8acc27466e
Admins can email a new user a welcome with a one-time link to choose their password, and send a reset link from the users list. The sign-in page gets "Forgot password?". Mail goes out through Resend; the emails show the person's sign-in address. - password_links collection (migration applied): only the SHA-256 of each token is stored; invites last 7 days, resets 1 hour, one use each - /set-password and /forgot-password pages and their /api/auth routes - forgot-password never reveals whether an account exists, throttles repeat mails, and builds links only from APP_URL - env: RESEND_API_KEY, EMAIL_FROM, EMAIL_REPLY_TO, APP_URL (docs/setup/email.md) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
106 lines
5.3 KiB
Text
106 lines
5.3 KiB
Text
# Named PocketBase accounts are required in every environment.
|
|
# Apply the login migration and create an admin before starting the app.
|
|
# Shared PIN sign-in is disabled, including when legacy PIN settings remain.
|
|
AUTH_MODE=users
|
|
|
|
# Brand
|
|
NEXT_PUBLIC_APP_NAME=MEGA INFRASTRUCTURE
|
|
NEXT_PUBLIC_DEFAULT_THEME=light
|
|
|
|
# Local API base URL (the Next.js app's own /api routes — currently a stub)
|
|
NEXT_PUBLIC_API_BASE_URL=http://localhost:3000/api
|
|
|
|
# ── PocketBase ─────────────────────────────────────────────────────────────
|
|
# Public client-side URL. Safe to expose because PocketBase handles
|
|
# auth at the collection-rule level — public reads need a token, the
|
|
# URL alone is not a credential.
|
|
NEXT_PUBLIC_POCKETBASE_URL=https://your-pocketbase.example.com
|
|
|
|
# Server-side only — used by Next.js server components / route handlers
|
|
# to seed data, sync files and run admin operations. NEVER prefix with
|
|
# NEXT_PUBLIC_ or the credentials leak into every browser bundle.
|
|
POCKETBASE_ADMIN_EMAIL=admin@example.com
|
|
POCKETBASE_ADMIN_PASSWORD=change-me
|
|
|
|
# If you have an existing auth token you can paste it here instead of
|
|
# having the server re-authenticate on every cold start. Leave blank
|
|
# to let the server log in with the email + password above.
|
|
POCKETBASE_ADMIN_TOKEN=
|
|
|
|
# ── Email (Resend) ──────────────────────────────────────────────────────────
|
|
# The dashboard sends a welcome invite when an admin adds a user, and a
|
|
# password reset from the "Forgot password?" link on the sign-in page.
|
|
#
|
|
# RESEND_API_KEY is the API key from Resend (starts with re_) — the SAME
|
|
# key you use as the PocketBase SMTP password. Do NOT paste the SMTP
|
|
# password here.
|
|
#
|
|
# Without the key the mail feature stays off: the admin button answers
|
|
# "Email is not set up yet" and no mail is sent. Nothing else breaks.
|
|
RESEND_API_KEY=
|
|
|
|
# The sender shown on the mail. Must be a domain verified in Resend,
|
|
# otherwise the mail lands in spam. See docs/setup/email.md.
|
|
EMAIL_FROM=MEGA Dashboard <support@apphub.co.za>
|
|
|
|
# Where replies go. Leave blank to reply to EMAIL_FROM.
|
|
EMAIL_REPLY_TO=
|
|
|
|
# The dashboard's public URL. Used to build the "choose your password"
|
|
# link and to load the logo in the mail. Without it the app falls back
|
|
# to the address the request came in on.
|
|
APP_URL=http://localhost:6004
|
|
|
|
# ── n8n (Purchase Order ingestion) ──────────────────────────────────────
|
|
# Webhook URL the Next.js server forwards PO uploads to.
|
|
# Server-only (no NEXT_PUBLIC_ prefix) — never exposed to the browser.
|
|
N8N_PO_INGEST_URL=https://n8n.your-host.example/webhook/purchase-order-upload
|
|
|
|
# Shared secret n8n sends in the x-ingest-secret header when calling
|
|
# /api/purchase-orders/ingest. Generate with: openssl rand -hex 32
|
|
N8N_INGEST_SECRET=replace-with-output-of-openssl-rand-hex-32
|
|
|
|
# ── n8n (Delivery Note OCR webhook) ─────────────────────────────────────
|
|
# Same shared secret as above — used by /api/delivery-notes/[id]/ocr-result.
|
|
# The Delivery Note OCR workflow in n8n imports docs/n8n/delivery-note-ocr-workflow.json
|
|
# and calls POST {MEGA_NEXT_URL}/api/delivery-notes/{id}/ocr-result with this header.
|
|
|
|
# ── Delivery-note batch pipeline (Task 10+) ────────────────────────
|
|
# Customer VAT number the pipeline uses to check the printed
|
|
# identity block on every slip. Suppliers print it on every weighbridge
|
|
# ticket; mismatches get marked needs_attention.
|
|
MEGA_CUSTOMER_VAT_NO=4280307796
|
|
|
|
# How many dn_batches rows the /api/dn-batches/tick route claims per
|
|
# cron hit. Tune for your batch size / model latency.
|
|
DN_TICK_BATCH_SIZE=1
|
|
|
|
# Server-only code required by the posted receipt correction form.
|
|
# Use a unique value of at least 12 characters; do not reuse NEXT_PUBLIC_APP_PIN.
|
|
# Generate with: openssl rand -hex 16
|
|
RECEIPT_CORRECTION_SECRET=
|
|
|
|
# Public URL of the n8n instance (used by your local Codex MCP config).
|
|
N8N_MCP_URL=https://wfdash.n8n.apphub.co.za/mcp-server/http
|
|
|
|
# ── AI chat (phase 3) ─────────────────────────────────────────────────────
|
|
# Master switch. The /api/chat route 404s and /dashboard/chat is unreachable
|
|
# unless this is exactly "true". MUST stay unset in production until real
|
|
# authentication exists — the chat reads every site's financials and spends
|
|
# LLM credits for anyone who can reach it.
|
|
ENABLE_CHAT=true
|
|
|
|
# Which provider the chat uses: "anthropic" or "minimax".
|
|
CHAT_PROVIDER=anthropic
|
|
|
|
# Anthropic. Leave unset to use an `ant auth login` profile instead.
|
|
ANTHROPIC_API_KEY=
|
|
|
|
# MiniMax. This must be an Open Platform API key from platform.minimax.io —
|
|
# a Token Plan "Subscription Key" is a different credential and will not work
|
|
# here. Consumer Hailuo / MiniMax Agent subscriptions cannot be used at all.
|
|
MINIMAX_API_KEY=
|
|
MINIMAX_BASE_URL=https://api.minimax.io/v1
|
|
# Verified for both vision AND tool calling on 2026-08-30: MiniMax-M3.
|
|
# MiniMax-M2 / M2.7 accept tools but reject images. M3 supports both.
|
|
MINIMAX_MODEL=MiniMax-M3
|