# Dirt Supabase Configuration
# For local development using `supabase start`
# See: https://supabase.com/docs/reference/cli/config

[api]
enabled = true
# Port to use for the API URL.
port = 54321
# Schemas to expose in your API. Tables, views and functions in these schemas will get API endpoints.
schemas = ["public", "graphql_public"]
# Extra schemas to add to the search_path of every request. public is always included.
extra_search_path = ["public", "extensions"]
# The maximum number of rows returned from a view, table, or stored procedure.
max_rows = 1000

[api.tls]
enabled = false

[db]
# Port to use for the local database URL.
port = 54322
# Port used by db diff command to initialize the shadow database.
shadow_port = 54320
# The database major version to use. This must be the same as your remote database version.
major_version = 15

[db.pooler]
enabled = false
# Port to use for the local connection pooler.
port = 54329
# Specifies when a server connection can be reused by other clients.
pool_mode = "transaction"
# How many server connections to allow per user/database pair.
default_pool_size = 20
# Maximum number of client connections allowed.
max_client_conn = 100

[realtime]
enabled = true
# IP range for realtime connections
# ip_version = "IPv6"

[studio]
enabled = true
# Port to use for Supabase Studio.
port = 54323
# External URL of the API server that frontend connects to.
api_url = "http://127.0.0.1"
# OpenAI API key for Supabase Studio AI assistant (optional)
# openai_api_key = "env(OPENAI_API_KEY)"

[inbucket]
enabled = true
# Port to use for the email testing server web interface.
port = 54324
# Uncomment to expose additional ports for smtp and pop3
# smtp_port = 54325
# pop3_port = 54326

[storage]
enabled = true
# The maximum file size allowed (in bytes).
file_size_limit = "50MiB"

[storage.image_transformation]
enabled = true

# S3 buckets configured for Dirt
# Note: Buckets are created via migrations, not config.toml
# Future buckets: review-images, avatars

[auth]
enabled = true
# The base URL of your website. Used for generating email links.
site_url = "http://127.0.0.1:3000"
# A list of *exact* URLs that auth providers are permitted to redirect to.
# Includes app schemes and Edge Function callback URLs for auth flow
additional_redirect_urls = [
  "io.dirt.app://",
  "dirt://",
  "http://127.0.0.1:54321/functions/v1/auth-callback",
  "http://localhost:54321/functions/v1/auth-callback",
  "https://dpgubirrzzxlvzbpgnok.supabase.co/functions/v1/auth-callback"
]
# How long tokens are valid for, in seconds. Default is 3600 (1 hour).
jwt_expiry = 3600
# Security note:
# - Supabase dashboard setting "Leaked password protection" (HIBP) should be enabled for production projects.
#   This linter warning cannot be resolved via SQL migrations, and may not be configurable via `config.toml`
#   depending on Supabase CLI version.
#   To enable: Go to Supabase Dashboard > Authentication > Settings > Password Security
#   and enable "Leaked password protection" (checks against HaveIBeenPwned.org).
# Allow/disallow new user signups to your project.
enable_signup = true
# Allow/disallow anonymous sign-ins to your project.
enable_anonymous_sign_ins = false
# Allow/disallow testing manual linking of accounts
enable_manual_linking = false

[auth.email]
# Allow/disallow new user signups via email to your project.
enable_signup = true
# If enabled, a user will be required to confirm any email change on both the old and new email addresses.
double_confirm_changes = true
# If enabled, users need to confirm their email address before signing in.
enable_confirmations = true
# Dirt-specific: Users must verify email before posting reviews

[auth.email.template.confirmation]
subject = "Welcome to Dirt - Verify your email"
content_path = "./supabase/templates/confirmation.html"

[auth.email.template.invite]
subject = "You've been invited to Dirt"
content_path = "./supabase/templates/invite.html"

[auth.email.template.magic_link]
subject = "Your Dirt login link"
content_path = "./supabase/templates/magic_link.html"

[auth.email.template.recovery]
subject = "Reset your Dirt password"
content_path = "./supabase/templates/recovery.html"

[auth.email.template.email_change]
subject = "Confirm your email change on Dirt"
content_path = "./supabase/templates/email_change.html"

[auth.sms]
# Allow/disallow new user signups via SMS.
enable_signup = false
enable_confirmations = false

# Dirt will use phone verification post-MVP
# [auth.sms.twilio]
# enabled = false
# account_sid = ""
# message_service_sid = ""
# auth_token = ""

[auth.external.apple]
enabled = true
# Apple Sign In - for iOS app integration
client_id = "env(APPLE_CLIENT_ID)"
secret = "env(APPLE_SECRET)"
redirect_uri = ""
# url = ""
# skip_nonce_check = false

# Other OAuth providers disabled for MVP
[auth.external.google]
enabled = false

[auth.external.facebook]
enabled = false

[auth.external.twitter]
enabled = false

# Multi-factor authentication (post-MVP feature)
[auth.mfa]
# Maximum number of enrolled factors
max_enrolled_factors = 10

[auth.mfa.totp]
enroll_enabled = false
verify_enabled = false

[auth.mfa.phone]
enroll_enabled = false
verify_enabled = false
otp_length = 6
template = "Your Dirt verification code is {{ .Code }}"
max_frequency = "10s"

[auth.sessions]
# How long sessions last in seconds. Defaults to 604800 (1 week).
timebox = 604800
# How often to refresh the session in seconds. Defaults to 3600 (1 hour).
inactivity_timeout = 3600

[auth.hook.custom_access_token]
# Hook for custom claims (future use: add subscription tier to JWT)
enabled = false
# uri = "pg-functions://<database>/<schema>/<function_name>"

[edge_runtime]
enabled = true
# Configure one of the supported policies: oneshot, per_worker.
policy = "oneshot"
# Port to attach the Chrome inspector for debugging edge functions.
inspector_port = 8083

[analytics]
enabled = true
port = 54327
# Configure one of the supported backends: postgres, bigquery.
backend = "postgres"

# Local seed settings
[db.seed]
enabled = true
# SQL file to seed your local database.
sql_paths = ["./seed.sql"]

