.env.example

# Copy this file to .env and fill in real values for local development.
# In production (HF Spaces / Render / etc.), set these as the platform's
# secret/env-var settings instead of committing a .env file there too.

# --- Required -----------------------------------------------------------

# Supabase project URL and service role key (Project Settings -> API).
# The service role key bypasses Row Level Security -- this backend is the
# ONLY thing that should ever hold it. Never expose it to the frontend.
SUPABASE_URL=
SUPABASE_SERVICE_ROLE_KEY=

# Random secret used to sign team/admin/judge session tokens (HMAC-SHA256).
# Generate one with: python3 -c "import secrets; print(secrets.token_hex(32))"
# The server refuses to issue or verify sessions if this is unset -- there
# is no insecure default.
SESSION_SECRET=

# Comma-separated list of origins allowed to call this API from a browser.
# Set this to your deployed frontend's actual URL(s) before going live --
# e.g. https://your-frontend.vercel.app
# Defaults to localhost only if unset, which will break the deployed
# frontend until you set this.
CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173

# --- Admin accounts -------------------------------------------------------

# One-time secret for creating the FIRST admin account via
# POST /admin/bootstrap. Only works while the `admins` table is empty --
# once one admin exists, that endpoint always 403s regardless of this
# value. Alternative: skip this entirely and insert the first admin
# directly via Supabase's SQL editor (see README "Creating admin accounts").
ADMIN_BOOTSTRAP_SECRET=

# --- Optional: team access-code emails (Resend) --------------------------

# If unset, email sending is skipped (logged as a warning) -- team creation
# still works, you just copy the access code from the admin Teams tab
# instead of it being emailed automatically.
RESEND_API_KEY=
RESEND_FROM=onboarding@resend.dev

# --- Optional: split-Space embedder (recommended for 100+ participants) --

# Leave both unset for a single-Space deploy (embedding + NER models load
# in-process in this backend instead). Set EMBEDDER_URL to point at a
# separately-deployed embedder Space (see embedder/) to isolate that
# CPU-heavy inference from this API's request-handling.
EMBEDDER_URL=
# Shared secret sent as X-API-Key to the embedder Space -- set the SAME
# value here and on the embedder Space's own EMBEDDER_API_KEY, or the
# Space is an open, unauthenticated compute endpoint to anyone who finds
# its URL.
EMBEDDER_API_KEY=

# --- Optional tuning (sensible defaults, rarely need changing) -----------

SESSION_TTL_SECONDS=72000
MODEL_NAME=sentence-transformers/paraphrase-multilingual-MiniLM-L12-v2
SIMILARITY_THRESHOLD=0.90
BATCH_SIMILARITY_THRESHOLD=0.90
FUZZ_PREFILTER_THRESHOLD=55
FUZZ_TOP_K=25
EMBEDDER_TIMEOUT_SECONDS=3.0
EMBEDDER_CIRCUIT_FAILURE_THRESHOLD=3
EMBEDDER_CIRCUIT_COOLDOWN_SECONDS=30
NER_TIMEOUT_SECONDS=60.0