# Microsoft 365 OAuth Configuration
# Create an Azure AD app registration and get these values:
#
# NOTE: .env is read from the directory the server is started in, which the MCP
# client picks. Only the four variables below are read from it. Everything else
# (token cache paths, the auth-cache command, Key Vault, logging, HTTP settings)
# must be set in your shell or MCP client config.

# Your Azure AD App Registration Client ID
MS365_MCP_CLIENT_ID=your-azure-ad-app-client-id-here

# Your Azure AD App Registration Client Secret (optional, for confidential clients)
MS365_MCP_CLIENT_SECRET=your-azure-ad-app-client-secret-here

# Tenant ID - use "common" for multi-tenant or your specific tenant ID
MS365_MCP_TENANT_ID=common

# Cloud environment: global (default) or china (21Vianet)
# MS365_MCP_CLOUD_TYPE=global

# Instructions for Global Cloud:
# 1. Go to https://portal.azure.com
# 2. Navigate to Azure Active Directory → App registrations → New registration
# 3. Set name: "MS365 MCP Server"
# 4. Add these redirect URIs (for MCP Inspector testing):
#    - http://localhost:6274/oauth/callback
#    - http://localhost:6274/oauth/callback/debug
#    - http://localhost:3000/callback (optional, for server callback)
# 5. Copy the Client ID from Overview page
# 6. Go to Certificates & secrets → New client secret → Copy the secret value
# 7. Replace the values above with your actual credentials
# 8. Rename this file to .env

# Instructions for China Cloud (21Vianet):
# 1. Go to https://portal.azure.cn
# 2. Navigate to Azure Active Directory → App registrations → New registration
# 3. Follow the same steps as above
# 4. Set MS365_MCP_CLOUD_TYPE=china

# -------------------------------------------------------------------
# Azure Key Vault Integration (Optional)
# -------------------------------------------------------------------
# When set, secrets are fetched from Azure Key Vault instead of environment variables.
# This is useful for production deployments, especially with Azure Container Apps.
#
# Not read from .env - export MS365_MCP_KEYVAULT_URL in the environment instead:
#   export MS365_MCP_KEYVAULT_URL=https://your-keyvault-name.vault.azure.net
#
# Key Vault secret names (store these in your Key Vault):
#   - ms365-mcp-client-id     (required)
#   - ms365-mcp-tenant-id     (optional, defaults to "common")
#   - ms365-mcp-client-secret (optional)
#   - ms365-mcp-cloud-type    (optional, defaults to "global")
#
# Authentication uses DefaultAzureCredential, which supports:
#   - Managed Identity (recommended for Azure Container Apps)
#   - Azure CLI credentials (for local development)
#   - Environment variables (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID)
#
# See README.md for detailed Azure Key Vault setup instructions.

# -------------------------------------------------------------------
# External Auth Cache Storage (Optional)
# -------------------------------------------------------------------
# Headless local-MSAL deployments can store token-cache and selected-account
# metadata with a provider-neutral executable wrapper. The value is a real
# executable path (absolute), not a shell command string; put any
# provider-specific args inside the wrapper script.
#
# This one starts a process, so it is deliberately NOT read from .env. Export it
# in the environment that launches the server:
#   export MS365_MCP_AUTH_CACHE_COMMAND=/path/to/ms365-auth-cache-store
#   export MS365_MCP_AUTH_CACHE_COMMAND_TIMEOUT_MS=10000