# ACCESS Core Database — Dev Environment Variables
# SYNTHETIC DATA ONLY — NO REAL PHI, NO LIVE CREDENTIALS

# PostgreSQL
# POSTGRES_HOST/PORT apply to host-side processes; inside compose the app
# always reaches the `db` service (published on localhost:5432 by default).
POSTGRES_DB=access_core
POSTGRES_USER=access_user
POSTGRES_PASSWORD=dev_password_synthetic_only
POSTGRES_HOST=localhost
POSTGRES_PORT=5432

# Django
DJANGO_SECRET_KEY=dev-secret-key-DO-NOT-USE-IN-PRODUCTION
DJANGO_DEBUG=true
DJANGO_SETTINGS_MODULE=access_core.settings.dev
ALLOWED_HOSTS=*

# Healthie API (synthetic / dev)
HEALTHIE_API_BASE_URL=https://api.gethealthie.com/graphql
HEALTHIE_API_KEY=dev-api-key-synthetic-only
HEALTHIE_INTAKE_FORM_ID=2360739
# Webhook signing secret — provide either the raw value or with whsec_ prefix (both work)
HEALTHIE_WEBHOOK_SECRET=dev-webhook-secret
HEALTHIE_WEBHOOK_VERIFY_SIGNATURE=true

# AWS (dev — no live credentials; host-side boto3 only, not forwarded into compose containers)
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=dev-access-key
AWS_SECRET_ACCESS_KEY=dev-secret-key
AWS_S3_BUCKET=access-core-dev-synthetic

# Encryption (dev — local key; staging/prod use KMS via PHI_KMS_KEY_ID)
# Base64-encoded 32-byte key. dev/test/local settings derive a default when unset,
# so this line is only needed for custom setups:
# PHI_LOCAL_ENCRYPTION_KEY=
# PHI_KMS_KEY_ID=arn:aws:kms:us-east-1:...:key/...   # set in staging/prod task definitions

# CMS ACCESS API. No public ACCESS sandbox exists yet — point at the local mock:
#   CMS_API_BASE_URL=http://localhost:3001  (CMS_FHIR_VERSION_PATH="")
# NOTE: sandbox.bcda.cms.gov is a DIFFERENT CMS product (bulk claims data), not an
# ACCESS endpoint; it only works as a placeholder until CMS publishes the real API.
CMS_API_BASE_URL=https://sandbox.bcda.cms.gov
CMS_API_CLIENT_ID=dev-client-id
CMS_API_CLIENT_SECRET=dev-client-secret