mike/backend/.env.example

PORT=3001
FRONTEND_URL=http://localhost:3000

# HMAC key used to sign /download/:token URLs. Required at startup.
# Generate with: openssl rand -hex 32
# Use a dedicated secret distinct from SUPABASE_SECRET_KEY.
DOWNLOAD_SIGNING_SECRET=replace-with-a-random-32-byte-hex-string
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_SECRET_KEY=your-supabase-service-role-key

R2_ENDPOINT_URL=https://your-account-id.r2.cloudflarestorage.com
R2_ACCESS_KEY_ID=your-r2-access-key
R2_SECRET_ACCESS_KEY=your-r2-secret-key
R2_BUCKET_NAME=mike

GEMINI_API_KEY=your-gemini-key
ANTHROPIC_API_KEY=your-anthropic-key
OPENAI_API_KEY=your-openai-key
RESEND_API_KEY=your-resend-key
USER_API_KEYS_ENCRYPTION_SECRET=your-long-random-secret

# Optional: enables higher-rate CourtListener case law/citation lookup tools.
COURTLISTENER_API_TOKEN=your-courtlistener-token
Add local repo contents 2026-04-29 19:49:06 +02:00			`PORT=3001`
			`FRONTEND_URL=http://localhost:3000`
fix(security): fail fast when download HMAC secret is missing Resolves the issue where getSecret() silently fell back to the literal string "dev-secret" when neither DOWNLOAD_SIGNING_SECRET nor SUPABASE_SECRET_KEY was set. Because the codebase is public, that fallback let anyone forge valid /download/:token signatures against a mis-configured deployment. - Throw at first call instead of returning the hardcoded string, with a message pointing the operator at `openssl rand -hex 32`. - Document DOWNLOAD_SIGNING_SECRET in backend/.env.example so deployers following the README know to set it (and that it should be distinct from SUPABASE_SECRET_KEY). Closes #7 2026-05-03 00:12:44 +00:00
			`# HMAC key used to sign /download/:token URLs. Required at startup.`
			`# Generate with: openssl rand -hex 32`
			`# Use a dedicated secret distinct from SUPABASE_SECRET_KEY.`
			`DOWNLOAD_SIGNING_SECRET=replace-with-a-random-32-byte-hex-string`
Add local repo contents 2026-04-29 19:49:06 +02:00			`SUPABASE_URL=https://your-project.supabase.co`
			`SUPABASE_SECRET_KEY=your-supabase-service-role-key`

			`R2_ENDPOINT_URL=https://your-account-id.r2.cloudflarestorage.com`
			`R2_ACCESS_KEY_ID=your-r2-access-key`
			`R2_SECRET_ACCESS_KEY=your-r2-secret-key`
			`R2_BUCKET_NAME=mike`

			`GEMINI_API_KEY=your-gemini-key`
			`ANTHROPIC_API_KEY=your-anthropic-key`
docs: improve setup guidance and env examples 2026-05-10 22:36:29 +08:00			`OPENAI_API_KEY=your-openai-key`
Add local repo contents 2026-04-29 19:49:06 +02:00			`RESEND_API_KEY=your-resend-key`
docs: improve setup guidance and env examples 2026-05-10 22:36:29 +08:00			`USER_API_KEYS_ENCRYPTION_SECRET=your-long-random-secret`
Add courtlistener intergration, liquid glass redesign, UI improvements, version control, various fixes 2026-06-06 15:48:47 +08:00
			`# Optional: enables higher-rate CourtListener case law/citation lookup tools.`
			`COURTLISTENER_API_TOKEN=your-courtlistener-token`