# ============================================
# GOOGLE OAUTH CONFIGURATION
# ============================================

# Path to Google OAuth client secrets JSON file (recommended)
GOOGLE_CLIENT_SECRETS_FILE=credentials.json

# OR use individual credentials (if not using JSON file)
# GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
# GOOGLE_CLIENT_SECRET=your-client-secret

# OAuth redirect URI (must match Google Console configuration)
OAUTH_REDIRECT_URI=http://localhost:8002/oauth2callback


# ============================================
# SERVER CONFIGURATION
# ============================================

# Server host and port
SERVER_HOST=localhost
SERVER_PORT=8002
SERVER_NAME=Google Workspace MCP Server

# Base URL for OAuth endpoints
# For Tailscale Funnel: https://your-machine.your-tailnet.ts.net
# For local: http://localhost:8002
BASE_URL=http://localhost:8002

# ============================================
# ACCESS CONTROL SECURITY (Tailscale Funnel)
# ============================================

# IMPORTANT: These settings control who can authenticate to your MCP server
# when exposed via Tailscale Funnel or other public URLs

# Require users to have pre-existing credentials (DEFAULT: true - RECOMMENDED)
# When true, only users who've previously authenticated locally can access remotely
# This ties remote OAuth to your local credential store for security
MCP_REQUIRE_EXISTING_CREDENTIALS=true

# Optional: Email allowlist file for additional restriction
# When set, users must be in this file (and meet credential requirement if enabled)
# MCP_EMAIL_ALLOWLIST_FILE=.email_allowlist

# ============================================
# CREDENTIAL STORAGE
# ============================================

# Storage mode: FILE_PLAINTEXT, FILE_ENCRYPTED, MEMORY_ONLY, MEMORY_WITH_BACKUP
# Recommended: FILE_ENCRYPTED for production
CREDENTIAL_STORAGE_MODE=FILE_ENCRYPTED

# Directory for storing credentials
CREDENTIALS_DIR=./credentials

# ============================================
# HTTPS/SSL CONFIGURATION (Optional)
# ============================================

# Enable HTTPS (default: false)
ENABLE_HTTPS=false

# SSL certificate paths (required if ENABLE_HTTPS=true)
# SSL_CERT_FILE=./certs/server.crt
# SSL_KEY_FILE=./certs/server.key

# ============================================
# SESSION CONFIGURATION
# ============================================

# Session timeout in minutes
SESSION_TIMEOUT_MINUTES=60

# ============================================
# PHASE 1 OAUTH MIGRATION
# ============================================

# Enable unified authentication (GoogleProvider + legacy tools)
ENABLE_UNIFIED_AUTH=true

# Enable legacy compatibility mode
LEGACY_COMPAT_MODE=true

# Enable credential migration between storage modes
CREDENTIAL_MIGRATION=true

# Enable service caching for performance
SERVICE_CACHING=true

# Enable enhanced logging for debugging
ENHANCED_LOGGING=true

# ============================================
# QDRANT CONFIGURATION (Optional)
# ============================================

# Qdrant database URL
# For local: http://localhost:6333
# For cloud: https://your-cluster.cloud.qdrant.io
QDRANT_URL=http://localhost:6333

# Qdrant API key (use NONE for no authentication)
QDRANT_KEY=NONE

# Use gRPC to avoid SSL certificate issues with cloud Qdrant
QDRANT_PREFER_GRPC=true

# Collection name for tool responses
QDRANT_COLLECTION_NAME=mcp_tool_responses

# Data retention in days (older data is automatically cleaned up)
MCP_TOOL_RESPONSES_COLLECTION_CACHE_DAYS=14

# ============================================
# QDRANT DOCKER AUTO-LAUNCH (Local Development)
# ============================================
# When enabled, automatically launches Qdrant via Docker if not reachable
# This provides a zero-config experience for local development

# Enable auto-launch (default: true for local URLs, disabled for cloud)
QDRANT_AUTO_LAUNCH=true

# Docker image to use (default: qdrant/qdrant:latest)
# QDRANT_DOCKER_IMAGE=qdrant/qdrant:latest

# Container name (default: mcp-qdrant)
# QDRANT_DOCKER_CONTAINER_NAME=mcp-qdrant

# gRPC port to expose (default: 6334)
# QDRANT_DOCKER_GRPC_PORT=6334

# Persistent data directory (default: ./credentials/qdrant_data)
# Data persists across container restarts for seamless experience
# QDRANT_DOCKER_DATA_DIR=./qdrant_data

# Startup timeout in seconds (default: 30)
# QDRANT_DOCKER_STARTUP_TIMEOUT=30

# Stop container when MCP server exits (default: false)
# Set to true if you want container to stop with the server
# QDRANT_DOCKER_STOP_ON_EXIT=false

# ============================================
# GOOGLE CHAT CONFIGURATION
# ============================================

# Default webhook URL for Google Chat card tools
# When set, card tools (send_dynamic_card, etc.) use this as the default webhook
# Useful for development/testing when you always send to the same space
# Format: https://chat.googleapis.com/v1/spaces/SPACE_ID/messages?key=KEY&token=TOKEN
# MCP_CHAT_WEBHOOK=

# ============================================
# EMBEDDING MODEL CONFIGURATION (FastEmbed)
# ============================================

# Embedding model for semantic search (uses FastEmbed library)
# Default: sentence-transformers/all-MiniLM-L6-v2 (384 dimensions, fast)
# Alternative models:
#   - sentence-transformers/all-mpnet-base-v2 (768 dimensions, higher quality)
#   - BAAI/bge-small-en-v1.5 (384 dimensions, good quality)
#   - BAAI/bge-base-en-v1.5 (768 dimensions, best quality)
#   - nomic-ai/nomic-embed-text-v1 (768 dimensions, good for long texts)
QDRANT_EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2

# Note: FastEmbed downloads models on first use (~50-300MB depending on model)
# Models are cached in ~/.cache/fastembed/ for subsequent use

# ============================================
# TAILSCALE FUNNEL DEPLOYMENT
# ============================================

# Example configuration for Tailscale Funnel:
# 1. Set BASE_URL to your Tailscale URL
# 2. Keep OAUTH_REDIRECT_URI as localhost (OAuth happens on user's machine)
# 3. Ensure MCP_REQUIRE_EXISTING_CREDENTIALS=true (default)
# 4. Pre-authorize users by running start_google_auth locally first
#
# Example:
# BASE_URL=https://your-machine.your-tailnet.ts.net
# OAUTH_REDIRECT_URI=http://localhost:8002/oauth2callback
# MCP_REQUIRE_EXISTING_CREDENTIALS=true