3c22d88bcd
- Demo accounts: super_admin-only provisioning into isolated DEMO_ORG_ID tenant, 30-day UTC trial on first login, revocable, one-time credential delivery via optional SES/webhook (never persisted). Adds boto3 dependency. - Analytics/report/export/privacy: shared bounded scan budget across users/groups/ sessions, tenant-consistent session/user/group joins, scalar-only CSV export (no nested persisted-value stringification). - Ownership/tenant isolation: canonical owner-tenant predicate for list/read/chat; client sees is_owned only, never owner_user_id. - Lifecycle/races: status transition validation, analyzing is an in-progress gate (no duplicate reanalysis), structured-ready publication, stale-variant revalidation. - Auth/setup/consent/JWT/OAuth/config: fail-closed consent, bounded JWT lifetime, provider-subject atomic OAuth identity, repeated-secret rejection, strict Persona trait validation. - Chat/session/privacy: pre-seller opener redaction, corrupt-session recovery, role-aware completed-chat dashboard routing. - Frontend: Training→product→personas→practice flow, demo/role/demo guards, is_owned-based ownership display, 320×568 and 500×768 responsive E2E. - 8 independent exact-five-key review scopes passed; backend 509, frontend 26, production build 1775 modules, isolated E2E 15.
51 lines
1.9 KiB
Plaintext
51 lines
1.9 KiB
Plaintext
# LLM — OpenAI, DeepSeek, or any OpenAI-compatible endpoint
|
|
LLM_PROVIDER=deepseek
|
|
LLM_BASE_URL=
|
|
LLM_MODEL_NAME=deepseek-chat
|
|
LLM_API_KEY=replace_me
|
|
|
|
# Auth — set both values explicitly; never commit real values.
|
|
APP_ENV=development
|
|
JWT_SECRET=replace_with_a_random_secret_at_least_32_chars
|
|
BOOTSTRAP_ADMIN_PASSWORD=replace_with_a_strong_initial_password
|
|
|
|
# Storage root (relative to backend/)
|
|
DATA_DIR=./data
|
|
|
|
# OAuth (Google + Facebook) — all optional. Each provider is ENABLED only when
|
|
# every one of its values here is set and not a placeholder. Leave blank to
|
|
# disable. OAUTH_DEFAULT_ORG is the tenant public social signups land in; OAuth
|
|
# is disabled entirely while it's unset/missing.
|
|
# OAUTH_GOOGLE_CLIENT_ID=
|
|
# OAUTH_GOOGLE_CLIENT_SECRET=
|
|
# OAUTH_FACEBOOK_APP_ID=
|
|
# OAUTH_FACEBOOK_APP_SECRET=
|
|
# OAUTH_DEFAULT_ORG=org-public
|
|
|
|
# Demo accounts — created only by a super_admin, isolated in this tenant, and
|
|
# granted a fixed 30-day UTC trial starting on first successful login.
|
|
DEMO_ORG_ID=org-demo
|
|
DEMO_ORG_NAME=Sales Trainer Demo
|
|
DEMO_ORG_SEATS=10000
|
|
|
|
# Optional one-time demo credential delivery. Leave blank to skip delivery in
|
|
# local/test environments. SES credentials use the normal AWS credential chain;
|
|
# never put access keys or temporary passwords in this file.
|
|
# AWS_REGION=ap-southeast-1
|
|
# SES_FROM_EMAIL=verified-sender@example.com
|
|
# SES_REPLY_TO=reply@example.com
|
|
|
|
# Optional authenticated demo-created webhook. The URL must be HTTPS; the
|
|
# client rejects HTTP/cross-origin redirects. The temporary password is sent
|
|
# only in the one-time request body and is not persisted or audit logged.
|
|
# DEMO_WEBHOOK_URL=https://ops.example.com/sales-trainer/demo-created
|
|
# DEMO_WEBHOOK_SECRET=replace_with_a_random_webhook_secret
|
|
DEMO_WEBHOOK_TIMEOUT_SECONDS=5
|
|
DEMO_WEBHOOK_MAX_RETRIES=3
|
|
DEMO_WEBHOOK_RETRY_BACKOFF_SECONDS=0.25
|
|
|
|
# App
|
|
FLASK_HOST=0.0.0.0
|
|
FLASK_PORT=5001
|
|
FLASK_DEBUG=1
|