIL_FROM: Sender address. Must use a verified domain on Resend,
# or use onboarding@resend.dev for testing.
MAIL_FROM="StudySync AI <onboarding@resend.dev>"

# === RATE LIMITING ===
# All rate limits are configurable. Defaults are reasonable for most apps.

# General API rate limit
RATE_LIMIT_GENERAL_WINDOW_MS=900000    # 15 minutes
RATE_LIMIT_GENERAL_MAX=100             # requests per window

# Auth route rate limit (per IP + per email)
RATE_LIMIT_AUTH_WINDOW_MS=900000       # 15 minutes
RATE_LIMIT_AUTH_MAX=20                 # requests per window

# Strict auth rate limit (repeated offenders, per IP)
RATE_LIMIT_AUTH_STRICT_WINDOW_MS=3600000  # 1 hour
RATE_LIMIT_AUTH_STRICT_MAX=5              # requests per window

# AI endpoint rate limit (per user)
RATE_LIMIT_AI_WINDOW_MS=60000          # 1 minute
RATE_LIMIT_AI_MAX=10                   # requests per window

# Write operation rate limit (per user)
RATE_LIMIT_WRITE_WINDOW_MS=60000       # 1 minute
RATE_LIMIT_WRITE_MAX=30                # requests per window