feat: implement persistent session feature for user authentication wi…

.claude/settings.local.json

@@ -0,0 +1,16 @@
+{
+  "permissions": {
+    "allow": [
+      "PowerShell(pnpm exec *)",
+      "PowerShell(pnpm db:generate *)",
+      "PowerShell(Get-Process *)",
+      "PowerShell(Stop-Process *)",
+      "PowerShell(pnpm db:push *)",
+      "PowerShell(pnpm lint *)",
+      "PowerShell(pnpm build *)",
+      "PowerShell(npx tsc --noEmit)",
+      "mcp__ide__getDiagnostics",
+      "PowerShell(pnpm run *)"
+    ]
+  }
+}

.env.example

@@ -1,17 +1,39 @@
-APP_DOMAIN="app.example.com"
 DATABASE_URL="postgresql://user:password@localhost:5432/mydatabase" # Replace with your actual database URL
 
 BETTER_AUTH_SECRET="supersecretkey" # Replace with a strong secret key
-BETTER_AUTH_URL="https://app.example.com" # Base URL of your app
+# Base URL of your app. MUST be a public HTTPS URL — GitHub delivers webhooks
+# here to auto-register hooks and post reviews. For local dev, expose your
+# server with a tunnel (e.g. cloudflared / ngrok) and use that URL; GitHub
+# cannot reach http://localhost.
+BETTER_AUTH_URL="https://app.example.com"
 NEXT_PUBLIC_APP_URL="https://app.example.com"
 
+# Optional override for the GitHub webhook endpoint origin. If set, webhooks are
+# registered against this URL instead of the app URL above. Use it in local dev
+# to point GitHub at a public HTTPS tunnel (e.g. ngrok) while BETTER_AUTH_URL /
+# NEXT_PUBLIC_APP_URL stay on http://localhost:3000. Accepts the bare origin
+# (https://xxxx.ngrok-free.app) or the full /api/webhooks/github URL. Leave unset
+# in production — the app URL is used automatically.
+WEBHOOK_PUBLIC_URL=""
+
 GH_CLIENT_ID=""
 GH_CLIENT_SECRET=""
 
 GROQ_API_KEY="" # Free key from https://console.groq.com/keys
 OPENAI_API_KEY="" # Optional — only needed when using the "openai" provider
 OPENAI_BASE_URL="" # Optional — override for OpenAI-compatible endpoints (e.g. OpenRouter)
+ANTHROPIC_API_KEY="" # Optional — app-level default for the "anthropic" (Claude) provider. If unset, Claude requires each user to bring their own key in Settings.
+GEMINI_API_KEY="" # Optional — app-level default for the "gemini" (Google) provider. If unset, Gemini requires each user to bring their own key in Settings. Get one at https://aistudio.google.com/apikey
+
+# 32-byte key used to encrypt user-supplied AI API keys at rest (AES-256-GCM).
+# REQUIRED to save a user API key in Settings; reviews on the default Groq path
+# keep working without it. Generate one with:
+#   node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+SETTINGS_ENCRYPTION_KEY=""
 
+# Legacy/global webhook secret. Each repo now gets its own per-repo secret
+# generated automatically when its webhook is registered. This value is only a
+# fallback for hooks configured manually before per-repo secrets existed.
 GH_WEBHOOK_SECRET="supersecretwebhooksecret" # Replace with a strong secret key
 
 INNGEST_EVENT_KEY=""