From f204d248fd60c436228924c8031749692da868cd Mon Sep 17 00:00:00 2001
From: keyhan <k.tahvilpour@greenweb.ir>
Date: Thu, 18 Jun 2026 19:43:53 +0330
Subject: [PATCH] docs(env): document MizbanSMS OTP vars and FRONTEND_URL in
 .env.example

Add the SMS_PROVIDER switch, the MizbanSMS credential/route/template vars
(now the default provider), and FRONTEND_URL (CORS + domain resolution),
so a fresh checkout has an accurate, complete env reference.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 backend/.env.example | 29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/backend/.env.example b/backend/.env.example
index 1793393..d307759 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -20,12 +20,30 @@ JWT_REFRESH_EXPIRES_IN=7d
 REDIS_HOST=localhost
 REDIS_PORT=6379
 
-# OTP SMS — Kavenegar (verify/lookup template API)
-# Create an approved OTP template in the Kavenegar panel and put its name here.
-# The template must contain a single %token placeholder for the code.
+# ─── OTP SMS ────────────────────────────────────────────────────────────────
+# Pick the provider. Without valid credentials, OTP codes are logged to the API
+# console in development only; in production a missing config makes OTP send fail
+# (registration + passwordless login return 503).
+SMS_PROVIDER=mizbansms          # "mizbansms" (default) | "kavenegar"
+
+# MizbanSMS (services.mizbansms.com) — sends the full OTP text over a dedicated
+# line. USERNAME/PASSWORD are required; FROM/API/USERTYPE come from your panel.
+# `Api` is the *active route* number for the FROM line (ask support if 1008).
+MIZBANSMS_USERNAME=
+MIZBANSMS_PASSWORD=
+MIZBANSMS_FROM=5000467254
+MIZBANSMS_API=2016
+MIZBANSMS_USERTYPE=2            # 2 = customer account, 1 = reseller
+# Per-flow message text; `{code}` (or `{{CODE}}`) is replaced with the 6-digit OTP.
+# Defaults are sensible Persian wording — override only to customise.
+# MIZBANSMS_OTP_TEMPLATE_REGISTER=به ابربان خوش آمدید.\nکد تأیید شما: {code}
+# MIZBANSMS_OTP_TEMPLATE_LOGIN=رمز یکبار مصرف ابربان:\n{code}
+# MIZBANSMS_OTP_TEMPLATE_CHANGE_PHONE=کد تأیید شماره جدید ابربان:\n{code}
+
+# Kavenegar (verify/lookup template API) — only used when SMS_PROVIDER=kavenegar.
+# Create an approved OTP template in the panel; it must contain a %token placeholder.
 KAVENEGAR_API_KEY=
 KAVENEGAR_OTP_TEMPLATE=
-# Without these, OTP codes are logged to the API console in development only.
 
 # Seed admin mobile (login is mobile-only) — used by `npm run seed`.
 ADMIN_PHONE=09120000000
@@ -52,6 +70,9 @@ BUILD_NAMESPACE=cloudhost-builds
 BUILD_SERVICE_ACCOUNT=kaniko-builder
 
 # Platform
+# Public URL(s) of the frontend — used for CORS and to derive the platform/preview
+# domains. May be a comma-separated list of origins (first one drives domain resolution).
+FRONTEND_URL=http://localhost:3000
 PLATFORM_DOMAIN=apps.cloudhost.local
 # Base domain for per-user preview URLs (<userId>-<7-digit>.<base-domain>).
 # Falls back to the root domain derived from FRONTEND_URL when unset.