# Entra config for the Entra e2e / spike harnesses. Copy to `.env` (gitignored)
# and fill in from your tenant. `entra_setup.sh setup` creates the app
# registrations and writes a populated `.env` for you.
#
#   cp scripts/obo-e2e/.env.example scripts/obo-e2e/.env
#   # then edit, or run: ./scripts/obo-e2e/entra_setup.sh setup

export ENTRA_TENANT_ID=<tenant-guid-or-domain>
export ENTRA_CLIENT_ID=<turnstone-spike-app-client-id>
export ENTRA_CLIENT_SECRET=<client-secret>
export SPIKE_AUDIENCE_A=api://<resource-app-a-guid>   # a consented resource
export SPIKE_AUDIENCE_B=api://<resource-app-b-guid>   # a second consented resource
export SPIKE_AUDIENCE_UNCONSENTED=api://<resource-app-c-guid>  # NOT granted (negative case)
export SPIKE_RUN_OBO=1
# export SPIKE_PORT=8765            # redirect-listener port (default 8765)
# export SPIKE_CALLBACK_FILE=/tmp/obo_cb.txt   # remote-browser mode: paste the redirect URL here

# The Keycloak / OSS-path harness needs no config — keycloak_e2e.sh sets
# everything and stands up an ephemeral container.