# For detailed configuration reference documentation, visit:
# https://supabase.com/docs/guides/local-development/cli/config
# A string used to distinguish different Supabase projects on the same host. Defaults to the
# working directory name when running `supabase init`.
project_id = "shuffle"

[api]
enabled = true
# Port to use for the API URL.
port = 54321
# Schemas to expose in your API. Tables, views and stored procedures in this schema will get API
# endpoints. `public` and `graphql_public` schemas are included by default.
schemas = ["public", "graphql_public"]
# Extra schemas to add to the search_path of every request.
extra_search_path = ["public", "extensions"]
# The maximum number of rows returned from a view, table, or stored procedure. Limits payload size
# for accidental or malicious requests.
max_rows = 1000
# Controls whether new tables, views, sequences and functions created in the `public` schema by
# `postgres` are reachable through the Data API roles (`anon`, `authenticated`, `service_role`)
# without explicit GRANTs, matching the cloud default. Set to `false` to require explicit GRANTs
# instead. Left unset, a fresh project falls back to `true`.
# auto_expose_new_tables = true

[api.tls]
# Enable HTTPS endpoints locally using a self-signed certificate.
enabled = false
# Paths to self-signed certificate pair.
# cert_path = "../certs/my-cert.pem"
# key_path = "../certs/my-key.pem"

[db]
# Port to use for the local database URL.
port = 54322
# Port used by db diff command to initialize the shadow database.
shadow_port = 54320
# Maximum amount of time to wait for health check when starting the local database.
health_timeout = "2m"
# The database major version to use. This has to be the same as your remote database's. Run `SHOW
# server_version;` on the remote database to check.
major_version = 17
# OrioleDB version to use as the Postgres storage engine. Leave empty to use the default engine.
orioledb_version = ""

[db.pooler]
enabled = false
# Port to use for the local connection pooler.
port = 54329
# Specifies when a server connection can be reused by other clients.
# Configure one of the supported pooler modes: `transaction`, `session`.
pool_mode = "transaction"
# How many server connections to allow per user/database pair.
default_pool_size = 20
# Maximum number of client connections allowed.
max_client_conn = 100

# [db.vault]
# secret_key = "env(SECRET_VALUE)"

[db.migrations]
# If disabled, migrations will be skipped during a db push or reset.
enabled = true
# Specifies an ordered list of schema files, directories, or glob patterns that describe your database.
# Supports paths relative to supabase directory: "./schemas/*.sql", "./database".
schema_paths = []

[db.seed]
# If enabled, seeds the database after migrations during a db reset.
enabled = true
# Specifies an ordered list of seed files to load during db reset.
# Supports glob patterns relative to supabase directory: "./seeds/*.sql"
sql_paths = ["./seed.sql"]

[db.network_restrictions]
# Enable management of network restrictions.
enabled = false
# List of IPv4 CIDR blocks allowed to connect to the database.
# Defaults to allow all IPv4 connections. Set empty array to block all IPs.
allowed_cidrs = ["0.0.0.0/0"]
# List of IPv6 CIDR blocks allowed to connect to the database.
# Defaults to allow all IPv6 connections. Set empty array to block all IPs.
allowed_cidrs_v6 = ["::/0"]

# Uncomment to reject non-secure connections to the database.
# [db.ssl_enforcement]
# enabled = true

[realtime]
enabled = true
# Bind realtime via either IPv4 or IPv6. (default: IPv4)
# ip_version = "IPv6"
# The maximum length in bytes of HTTP request headers. (default: 4096)
# max_header_length = 4096

[studio]
enabled = true
# Port to use for Supabase Studio.
port = 54323
# External URL of the API server that frontend connects to.
api_url = "http://127.0.0.1"
# OpenAI API Key to use for Supabase AI in the Supabase Studio.
openai_api_key = "env(OPENAI_API_KEY)"

# Email testing server. Emails sent with the local dev setup are not actually sent - rather, they
# are monitored, and you can view the emails that would have been sent from the web interface.
# AUTH-CFG-22 (wirkt lokal): Mailfänger ist Mailpit (Container heißt historisch supabase_inbucket_*).
# Web-Oberfläche und API: http://127.0.0.1:54324 (API: /api/v1/messages, /api/v1/message/{id}).
# Staging/Prod: SMTP über GOTRUE_SMTP_* (Anbieter offen, siehe docs/auth-konfiguration.md).
[local_smtp]
enabled = true
# Port to use for the email testing server web interface.
port = 54324
# Uncomment to expose additional ports for testing user applications that send emails.
# smtp_port = 54325
# pop3_port = 54326
# admin_email = "admin@email.com"
# sender_name = "Admin"

[storage]
enabled = true
# The maximum file size allowed (e.g. "5MB", "500KB").
file_size_limit = "50MiB"

# Uncomment to configure local storage buckets
# [storage.buckets.images]
# public = false
# file_size_limit = "50MiB"
# allowed_mime_types = ["image/png", "image/jpeg"]
# objects_path = "./images"

# Allow connections via S3 compatible clients
[storage.s3_protocol]
enabled = true

# Image transformation API is available to Supabase Pro plan.
# [storage.image_transformation]
# enabled = true

# Store analytical data in S3 for running ETL jobs over Iceberg Catalog
# This feature is only available on the hosted platform.
[storage.analytics]
enabled = false
max_namespaces = 5
max_tables = 10
max_catalogs = 2

# Analytics Buckets is available to Supabase Pro plan.
# [storage.analytics.buckets.my-warehouse]

# Store vector embeddings in S3 for large and durable datasets
[storage.vector]
enabled = true
max_buckets = 10
max_indexes = 5

# Vector Buckets is available to Supabase Pro plan.
# [storage.vector.buckets.documents-openai]

[auth]
enabled = true
# AUTH-CFG-01 (wirkt lokal): Site-URL, Basis der Mail-Links ({{ .SiteURL }}).
# Staging/Prod: GOTRUE_SITE_URL (Prod-Platzhalter https://shuffle.cshomelabs.work).
site_url = "http://localhost:3000"
# The public URL that Auth serves on. Defaults to the API external URL with `/auth/v1` appended.
# external_url = ""
# AUTH-CFG-02 (wirkt lokal): Redirect-Allow-List, nur die eigene Web-App-Seite für Mail-Links.
# Staging/Prod: GOTRUE_URI_ALLOW_LIST.
additional_redirect_urls = ["http://localhost:3000/auth/confirm"]
# AUTH-CFG-14 (wirkt lokal): JWT-Laufzeit 3600 s. Bestimmt die Verzögerung bei KTO-01 Kriterium 9
# (andere Geräte spätestens nach 60 min abgemeldet, Restrisiko R8). Staging/Prod: GOTRUE_JWT_EXP.
jwt_expiry = 3600
# JWT issuer URL. If not set, defaults to auth.external_url.
# jwt_issuer = ""
# Path to JWT signing key. DO NOT commit your signing keys file to git.
# signing_keys_path = "./signing_keys.json"
# AUTH-CFG-15 (wirkt lokal): Refresh-Token-Rotation an, Wiederverwendungsfenster 10 s.
# Staging/Prod: GOTRUE_SECURITY_REFRESH_TOKEN_ROTATION_ENABLED, GOTRUE_SECURITY_REFRESH_TOKEN_REUSE_INTERVAL.
enable_refresh_token_rotation = true
refresh_token_reuse_interval = 10
# AUTH-CFG-03 (wirkt lokal): Registrierung erlaubt. Staging/Prod: GOTRUE_DISABLE_SIGNUP=false.
enable_signup = true
# Allow/disallow anonymous sign-ins to your project.
enable_anonymous_sign_ins = false
# Allow/disallow testing manual linking of accounts
enable_manual_linking = false
# AUTH-CFG-05 (wirkt lokal): Passwort-Mindestlänge 10 (O10). Staging/Prod: GOTRUE_PASSWORD_MIN_LENGTH.
minimum_password_length = 10
# AUTH-CFG-06 (wirkt lokal): keine Zeichenklassen gefordert. Staging/Prod: GOTRUE_PASSWORD_REQUIRED_CHARACTERS (leer).
password_requirements = ""

# AUTH-CFG-21 (nur Env / nur Self-Hosting): Leaked-Password-Prüfung (HIBP) ist aus (Entscheidung F2).
# Die CLI kennt dafür keinen Schlüssel und führt keine Prüfung aus. Staging/Prod muss
# GOTRUE_PASSWORD_HIBP_ENABLED=false explizit setzen.

# AUTH-CFG-20 (nur Self-Hosting / Gateway): Magic Link und OTP-Login (/auth/v1/otp, /auth/v1/magiclink)
# lassen sich in GoTrue nicht abschalten (Spike A7). Staging/Prod: am Gateway sperren.
# Lokal bewusst nicht gesperrt.

# Configure passkey sign-ins.
# [auth.passkey]
# enabled = false

# Configure WebAuthn relying party settings (required when passkey is enabled).
# [auth.webauthn]
# rp_display_name = "Supabase"
# rp_id = "localhost"
# rp_origins = ["http://127.0.0.1:3000"]

# Rate Limits. ACHTUNG: Die lokale CLI kann GOTRUE_RATE_LIMIT_HEADER nicht setzen (AUTH-CFG-13).
# Ohne diesen Header gibt es keine IP-Drosselung; lokal und in der CI-CLI wird nichts gedrosselt.
# Die Werte unten sind daher Dokumentation der Zielwerte. Wirksam sind sie nur im Self-Hosting mit
# GOTRUE_RATE_LIMIT_HEADER und Requests, die den Header tragen (Spike B0, A2).
[auth.rate_limit]
# AUTH-CFG-09 (nur Env, lokal OHNE Wirkung): Mails pro Stunde, instanzweit. Die CLI setzt intern
# GOTRUE_RATE_LIMIT_EMAIL_SENT=360000 (Spike A3). Lokal/CI-Zielwert 100, Staging/Prod: 30 über
# GOTRUE_RATE_LIMIT_EMAIL_SENT=30.
email_sent = 100
# Number of SMS messages that can be sent per hour. Requires auth.sms to be enabled.
sms_sent = 30
# Number of anonymous sign-ins that can be made per hour per IP address. Requires enable_anonymous_sign_ins = true.
anonymous_users = 30
# AUTH-CFG-10 (nur mit AUTH-CFG-13 wirksam, lokal ohne Wirkung): Passwort-Login und Token-Refresh,
# 150 je 5 min je IP. Env: GOTRUE_RATE_LIMIT_TOKEN_REFRESH.
token_refresh = 150
# AUTH-CFG-11 (nur mit AUTH-CFG-13 wirksam, lokal ohne Wirkung): Registrierung, Reset, erneut senden,
# 30 je 5 min je IP. Env: GOTRUE_RATE_LIMIT_OTP.
sign_in_sign_ups = 30
# AUTH-CFG-12 (nur mit AUTH-CFG-13 wirksam, lokal ohne Wirkung): Link-Prüfung, 30 je 5 min je IP.
# Env: GOTRUE_RATE_LIMIT_VERIFY.
token_verifications = 30
# Number of Web3 logins that can be made in a 5 minute interval per IP address.
web3 = 30

# Configure one of the supported captcha providers: `hcaptcha`, `turnstile`.
# [auth.captcha]
# enabled = true
# provider = "hcaptcha"
# secret = ""

# AUTH-CFG-13 (nur Env / nur Self-Hosting): Client-IP hinter Proxy, GOTRUE_RATE_LIMIT_HEADER
# (z. B. X-Forwarded-For). Pflicht für Staging/Prod, in der CLI nicht setzbar.

[auth.email]
# AUTH-CFG-03 (wirkt lokal): E-Mail-Anmeldung erlaubt. Staging/Prod: GOTRUE_EXTERNAL_EMAIL_ENABLED=true.
enabled = true
# AUTH-CFG-23 (wirkt lokal, in #1 NICHT festgelegt): CLI-Standard bleibt unverändert; Entscheidung in
# KTO-11 (Info-Mail an die alte Adresse, N2). Staging/Prod: GOTRUE_MAILER_SECURE_EMAIL_CHANGE_ENABLED.
double_confirm_changes = true
# AUTH-CFG-04 (wirkt lokal): E-Mail-Bestätigung Pflicht (CLI-Standard wäre false). Voraussetzung für den
# Enumerationsschutz zusammen mit AUTH-CFG-24. Staging/Prod: GOTRUE_MAILER_AUTOCONFIRM=false.
enable_confirmations = true
# AUTH-CFG-25 (Spec 9.4): Passwortänderung ohne erneute Anmeldung bleibt wie im Standard.
# Recovery-Sitzungen sind ohnehin ausgenommen; die Entscheidung "aktuelles Passwort verlangen" fällt in KTO-11 (N13).
secure_password_change = false
# AUTH-CFG-08 (wirkt lokal): Mindestabstand zwischen Mails je Nutzer. Lokal/CI 1 s (sonst scheitert der
# Resend-Test direkt nach dem Signup mit 429). Staging/Prod: 60 s über GOTRUE_SMTP_MAX_FREQUENCY=60s.
max_frequency = "1s"
# Länge des E-Mail-OTP-Codes (nur der Vollständigkeit halber gesetzt; Shuffle nutzt token_hash-Links).
otp_length = 6
# AUTH-CFG-07 (wirkt lokal): Gültigkeit von Bestätigungs- und Reset-Link, 3600 s (1 h, Entscheidung F3).
# Staging/Prod: GOTRUE_MAILER_OTP_EXP=3600 explizit setzen (das Binary hätte 86400).
otp_expiry = 3600

# Use a production-ready SMTP server
# [auth.email.smtp]
# enabled = true
# host = "smtp.sendgrid.net"
# port = 587
# user = "apikey"
# pass = "env(SENDGRID_API_KEY)"
# admin_email = "admin@email.com"
# sender_name = "Admin"

# AUTH-CFG-17 (wirkt lokal): Mailvorlage Bestätigung, de/en per user_metadata.locale (Else-Zweig Englisch).
# Betreff und Text verzweigen gleich (Spike B0 (a)). Staging/Prod: Vorlagen per URL
# (GOTRUE_MAILER_TEMPLATES_CONFIRMATION, GOTRUE_MAILER_SUBJECTS_CONFIRMATION).
[auth.email.template.confirmation]
subject = '{{ if and .Data (eq (index .Data "locale") "de") }}Bestätige deine E-Mail-Adresse für Shuffle{{ else }}Confirm your email address for Shuffle{{ end }}'
content_path = "./supabase/templates/confirmation.html"

# AUTH-CFG-18 (wirkt lokal): Mailvorlage Passwort zurücksetzen, wie oben.
# Staging/Prod: GOTRUE_MAILER_TEMPLATES_RECOVERY, GOTRUE_MAILER_SUBJECTS_RECOVERY.
[auth.email.template.recovery]
subject = '{{ if and .Data (eq (index .Data "locale") "de") }}Passwort für Shuffle zurücksetzen{{ else }}Reset your Shuffle password{{ end }}'
content_path = "./supabase/templates/recovery.html"

# AUTH-CFG-19 (wirkt lokal): Benachrichtigungs-Mails explizit aus (KTO-01 Kriterium 11, nur Bestätigung
# und Reset). email_changed schaltet KTO-11 ein (N2). Staging/Prod: GOTRUE_MAILER_NOTIFICATIONS_<TYP>_ENABLED=false.
[auth.email.notification.password_changed]
enabled = false
[auth.email.notification.email_changed]
enabled = false
[auth.email.notification.phone_changed]
enabled = false
[auth.email.notification.identity_linked]
enabled = false
[auth.email.notification.identity_unlinked]
enabled = false
[auth.email.notification.mfa_factor_enrolled]
enabled = false
[auth.email.notification.mfa_factor_unenrolled]
enabled = false

[auth.sms]
# Allow/disallow the phone provider. When false, users can't sign up or sign in with SMS.
# To block new signups only, set enable_signup = false under [auth] instead.
enabled = false
# AUTH-CFG-24 (wirkt lokal): SMS ist nicht im Einsatz, diese Einstellung steuert aber den
# Enumerationsschutz beim E-Mail-Signup. Mit false (= GOTRUE_SMS_AUTOCONFIRM=true, CLI-Standard) liefert
# Signup mit bestätigter Adresse 422 user_already_exists (Spike A1). MUSS true bleiben.
# Staging/Prod: GOTRUE_SMS_AUTOCONFIRM=false bzw. ENABLE_PHONE_AUTOCONFIRM=false (Vorlage setzt true!).
enable_confirmations = true
# Template for sending OTP to users
template = "Your code is {{ .Code }}"
# Controls the minimum amount of time that must pass before sending another sms otp.
max_frequency = "5s"

# Use pre-defined map of phone number to OTP for testing.
# Keys are the phone number with country code and without the + prefix.
# [auth.sms.test_otp]
# 14152127777 = "123456"

# AUTH-CFG-16 (wirkt lokal): Sitzungsbegrenzung bewusst NICHT gesetzt (KTO-01 Kriterium 5: angemeldet
# bis zum Abmelden). Nicht auskommentieren.
# [auth.sessions]
# Force log out after the specified duration.
# timebox = "24h"
# Force log out if the user has been inactive longer than the specified duration.
# inactivity_timeout = "8h"

# This hook runs before a new user is created and allows developers to reject the request based on the incoming user object.
# [auth.hook.before_user_created]
# enabled = true
# uri = "pg-functions://postgres/auth/before-user-created-hook"

# This hook runs before a token is issued and allows you to add additional claims based on the authentication method used.
# [auth.hook.custom_access_token]
# enabled = true
# uri = "pg-functions://<database>/<schema>/<hook_name>"

# Configure one of the supported SMS providers: `twilio`, `twilio_verify`, `messagebird`, `textlocal`, `vonage`.
[auth.sms.twilio]
enabled = false
account_sid = ""
message_service_sid = ""
# DO NOT commit your Twilio auth token to git. Use environment variable substitution instead:
auth_token = "env(SUPABASE_AUTH_SMS_TWILIO_AUTH_TOKEN)"

# Multi-factor-authentication is available to Supabase Pro plan.
[auth.mfa]
# Control how many MFA factors can be enrolled at once per user.
max_enrolled_factors = 10

# Control MFA via App Authenticator (TOTP)
[auth.mfa.totp]
enroll_enabled = false
verify_enabled = false

# Configure MFA via Phone Messaging
[auth.mfa.phone]
enroll_enabled = false
verify_enabled = false
otp_length = 6
template = "Your code is {{ .Code }}"
max_frequency = "5s"

# Configure MFA via WebAuthn
# [auth.mfa.web_authn]
# enroll_enabled = true
# verify_enabled = true

# Use an external OAuth provider. The full list of providers are: `apple`, `azure`, `bitbucket`,
# `discord`, `facebook`, `github`, `gitlab`, `google`, `keycloak`, `linkedin_oidc`, `notion`, `twitch`,
# `twitter`, `x`, `slack_oidc`, `spotify`, `workos`, `zoom`.
[auth.external.apple]
enabled = false
client_id = ""
# DO NOT commit your OAuth provider secret to git. Use environment variable substitution instead:
secret = "env(SUPABASE_AUTH_EXTERNAL_APPLE_SECRET)"
# Overrides the default auth callback URL derived from auth.external_url.
redirect_uri = ""
# Overrides the default auth provider URL. Used to support self-hosted gitlab, single-tenant Azure,
# or any other third-party OIDC providers.
url = ""
# If enabled, the nonce check will be skipped. Required for local sign in with Google auth.
skip_nonce_check = false
# If enabled, it will allow the user to successfully authenticate when the provider does not return an email address.
email_optional = false

# Allow Solana wallet holders to sign in to your project via the Sign in with Solana (SIWS) standard.
# You can configure "web3" rate limit in the [auth.rate_limit] section and set up [auth.captcha] if self-hosting.
[auth.web3.solana]
enabled = false

# Allow Ethereum wallet holders to sign in to your project via the Sign in with Ethereum (SIWE, EIP-4361) standard.
# [auth.web3.ethereum]
# enabled = true

# Use Firebase Auth as a third-party provider alongside Supabase Auth.
[auth.third_party.firebase]
enabled = false
# project_id = "my-firebase-project"

# Use Auth0 as a third-party provider alongside Supabase Auth.
[auth.third_party.auth0]
enabled = false
# tenant = "my-auth0-tenant"
# tenant_region = "us"

# Use AWS Cognito (Amplify) as a third-party provider alongside Supabase Auth.
[auth.third_party.aws_cognito]
enabled = false
# user_pool_id = "my-user-pool-id"
# user_pool_region = "us-east-1"

# Use Clerk as a third-party provider alongside Supabase Auth.
[auth.third_party.clerk]
enabled = false
# Obtain from https://clerk.com/setup/supabase
# domain = "example.clerk.accounts.dev"

# OAuth server configuration
[auth.oauth_server]
# Enable OAuth server functionality
enabled = false
# Path for OAuth consent flow UI
authorization_url_path = "/oauth/consent"
# Allow dynamic client registration
allow_dynamic_registration = false

[edge_runtime]
enabled = true
# Supported request policies: `oneshot`, `per_worker`.
# `per_worker` (default) — enables hot reload during local development.
# `oneshot` — fallback mode if hot reload causes issues (e.g. in large repos or with symlinks).
policy = "per_worker"
# Port to attach the Chrome inspector for debugging edge functions.
inspector_port = 8083
# The Deno major version to use.
deno_version = 2

# [edge_runtime.secrets]
# secret_key = "env(SECRET_VALUE)"

[analytics]
enabled = true
port = 54327
# Configure one of the supported backends: `postgres`, `bigquery`.
backend = "postgres"

# Experimental features may be deprecated any time
[experimental]
# Configures S3 bucket URL, eg. <bucket_name>.s3-<region>.amazonaws.com
s3_host = "env(S3_HOST)"
# Configures S3 bucket region, eg. us-east-1
s3_region = "env(S3_REGION)"
# Configures AWS_ACCESS_KEY_ID for S3 bucket
s3_access_key = "env(S3_ACCESS_KEY)"
# Configures AWS_SECRET_ACCESS_KEY for S3 bucket
s3_secret_key = "env(S3_SECRET_KEY)"

# pg-delta is the schema diff engine for db diff / db pull.
# Set enabled = false to fall back to the legacy migra engine.
[experimental.pgdelta]
enabled = true
# Directory under `supabase/` where declarative files are written.
# declarative_schema_path = "./schemas"
# JSON string passed through to pg-delta SQL formatting. When omitted, SQL is
# formatted with uppercase keywords, indent 2, max width 180, trailing commas,
# and column/key alignment. Set to "null" to emit raw, unformatted SQL.
# format_options = "{\"keywordCase\":\"upper\",\"indent\":2,\"maxWidth\":180,\"commaStyle\":\"trailing\"}"