feat/Update_Controllers_to_Allow_for_Premium_Membership

.env.example

@@ -30,15 +30,16 @@ AUTH_GOOGLE_CLIENT_ID=CHANGE_ME_GOOGLE_CLIENT_ID
 # Optional: enables the "Continue with Microsoft" sign-in tab (separate from the
 # MICROSOFT_CLIENT_ID below, which is for Outlook mail linking, not sign-in).
 AUTH_MICROSOFT_CLIENT_ID=
+# Microsoft application sign-in tenant policy: tenant GUID, organizations, consumers, or common.
+# This is separate from MICROSOFT_TENANT_ID, which configures Graph mailbox OAuth.
+AUTH_MICROSOFT_TENANT=common
 GOOGLE_GMAIL_CLIENT_SECRET=CHANGE_ME_GOOGLE_OAUTH_CLIENT_SECRET
 # Optional. If omitted, the backend uses https://<your-domain>/api/gmail/oauth/callback
-GOOGLE_GMAIL_REDIRECT_URI=
 MICROSOFT_CLIENT_ID=CHANGE_ME_MICROSOFT_CLIENT_ID
 MICROSOFT_CLIENT_SECRET=CHANGE_ME_MICROSOFT_OAUTH_CLIENT_SECRET
 # Optional. Defaults to "common" (personal + work/school accounts).
 MICROSOFT_TENANT_ID=
 # Optional. If omitted, the backend uses https://<your-domain>/api/microsoft-graph/oauth/callback
-MICROSOFT_REDIRECT_URI=
 AI_SERVICE_BASE_URL=http://ai-service:8001
 # REQUIRED. Shared secret the backend sends to ai-service on every call except /health.
 # The stack refuses to start without it. Generate with: openssl rand -hex 32
@@ -48,21 +49,33 @@ OLLAMA_BASE_URL=http://ollama:11434
 OLLAMA_MODEL=qwen2.5:7b
 
 # AI provider for the heavy /cv/* calls: ollama (default, local) | gemini | groq.
-# /summarize always stays local (distilbart). To offload a weak production GPU,
-# set AI_PROVIDER=gemini (or groq) and provide the matching key below.
+# External processing is denied unless the administrator gate below is true AND
+# the authenticated Pro user has explicitly opted in under Settings. /summarize
+# always stays local (distilbart).
 # Keys are read from the environment only — never commit real keys.
 AI_PROVIDER=ollama
+EXTERNAL_AI_ENABLED=false
 GEMINI_API_KEY=
 GEMINI_MODEL=gemini-2.0-flash
 GROQ_API_KEY=
 GROQ_MODEL=llama-3.3-70b-versatile
 
+# Durable AI operation worker. Keep false until handlers, monitoring and rollout gates are verified.
+WORKER_AI_OPERATIONS_ENABLED=false
+AI_QUEUE_WORKER_CONCURRENCY=1
+AI_QUEUE_GLOBAL_CAPACITY=100
+AI_QUEUE_PER_USER_CAPACITY=10
+AI_QUEUE_DEADLINE_MINUTES=15
+AI_QUEUE_OPERATION_TIMEOUT_SECONDS=300
+
 # Optional: only needed if you want the UI to call a non-default API base URL.
 # In production the UI defaults to `/api`.
 NEXT_PUBLIC_API_BASE_URL=
 
 # Used by docker-compose.yml (email / password resets / notifications)
 APP_PUBLIC_BASE_URL=https://jobs.cesnimda.uk
+# Dedicated nginx-to-backend network. Confirm this CIDR does not overlap existing Docker networks.
+WEB_PROXY_SUBNET=172.31.250.0/29
 APP_VERSION=
 APP_COMMIT_SHA=
 APP_BUILD_STAMP=
@@ -73,8 +86,12 @@ EMAIL_SMTP_USER=CHANGE_ME_GMAIL_ADDRESS
 EMAIL_SMTP_PASSWORD=CHANGE_ME_GOOGLE_APP_PASSWORD
 EMAIL_FROM=CHANGE_ME_GMAIL_ADDRESS
 EMAIL_FROM_NAME=Jobbjakt
-EMAIL_FOLLOWUPREMINDERS_ENABLED=true
+EMAIL_FOLLOWUPREMINDERS_ENABLED=false
 EMAIL_FOLLOWUPREMINDERS_UPCOMINGDAYS=2
+WORKER_RULES_ENABLED=false
+WORKER_FOLLOWUP_REMINDERS_ENABLED=false
+WORKER_DAILY_EXPORT_ENABLED=false
+WORKER_JOB_ENRICHMENT_ENABLED=false
 
 EMAIL_SMTP_ENABLE_SSL=true
 EMAIL_SMTP_TIMEOUT_MS=15000