9a6aed50a4
Add turnover, project, retention, and year comparison pages from the supplied workbook, protected by named admin access. Include the local chart gallery, grouped monthly hover, smooth comparison toggle, and monthly income minus cost series. Require named PocketBase sign-in in every environment and remove the shared PIN bypass. Update access documentation and business-route test fixtures.
82 lines
4.2 KiB
Text
82 lines
4.2 KiB
Text
# Named PocketBase accounts are required in every environment.
|
|
# Apply the login migration and create an admin before starting the app.
|
|
# Shared PIN sign-in is disabled, including when legacy PIN settings remain.
|
|
AUTH_MODE=users
|
|
|
|
# Brand
|
|
NEXT_PUBLIC_APP_NAME=MEGA INFRASTRUCTURE
|
|
NEXT_PUBLIC_DEFAULT_THEME=light
|
|
|
|
# Local API base URL (the Next.js app's own /api routes — currently a stub)
|
|
NEXT_PUBLIC_API_BASE_URL=http://localhost:3000/api
|
|
|
|
# ── PocketBase ─────────────────────────────────────────────────────────────
|
|
# Public client-side URL. Safe to expose because PocketBase handles
|
|
# auth at the collection-rule level — public reads need a token, the
|
|
# URL alone is not a credential.
|
|
NEXT_PUBLIC_POCKETBASE_URL=https://your-pocketbase.example.com
|
|
|
|
# Server-side only — used by Next.js server components / route handlers
|
|
# to seed data, sync files and run admin operations. NEVER prefix with
|
|
# NEXT_PUBLIC_ or the credentials leak into every browser bundle.
|
|
POCKETBASE_ADMIN_EMAIL=admin@example.com
|
|
POCKETBASE_ADMIN_PASSWORD=change-me
|
|
|
|
# If you have an existing auth token you can paste it here instead of
|
|
# having the server re-authenticate on every cold start. Leave blank
|
|
# to let the server log in with the email + password above.
|
|
POCKETBASE_ADMIN_TOKEN=
|
|
|
|
# ── n8n (Purchase Order ingestion) ──────────────────────────────────────
|
|
# Webhook URL the Next.js server forwards PO uploads to.
|
|
# Server-only (no NEXT_PUBLIC_ prefix) — never exposed to the browser.
|
|
N8N_PO_INGEST_URL=https://n8n.your-host.example/webhook/purchase-order-upload
|
|
|
|
# Shared secret n8n sends in the x-ingest-secret header when calling
|
|
# /api/purchase-orders/ingest. Generate with: openssl rand -hex 32
|
|
N8N_INGEST_SECRET=replace-with-output-of-openssl-rand-hex-32
|
|
|
|
# ── n8n (Delivery Note OCR webhook) ─────────────────────────────────────
|
|
# Same shared secret as above — used by /api/delivery-notes/[id]/ocr-result.
|
|
# The Delivery Note OCR workflow in n8n imports docs/n8n/delivery-note-ocr-workflow.json
|
|
# and calls POST {MEGA_NEXT_URL}/api/delivery-notes/{id}/ocr-result with this header.
|
|
|
|
# ── Delivery-note batch pipeline (Task 10+) ────────────────────────
|
|
# Customer VAT number the pipeline uses to check the printed
|
|
# identity block on every slip. Suppliers print it on every weighbridge
|
|
# ticket; mismatches get marked needs_attention.
|
|
MEGA_CUSTOMER_VAT_NO=4280307796
|
|
|
|
# How many dn_batches rows the /api/dn-batches/tick route claims per
|
|
# cron hit. Tune for your batch size / model latency.
|
|
DN_TICK_BATCH_SIZE=1
|
|
|
|
# Server-only code required by the posted receipt correction form.
|
|
# Use a unique value of at least 12 characters; do not reuse NEXT_PUBLIC_APP_PIN.
|
|
# Generate with: openssl rand -hex 16
|
|
RECEIPT_CORRECTION_SECRET=
|
|
|
|
# Public URL of the n8n instance (used by your local Codex MCP config).
|
|
N8N_MCP_URL=https://wfdash.n8n.apphub.co.za/mcp-server/http
|
|
|
|
# ── AI chat (phase 3) ─────────────────────────────────────────────────────
|
|
# Master switch. The /api/chat route 404s and /dashboard/chat is unreachable
|
|
# unless this is exactly "true". MUST stay unset in production until real
|
|
# authentication exists — the chat reads every site's financials and spends
|
|
# LLM credits for anyone who can reach it.
|
|
ENABLE_CHAT=true
|
|
|
|
# Which provider the chat uses: "anthropic" or "minimax".
|
|
CHAT_PROVIDER=anthropic
|
|
|
|
# Anthropic. Leave unset to use an `ant auth login` profile instead.
|
|
ANTHROPIC_API_KEY=
|
|
|
|
# MiniMax. This must be an Open Platform API key from platform.minimax.io —
|
|
# a Token Plan "Subscription Key" is a different credential and will not work
|
|
# here. Consumer Hailuo / MiniMax Agent subscriptions cannot be used at all.
|
|
MINIMAX_API_KEY=
|
|
MINIMAX_BASE_URL=https://api.minimax.io/v1
|
|
# Verified for both vision AND tool calling on 2026-08-30: MiniMax-M3.
|
|
# MiniMax-M2 / M2.7 accept tools but reject images. M3 supports both.
|
|
MINIMAX_MODEL=MiniMax-M3
|