# Backend

## PostgreSQL

The API targets PostgreSQL through EF Core 8 and `Npgsql.EntityFrameworkCore.PostgreSQL`.

Local development is aligned with `../docker-compose.dev.yml` and `appsettings.Development.json`:

```text
Host=localhost;Port=5433;Database=vtuber_star_awards_dev;Username=vtsa_dev;Password=change-me-local-only
```

For production or shared deployments, keep checked-in appsettings empty and provide your own value through:

```text
VTSA_POSTGRES
ConnectionStrings__Postgres
```

The API reads its connection string from:

- environment variable `VTSA_POSTGRES`
- environment variable `ConnectionStrings__Postgres`

Demo content is inserted through explicit demo-data migrations, not runtime startup seeding.
Before production, create or activate a real season and delete any season marked as demo. The default app configuration migration contains only non-secret placeholders; restore private Twitch/demo/team credentials from environment variables or a local ignored backup.

If Docker is available locally, start a dev database from the repository root with:

```bash
docker compose -f docker-compose.dev.yml up -d
```

## Commands

Restore and build:

```bash
dotnet restore
dotnet build
```

Create a migration:

```bash
dotnet ef migrations add <MigrationName>
```

Generate a SQL migration script when deployment needs a reviewed artifact:

```bash
dotnet ef migrations script --output Migrations/migration.sql
```

Apply migrations once PostgreSQL is running:

```bash
dotnet ef database update
```

Run the API:

```bash
ASPNETCORE_ENVIRONMENT=Development dotnet run --urls http://127.0.0.1:5084
```

Check the API and database wiring:

```bash
curl http://127.0.0.1:5084/api/health
curl http://127.0.0.1:5084/api/health/database
```

Development auth/session:

```bash
curl -X POST http://localhost:5084/api/auth/dev-login \
  -H "Content-Type: application/json" \
  -d '{"twitchUserId":"jayuhime_admin","displayName":"Jayuhime Admin","role":"admin"}'
```

Demo admin login for public presentations:

```text
VTSA_DEMO_LOGIN_ENABLED=true
VTSA_DEMO_ADMIN_LOGIN=jayuhime_admin
VTSA_DEMO_ADMIN_EMAIL=admin@example.local
VTSA_DEMO_ADMIN_PASSWORD=<set-secure-demo-password>
VTSA_DEMO_ADMIN_TWITCH_ID=jayuhime_admin
VTSA_DEMO_ADMIN_DISPLAY_NAME=Jayuhime Admin
```

The frontend route is `/login`. `VTSA_DEMO_ADMIN_LOGIN` may be a username or an email-style identifier; the backend also accepts the configured email, Twitch ID, and display name for admin flexibility. Disable the demo login for release with `VTSA_DEMO_LOGIN_ENABLED=false`.

Team owner bootstrap credentials are separate from demo login credentials:

```text
VTSA_TEAM_OWNER_PASSWORD=<set-secure-owner-password>
VTSA_TEAM_CREATOR_PASSWORD=<set-secure-creator-password>
```

These fixed owner/creator credentials are authoritative on API startup. If a
personal team account gets locked out after an admin reset, redeploying with the
configured environment password restores the login.

Frontend app-wide demo gate:

```text
VITE_DEMO_GATE_ENABLED=true
```

- `true`: if `/api/public/site-status` is unavailable, the Vue app still starts at `/login` until a session exists.
- unset or `false`: if `/api/public/site-status` is unavailable, public pages such as `/` remain visible without the initial demo login.

When `/api/public/site-status` is reachable, the backend `demoLoginEnabled` flag is authoritative.