apps/api/.env.example

DATABASE_URL="postgresql://postgres:postgres@localhost:5432/gold_bank?schema=public"

# Must match API_PORT in the repo-root .env (source of truth for all dev
# ports). NestJS/Prisma only load .env from this app's own directory, so this
# value is kept in sync manually rather than read from the root file.
PORT=3000

# Customer app sessions (security hotfix stage 2).
# Separate from JWT_SECRET so an admin token can never validate as a customer
# token. Falls back to JWT_SECRET, then to a dev-only string, when unset.
JWT_CUSTOMER_SECRET=
# Customer token lifetime. The reference issued a token that never expired.
JWT_CUSTOMER_EXPIRES_IN=30d
feat: initial commit 2026-09-09 06:46:27 +03:30			`DATABASE_URL="postgresql://postgres:postgres@localhost:5432/gold_bank?schema=public"`
SearchView: Removed the dynamic collection-tile grid (e.g. "پرفروش‌های این هفته") and the "نتایج / N محصول" section header from the UI. Underlying data/filtering logic untouched. 2026-09-18 12:54:45 +03:30
			`# Must match API_PORT in the repo-root .env (source of truth for all dev`
			`# ports). NestJS/Prisma only load .env from this app's own directory, so this`
			`# value is kept in sync manually rather than read from the root file.`
feat: initial commit 2026-09-09 06:46:27 +03:30			`PORT=3000`
parity(api,apps): security hotfix stage 2 - real customer sessions, close IDOR 2026-09-22 01:20:00 +03:30
			`# Customer app sessions (security hotfix stage 2).`
			`# Separate from JWT_SECRET so an admin token can never validate as a customer`
			`# token. Falls back to JWT_SECRET, then to a dev-only string, when unset.`
			`JWT_CUSTOMER_SECRET=`
			`# Customer token lifetime. The reference issued a token that never expired.`
			`JWT_CUSTOMER_EXPIRES_IN=30d`