DATABASE_URL="postgresql://postgres:postgres@localhost:5432/gold_bank?schema=public"

# Must match API_PORT in the repo-root .env (source of truth for all dev
# ports). NestJS/Prisma only load .env from this app's own directory, so this
# value is kept in sync manually rather than read from the root file.
PORT=3000

# Customer app sessions (security hotfix stage 2).
# Separate from JWT_SECRET so an admin token can never validate as a customer
# token. Falls back to JWT_SECRET, then to a dev-only string, when unset.
JWT_CUSTOMER_SECRET=
# Customer token lifetime. The reference issued a token that never expired.
JWT_CUSTOMER_EXPIRES_IN=30d

# ---------------------------------------------------------------------------
# SMS gateway — Trez panel (port of henza_server/app/Models/Sms.php:57-82)
# ---------------------------------------------------------------------------
# NEVER commit real values. The reference hardcoded its live production
# credentials in the source (SEC-12); those are treated as compromised and are
# not reused. Set the real values in .env, which is gitignored.
#
# In production the server REFUSES TO START when the three required variables
# below are unset, because without them no customer can receive a login code.
# Outside production it only warns, and OTP codes are logged locally instead.

# "trez" (default) or "none" to disable sending entirely.
SMS_PROVIDER=trez
# Defaults to the reference endpoint when unset; override for staging.
SMS_TREZ_URL=
# Required in production:
SMS_TREZ_USERNAME=
SMS_TREZ_PASSWORD=
# The panel's sender line — the `PhoneNumber` form field.
SMS_TREZ_SENDER_LINE=
# Comma-separated admin numbers for order/document notifications. The reference
# hardcoded six mobile numbers across its controllers (STUB-05); empty means
# no admin notifications are sent.
SMS_ADMIN_RECIPIENTS=