# E2E LOCAL-AUTH harness config.
#
# Loaded via AAO_CONFIG by ui/playwright.auth.config.ts. Unlike the auth-off
# harness (ui/playwright.config.ts, no AAO_CONFIG => synthetic 'local' user),
# this boots the orchestrator with LOCAL LOGIN ENABLED so real users sign in
# through the browser. This is the ONLY way to exercise the shared-space member
# invite + avatar features end-to-end: they depend on real user identities
# (owner row, /api/users/pickable, space_members membership) that simply do not
# exist under no-auth.
#
# - DB_PATH / WORKTREE_DIR come from env (the playwright config mks fresh temp
#   dirs and passes them to BOTH the webServer and the seeding code), so no
#   storage paths are pinned here.
# - session_secret is inlined (fixed throwaway value) so the server never
#   generates a key file under data/ — keeps the repo clean and the run
#   deterministic.
# - secure_cookie: false is REQUIRED — over plain http://127.0.0.1 a secure
#   cookie is never sent back, so login would appear to fail.

auth:
  session_secret: "e2e-fixed-secret-do-not-use-in-prod-0123456789"
  secure_cookie: false
  primary_provider: local
  local:
    enabled: true
    allow_signup: false
    bootstrap_admin:
      email: "admin@test.local"
      password: "AdminPass123!"

# A single ENABLED worker pointed at an UNREACHABLE endpoint. It must be enabled
# with a non-empty endpoint + model + execution role so the browser setup
# wizard's needsSetup gate (scripts/setup-lib.mjs isLlmConfigured, evaluated over
# the resolved provider.workers) is satisfied — otherwise the SPA renders the
# first-run wizard instead of the real app and no spaces UI is reachable.
#
# NOTE: this MUST be the legacy `provider.workers` block (the runtime-effective
# array that worker.ts and computeNeedsSetup read). The v2 `llm.workers` block is
# NOT mapped back into provider.workers at load time — a config that only sets
# `llm.workers` falls back to the synthetic model-less `default` worker and
# needsSetup stays true.
#
# Reachability is irrelevant: the member/avatar tests never run a job, so the
# queued job that would need this LLM is never picked up.
provider:
  base_url: http://127.0.0.1:1/v1
  model: e2e-noop
  workers:
    - id: e2e-noop
      endpoint: http://127.0.0.1:1/v1
      model: e2e-noop
      roles: [auto, fast, quality]
      enabled: true