{
  "ConnectionStrings": {
    "Default": "server=localhost;port=3306;database=ttrating_stage;uid=ttrating_stage;Pwd=tTraTing!1;Old Guids=true;"
  },

  "TokenTT": "5329485069:AAEjxuLd6B5JXVQRTpUkrIg3H5HMaMFUI8M",

  "AppSettings": {
    "BotName": "tt_rating_dev_bot",
    "MobileAppScheme": "ttar.stage",
    "PasswordResetWebUrl": "https://stage.ttar.app",
    "Cors": [
      "https://stage.ttar.app",
      "https://localhost:7067"
    ],
    "AllowedAuthRedirectUris": [
      "https://stage.ttar.app/auth",
      "https://localhost:7067/auth"
    ]
  },

  "AuthOptions": {
    "SecretKey": "stage-sorokTysiahObez'yanITakDaleePoTekstu...(c)S.L."
  },

  // Telegram Login (OpenID Connect) of tt_rating_dev_bot — BotFather → Bot Settings → Login Widget.
  "Authentication": {
    "Telegram": {
      "ClientId": "5329485069",
      "ClientSecret": "W_h6DVtDqZOZY3yE3Ozqv5o6Ul-VMOkUTrch7OXZBQUC0RB8HGnIGw"
    }
  },

  // Staging OIDC provider: the API runs at stage.api.ttar.app (see deploy workflow / account-removal config), the web
  // login at stage.ttar.app. Cert files live in /home/ttar.app/oidc-keys/stage/ on the server (outside the deploy
  // target, so tar-extract does not overwrite them). Passwords are stored here for convenience; move to a secret
  // store when hardening for production parity.
  // The test client is a public (PKCE-only) client for manual end-to-end verification against staging; safe to check
  // in (no secret). Remove it once real partner clients are provisioned.
  "OpenIddict": {
    "Issuer": "https://stage.api.ttar.app",
    "WebLoginUrl": "https://stage.ttar.app/oidc/login",
    "WebPostLogoutRedirectUris": [
      "https://stage.ttar.app/login",
      "https://localhost:7067/login"
    ],
    "SigningCertificatePath": "/home/ttar.app/oidc-keys/stage/signing.pfx",
    "SigningCertificatePassword": "oidcKEYSpwd$4",
    "EncryptionCertificatePath": "/home/ttar.app/oidc-keys/stage/encryption.pfx",
    "EncryptionCertificatePassword": "oidcKEYSpwd$4",
    "DataProtectionKeysPath": "/home/ttar.app/oidc-keys/stage/dp-keys",
    "Clients": [
      {
        "ClientId": "ttar-test-client",
        "DisplayName": "TTAR test client",
        "RedirectUris": [ "https://oidcdebugger.com/debug" ]
      },
      {
        "ClientId": "ttar-prospin",
        "DisplayName": "ProSpin Georgia",
        "RedirectUris": [
          "https://prospin-api-194894830109.europe-central2.run.app/integrations/ttar/callback",
          "http://127.0.0.1:8765/integrations/ttar/callback"
        ]
      }
    ]
  },

  "TtarConfiguration": {
    "WebAppUrl": "https://stage.ttar.app",
    "ApiBaseUrl": "http://localhost:5001",
    "InternalBroadcastKey": "fkaN3gZ3ByImp3H-yf2wJaFdfRPQ4lV9Orul-n8AoQw=",
    "ApiPublicUrl": "https://stage.api.ttar.app",
    "EmailPreferencesKey": "hc8jOAHAztefokotNeFj4Ws8Zxsap7tH2ds-qwyUBjI=",
    "AvatarsPath": "/home/ttar.app/api.stage/Images/Avatars",
    "PhotosPath": "/home/ttar.app/api.stage/Images/Photos",
    "AllowStartWithoutConfirmation": true
  },

  // Sandbox DB holds a copy of real user emails; never let testers spam them from staging.
  "EmailConfiguration": {
    "DisableSending": true
  },

  // Swagger is IP-restricted on staging: only these developer networks may open /swagger.
  // Entries are CIDR ranges (x.x.x.x/prefix); fail-closed — an empty/missing list allows no one.
  "Swagger": {
    "AllowedNetworks": [
      "80.249.81.0/24",
      "91.149.171.0/24",
      "91.149.177.0/24",
      "91.215.178.0/24",
      "138.59.5.113/32",
      "212.58.120.0/24"
    ]
  },

  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "Kestrel": {
    "Endpoints": {
      "MyHttpEndpoint": {
        "Url": "http://*:5001"
      }
    }
  }
}