{"repo": "baduru11/xiyouquest-rpg-study-web", "files": {".env.example": {"6b0afd5f77c0de0780fc918a3952c1e82b607ee9": {"t": 1785746762.4071336, "n": 2263, "h": "8f39d4264db51c24", "c": "# Supabase — project URL and anon key from your Supabase dashboard.\n# Auth is Better Auth (HKUST SSO); Supabase is the database + storage + edge\n# functions only. The anon key is still used for RLS'd data access, now\n# authorized by the Better Auth JWT (third-party auth).\nNEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your_anon_key\n# Service role — server-side only (account deletion + achievement provisioning).\nSUPABASE_SERVICE_ROLE_KEY=your_service_role_key\n\n# --- Better Auth (HKUST SSO) ------------------------------------------------\n# App origin; also Better Auth's baseURL and sole trusted origin.\nBETTER_AUTH_URL=http://localhost:3000\n# Session signing secret. Generate with: openssl rand -base64 32\nBETTER_AUTH_SECRET=your_better_auth_secret\n# Postgres connection string for Better Auth's own tables (better_auth schema).\n# Use the Supabase SESSION pooler (port 5432) — transaction mode does not\n# honor the search_path option Better Auth relies on.\nBETTER_AUTH_DATABASE_URL=postgresql://postgres.<ref>:<password>@aws-1-<region>.pooler.supabase.com:5432/postgres\n\n# --- HKUST OIDC (Microsoft Entra, multi-tenant /organizations) ---------------\n# App registration ce4cb5e3-... ; providerId \"hkust\"; callback\n# {BETTER_AUTH_URL}/api/auth/oauth2/callback/hkust (see docs/oidc-redirect-uris.md).\n# One multi-tenant provider serves staff (@ust.hk) + students (@connect.ust.hk):\n# src/lib/auth.ts uses EXPLICIT /organizations/ authorize+token endpoints (no\n# discovery URL). The client secret is OPTIONAL — public-client PKCE, sent only\n# when set. (HKUST_DISCOVERY_URL is no longer used.)\nHKUST_XYQ_CLIENT_ID=your_hkust_client_id\nHKUST_XYQ_CLIENT_SECRET=\n\n# --- AI + speech ------------------------------------------------------------\n# OpenRouter — primary LLM (DeepSeek V4 Flash); Gemini is the fallback.\nOPENROUTER_API_KEY=your_openrouter_api_key\nGEMINI_API_KEY=your_gemini_api_key\n# iFlytek — speech evaluation (ISE) and text-to-speech (TTS).\nIFLYTEK_APP_ID=your_iflytek_app_id\nIFLYTEK_API_KEY=your_iflytek_api_key\nIFLYTEK_API_SECRET=your_iflytek_api_secret\n\n# Supabase Edge Function secret (set via `supabase secrets set`, not in this app):\n#   BETTER_AUTH_JWKS_URL=https://cle-xyq.hkust.edu.hk/api/auth/jwks\n"}, "5dfc4cea7c713aca0aa1ab1cf2d38df60ac0564b": {"t": 1785767565.6079314, "n": 2263, "h": "8f39d4264db51c24", "c": "# Supabase — project URL and anon key from your Supabase dashboard.\n# Auth is Better Auth (HKUST SSO); Supabase is the database + storage + edge\n# functions only. The anon key is still used for RLS'd data access, now\n# authorized by the Better Auth JWT (third-party auth).\nNEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your_anon_key\n# Service role — server-side only (account deletion + achievement provisioning).\nSUPABASE_SERVICE_ROLE_KEY=your_service_role_key\n\n# --- Better Auth (HKUST SSO) ------------------------------------------------\n# App origin; also Better Auth's baseURL and sole trusted origin.\nBETTER_AUTH_URL=http://localhost:3000\n# Session signing secret. Generate with: openssl rand -base64 32\nBETTER_AUTH_SECRET=your_better_auth_secret\n# Postgres connection string for Better Auth's own tables (better_auth schema).\n# Use the Supabase SESSION pooler (port 5432) — transaction mode does not\n# honor the search_path option Better Auth relies on.\nBETTER_AUTH_DATABASE_URL=postgresql://postgres.<ref>:<password>@aws-1-<region>.pooler.supabase.com:5432/postgres\n\n# --- HKUST OIDC (Microsoft Entra, multi-tenant /organizations) ---------------\n# App registration ce4cb5e3-... ; providerId \"hkust\"; callback\n# {BETTER_AUTH_URL}/api/auth/oauth2/callback/hkust (see docs/oidc-redirect-uris.md).\n# One multi-tenant provider serves staff (@ust.hk) + students (@connect.ust.hk):\n# src/lib/auth.ts uses EXPLICIT /organizations/ authorize+token endpoints (no\n# discovery URL). The client secret is OPTIONAL — public-client PKCE, sent only\n# when set. (HKUST_DISCOVERY_URL is no longer used.)\nHKUST_XYQ_CLIENT_ID=your_hkust_client_id\nHKUST_XYQ_CLIENT_SECRET=\n\n# --- AI + speech ------------------------------------------------------------\n# OpenRouter — primary LLM (DeepSeek V4 Flash); Gemini is the fallback.\nOPENROUTER_API_KEY=your_openrouter_api_key\nGEMINI_API_KEY=your_gemini_api_key\n# iFlytek — speech evaluation (ISE) and text-to-speech (TTS).\nIFLYTEK_APP_ID=your_iflytek_app_id\nIFLYTEK_API_KEY=your_iflytek_api_key\nIFLYTEK_API_SECRET=your_iflytek_api_secret\n\n# Supabase Edge Function secret (set via `supabase secrets set`, not in this app):\n#   BETTER_AUTH_JWKS_URL=https://cle-xyq.hkust.edu.hk/api/auth/jwks\n"}, "fea8c7d99213981a7416445cdc04630a2ff0543d": {"t": 1785767566.9562864, "n": 2159, "h": "050444cc9470c6e1", "c": "# Supabase — project URL and anon key from your Supabase dashboard.\n# Auth is Better Auth (HKUST SSO); Supabase is the database + storage + edge\n# functions only. The anon key is still used for RLS'd data access, now\n# authorized by the Better Auth JWT (third-party auth).\nNEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your_anon_key\n# Service role — server-side only (account deletion + achievement provisioning).\nSUPABASE_SERVICE_ROLE_KEY=your_service_role_key\n\n# --- Better Auth (HKUST SSO) ------------------------------------------------\n# App origin; also Better Auth's baseURL and sole trusted origin.\nBETTER_AUTH_URL=http://localhost:3000\n# Session signing secret. Generate with: openssl rand -base64 32\nBETTER_AUTH_SECRET=your_better_auth_secret\n# Postgres connection string for Better Auth's own tables (better_auth schema).\n# Use the Supabase SESSION pooler (port 5432) — transaction mode does not\n# honor the search_path option Better Auth relies on.\nBETTER_AUTH_DATABASE_URL=postgresql://postgres.<ref>:<password>@aws-1-<region>.pooler.supabase.com:5432/postgres\n\n# --- HKUST OIDC (Microsoft Entra, staff tenant) -----------------------------\n# App registration ce4cb5e3-... ; client secret issued by ITSO (expires\n# 2028-06-28). providerId is \"hkust\"; callback is\n# {BETTER_AUTH_URL}/api/auth/oauth2/callback/hkust (see docs/oidc-redirect-uris.md).\nHKUST_XYQ_CLIENT_ID=your_hkust_client_id\nHKUST_XYQ_CLIENT_SECRET=your_hkust_client_secret\nHKUST_DISCOVERY_URL=https://login.microsoftonline.com/<tenant-guid>/v2.0/.well-known/openid-configuration\n\n# --- AI + speech ------------------------------------------------------------\n# OpenRouter — primary LLM (DeepSeek V4 Flash); Gemini is the fallback.\nOPENROUTER_API_KEY=your_openrouter_api_key\nGEMINI_API_KEY=your_gemini_api_key\n# iFlytek — speech evaluation (ISE) and text-to-speech (TTS).\nIFLYTEK_APP_ID=your_iflytek_app_id\nIFLYTEK_API_KEY=your_iflytek_api_key\nIFLYTEK_API_SECRET=your_iflytek_api_secret\n\n# Supabase Edge Function secret (set via `supabase secrets set`, not in this app):\n#   BETTER_AUTH_JWKS_URL=https://cle-xyq.hkust.edu.hk/api/auth/jwks\n"}}}}