c431d4ab45
Security Improvements (P0.0-P0.4): - P0.0: Migrate to Gemini-only AI stack (simplified, single billing) - P0.1: Fix CORS to restrict allowed origins from env (was *) - P0.2: Remove hardcoded dev password, require env var - P0.3: Add rate limiting (slowapi) - 3-10 req/min on sensitive endpoints - P0.4: Add request size limits (100MB default via middleware) New Features: - Unified LLM service with Google Gemini priority - OXML geometry extractor for layout parsing - TSX validator for generated React components - Client ID support in presentation requests with access control - Configurable LLM/image timeouts via env vars Modern Design System (P0.9 - partial): - Enhanced CSS design tokens (primary, semantic colors, shadows) - Typography scale (h1-h4, body variants, caption) - Modern animations (fadeIn, slideIn, scaleIn) - Updated Button component with better variants and hover effects - Created unified Card and StatusBadge components - Applied design system to Dashboard and Settings pages Backend Improvements: - Master deck parser simplification - Slide-to-HTML endpoint cleanup (325 lines removed) - Better error handling in prompts endpoint Frontend Improvements: - Settings UI simplified to show only Google/Gemini - Dashboard uses CSS variables instead of hardcoded colors - Improved button transitions and hover states Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
45 lines
1.3 KiB
Text
45 lines
1.3 KiB
Text
# Database
|
|
POSTGRES_PASSWORD=deckforge
|
|
|
|
# Redis
|
|
REDIS_URL=redis://redis:6379/0
|
|
|
|
# Azure AD Auth (leave blank to enable dev auth bypass)
|
|
AZURE_AD_TENANT_ID=
|
|
AZURE_AD_CLIENT_ID=
|
|
AZURE_AD_CLIENT_SECRET=
|
|
AZURE_AD_REDIRECT_URI=http://localhost/api/v1/auth/callback
|
|
|
|
# JWT
|
|
JWT_SECRET_KEY=change-me-to-a-random-256-bit-key
|
|
|
|
# Dev Auth (only used when AZURE_AD_TENANT_ID is not set)
|
|
# IMPORTANT: Change this to a strong password or use Azure AD instead
|
|
DEV_AUTH_PASSWORD=change-me-to-secure-password
|
|
|
|
# AI Provider — Google Gemini for all AI operations
|
|
GOOGLE_API_KEY=your_google_api_key_here
|
|
GOOGLE_MODEL=gemini-2.0-flash-exp
|
|
IMAGE_PROVIDER=gemini_flash
|
|
|
|
# Get your Google AI API key at: https://aistudio.google.com/app/apikey
|
|
# Gemini 2.0 Flash: Fast, cheap, great for text generation
|
|
# Gemini 3.1 Flash: Excellent vision model for image analysis
|
|
|
|
# Optional: Image fallback providers (if Gemini image gen fails)
|
|
PEXELS_API_KEY=
|
|
PIXABAY_API_KEY=
|
|
DISABLE_IMAGE_GENERATION=false
|
|
|
|
# App
|
|
APP_DATA_DIRECTORY=/app_data
|
|
TEMP_DIRECTORY=/tmp/deckforge
|
|
CAN_CHANGE_KEYS=false
|
|
DISABLE_ANONYMOUS_TRACKING=true
|
|
|
|
# Security
|
|
ALLOWED_ORIGINS=http://localhost:3000,http://localhost
|
|
# In production, set to: https://yourdomain.com,https://www.yourdomain.com
|
|
|
|
# Request size limit (in bytes, default 100MB = 104857600)
|
|
MAX_REQUEST_SIZE=104857600
|