import Config

config :openagents, :runtime_environment, :development

# The changelog seed. Deliberately not enabled in `test`: it runs off the boot
# path, and a write that escapes the sandbox is a flaky suite.
config :openagents, :changelog_backfill_on_boot, true

# The forge, pointed at a writable directory inside the checkout. It is off in
# the base config because `forge_data_dir` defaults to `/var/lib`, which no
# development machine can write -- and with it off, every `/{owner}/{repo}`
# page is a 404 locally, so the repository surfaces cannot be reviewed at all.
config :openagents,
  forge_enabled: true,
  forge_data_dir: Path.expand("../.local/forge", __DIR__),
  forge_wal_dir: Path.expand("../.local/forge-wal", __DIR__)

# Configure your database
config :openagents, OpenAgents.Repo,
  username: System.get_env("USER") || "christopherdavid",
  password: "",
  socket_dir: "/tmp",
  database: "openagents_dev",
  stacktrace: true,
  show_sensitive_data_on_connection_error: true,
  pool_size: 10

# Development-only GitHub OAuth placeholders. Override with real values in .env.
config :openagents, :github_oauth,
  client_id: System.get_env("GITHUB_CLIENT_ID") || "dev-client-id",
  client_secret: System.get_env("GITHUB_CLIENT_SECRET") || "dev-client-secret",
  redirect_uri: "http://localhost:4000/auth/github/callback"

# Overridable like the OAuth pair above: a real local GitHub app issues real
# tokens, and encrypting them under a key checked into the repository would
# make the vault decorative.
config :openagents,
       :github_token_encryption_key,
       System.get_env("GITHUB_TOKEN_ENCRYPTION_KEY") ||
         Base.encode64("openagents-dev-token-vault-key32")

config :openagents, :github_token_encryption_key_id, "development-2026-08"
config :openagents, :github_token_decryption_keys, %{}

# The machine pairing vault's own key, distinct from the GitHub vault's so
# development exercises the key independence VAULT-001 requires.
config :openagents,
       :machine_token_encryption_key,
       System.get_env("MACHINE_TOKEN_ENCRYPTION_KEY") ||
         Base.encode64("openagents-dev-machine-vault-key")

# The voice recording vault and the content vault, each with its own key for
# the same reason. Sealing the audio under one key and the words under another
# is the whole point of VAULT-001: neither opens the other.
config :openagents,
       :voice_recording_encryption_key,
       System.get_env("VOICE_RECORDING_ENCRYPTION_KEY") ||
         Base.encode64("openagents-dev-recording-vaultkey")

config :openagents,
       :content_encryption_key,
       System.get_env("CONTENT_ENCRYPTION_KEY") ||
         Base.encode64("openagents-dev-content-vault-key3")

# For development, we disable any cache and enable
# debugging and code reloading.
#
# The watchers configuration can be used to run external
# watchers to your application. For example, we can use it
# to bundle .js and .css sources.
config :openagents, OpenAgentsWeb.Endpoint,
  # Binding to loopback ipv4 address prevents access from other machines.
  # `PHX_LISTEN_ALL=true` widens it to every interface, like the PORT
  # override below and for the same reason: a Gym benchmark container
  # reaching the dev server through host.docker.internal needs a non-loopback
  # bind, and flipping it should not mean editing checked-in config.
  # 4000 unless `PORT` says otherwise. Another agent verifying a git-forge
  # receipt needs the canonical port free, and moving this server aside should
  # not mean editing checked-in config to do it.
  http: [
    ip: if(System.get_env("PHX_LISTEN_ALL") == "true", do: {0, 0, 0, 0}, else: {127, 0, 0, 1}),
    port: String.to_integer(System.get_env("PORT") || "4000")
  ],
  check_origin: false,
  code_reloader: true,
  debug_errors: true,
  secret_key_base: "7g8XzqhjERSKPxluld+DgJttpl7vypiQg2/6wR+5AJmONkFmEzX5pQnUsdGnH/v2",
  watchers: [
    esbuild: {Esbuild, :install_and_run, [:openagents, ~w(--sourcemap=inline --watch)]},
    tailwind: {Tailwind, :install_and_run, [:openagents, ~w(--watch)]}
  ]

# ## SSL Support
#
# In order to use HTTPS in development, a self-signed
# certificate can be generated by running the following
# Mix task:
#
#     mix phx.gen.cert
#
# Run `mix help phx.gen.cert` for more information.
#
# The `http:` config above can be replaced with:
#
#     https: [
#       port: 4001,
#       cipher_suite: :strong,
#       keyfile: "priv/cert/selfsigned_key.pem",
#       certfile: "priv/cert/selfsigned.pem"
#     ],
#
# If desired, both `http:` and `https:` keys can be
# configured to run both http and https servers on
# different ports.

# Enable dev routes for dashboard and mailbox
config :openagents, dev_routes: true

# Do not include metadata nor timestamps in development logs
config :logger, :default_formatter, format: "[$level] $message\n"

# Set a higher stacktrace during development. Avoid configuring such
# in production as building large stacktraces may be expensive.
config :phoenix, :stacktrace_depth, 20

# Initialize plugs at runtime for faster development compilation
config :phoenix, :plug_init_mode, :runtime

config :phoenix_live_view,
  # Include debug annotations and locations in rendered markup.
  # Changing this configuration will require mix clean and a full recompile.
  debug_heex_annotations: true,
  debug_attributes: true,
  # Enable helpful, but potentially expensive runtime checks
  enable_expensive_runtime_checks: true

# Disable swoosh api client as it is only required for production adapters.
config :swoosh, :api_client, false