# Vault Setup

Never print user-provided secret values into chat, files, or logs — reference only the env keys and where each value lives. The one value the AI generates itself is `SESSION_SECRET`: a fresh 64-char hex string via `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`. The template ships only `VITE_MUI_LICENSE_KEY` in `.env`; all project configuration goes into the gitignored `.env.local` created in this step.

## User Input

Ask: **"Do you use Vault for this project? (yes/no)"**

- **Yes** → Branch A.
- **No** → Branch B.

---

## Branch A — Vault

### Part 1 — Vault secrets (user fills these in the Vault UI)

Output:

> 1. Navigate to your Vault UI and log in.
> 2. In your app's root path, create a secret named exactly `harborvault`: toggle 'JSON' mode, then copy-paste the JSON values from another app's `harborvault` secret and save.
> 3. Open your app's `default` secret, click 'Edit' (toggle 'View as JSON'), fill in these keys, then save. Provide user this in JSON to copy-paste — empty string values, except `SESSION_SECRET`, which you pre-fill with a freshly generated value:
>
> | Key                     | Value source                                                    |
> | ----------------------- | --------------------------------------------------------------- |
> | `ENTRA_CLIENT_ID`       | the Entra ID step                                               |
> | `ENTRA_TENANT_ID`       | same for all Wistron apps — copy from another project           |
> | `ENTRA_CLIENT_SECRET`   | your Entra ID application                                       |
> | `SESSION_SECRET`        | already pre-filled in the JSON — generated by the AI            |
> | `DATABASE_SCHEMA`       | the database step                                               |
> | `DATABASE_AUTO_MIGRATE` | `true` unless you manage migrations manually                    |
> | `DATABASE_URL`          | the database step                                               |
>
> When finished, type 'done'.

Wait for "done".

### Part 2 — Create `.env.local`

Rewrite `.env.local` so it contains **only** the keys below. Never fill in secret values yourself — keep values empty except `DATABASE_URL`, where you keep the value if the database step already set one:

```dotenv
VAULT_ADDRESS=
VAULT_SECRET_PATH=
VAULT_USERNAME=
VAULT_PASSWORD=

DATABASE_URL=
```

Then ask the user to fill in the empty values directly in `.env.local` (not in chat) and type 'done'. Wait for "done".

---

## Branch B — No Vault

Create `.env.local` to contain exactly these keys — keep any values already set by earlier steps, fill `SESSION_SECRET` with a freshly generated value, and leave the rest empty:

```dotenv
ENTRA_CLIENT_ID=
ENTRA_TENANT_ID=
ENTRA_CLIENT_SECRET=
SESSION_SECRET=<generated-64-char-hex>

DATABASE_SCHEMA=
DATABASE_AUTO_MIGRATE=
DATABASE_URL=
```

Then ask the user to fill in the empty values directly in `.env.local` (not in chat) and wait for "done".