Align prod schema and deploy tooling

terraform/variables.tf

@@ -0,0 +1,68 @@
+variable "supabase_access_token" {
+  description = "Supabase API access token"
+  type        = string
+  sensitive   = true
+}
+
+# Project refs per environment (selected by workspace)
+locals {
+  project_refs = {
+    production     = "ckjcrkjpmhqhiucifukx"
+    non-production = "itbzhrvlgvdmzbnhzhyx"
+    default        = "itbzhrvlgvdmzbnhzhyx" # Default workspace uses non-prod
+  }
+
+  # Select project_ref based on current workspace
+  project_ref = lookup(local.project_refs, terraform.workspace, local.project_refs["default"])
+
+  # Environment detection
+  is_production = terraform.workspace == "production"
+
+  # SMTP settings (only production has custom SMTP configured)
+  smtp_settings = local.is_production ? {
+    smtp_admin_email   = "team@send.sauci.app"
+    smtp_host          = "smtp.resend.com"
+    smtp_max_frequency = 1
+    smtp_port          = "465"
+    smtp_sender_name   = "Sauci App"
+    smtp_user          = "resend"
+  } : {}
+
+  # Rate limit for email (requires custom SMTP in production)
+  rate_limit_email_sent = local.is_production ? 25 : 3
+}
+
+variable "project_ref" {
+  description = "Supabase project reference ID (overrides workspace-based selection)"
+  type        = string
+  default     = ""
+}
+
+# Auth provider secrets (stored in Supabase dashboard, referenced here for documentation)
+variable "google_client_id" {
+  description = "Google OAuth client ID"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "google_client_secret" {
+  description = "Google OAuth client secret"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "apple_client_id" {
+  description = "Apple OAuth client ID (Services ID)"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "apple_client_secret" {
+  description = "Apple OAuth client secret (JWT)"
+  type        = string
+  sensitive   = true
+  default     = ""
+}