@@ -1,45 +1,81 @@
+# Application metadata and runtime environment.
 APP_NAME=Todo Modulith API
 APP_ENV=production
+FRONTEND_URL=http://localhost:3000
 
+# Local service credentials used by Docker Compose.
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=
 POSTGRES_DB=todo_db
 REDIS_PASSWORD=
 
+# Database connection string and SQLAlchemy pool tuning.
 DATABASE_URL=
 DATABASE_POOL_SIZE=20
 DATABASE_MAX_OVERFLOW=10
 DATABASE_POOL_TIMEOUT=30
 DATABASE_POOL_RECYCLE=3600
 
+# Redis connection used by shared infrastructure such as rate limiting or caching.
 REDIS_URL=
 
+# JWT signing secret. Change this in every deployed environment.
 SECRET_KEY=
 
+# Maximum request body size in bytes.
 MAX_REQUEST_SIZE_MB=5242880 #5mb
 
+# JWT signing, validation, and token lifetime settings.
 ALGORITHM=HS256
 JWT_ISSUER=todo-modulith-api
 JWT_AUDIENCE=todo-modulith-client
 ACCESS_TOKEN_EXPIRE_MINUTES=30
 REFRESH_TOKEN_EXPIRE_MINUTES=10080
 
+# API rate limit rule.
 RATE_LIMIT="100/minute"
 
+# CORS settings for browser clients.
 CORS_ALLOW_ORIGINS=http://localhost:3000
 CORS_ALLOW_METHODS=*
 CORS_ALLOW_HEADERS=*
 
+# Content Security Policy header value.
 SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; frame-ancestors 'none'
 
+# Idempotency key retention time in seconds.
 IDEMPOTENCY_TTL_SECONDS=86400
 
+# Account lockout thresholds used to slow repeated failed login attempts.
 ACCOUNT_LOCKOUT_MAX_ATTEMPTS=5
 ACCOUNT_LOCKOUT_WINDOW_MINUTES=15
 ACCOUNT_LOCKOUT_DURATION_MINUTES=15
 
+# Logging output format for application logs.
 LOG_FORMAT=json
 
+# Email provider selection. Options: ses, sendgrid, smtp.
+EMAIL_PROVIDER=ses
+
+# AWS SES configuration.
+AWS_REGION=us-east-1
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+SES_FROM_EMAIL=noreply@example.com
+
+# SendGrid configuration.
+SENDGRID_API_KEY=
+SENDGRID_FROM_EMAIL=noreply@example.com
+
+# SMTP configuration for Gmail or other SMTP providers.
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USERNAME=
+SMTP_PASSWORD=
+SMTP_FROM_EMAIL=noreply@example.com
+SMTP_USE_TLS=true
+
+# Optional admin and development users created by database seeders.
 SEED_ADMIN_EMAIL=
 SEED_ADMIN_PASSWORD=
 SEED_ADMIN_USERNAME=admin
 
@@ -19,7 +19,10 @@ dependencies = [
     "greenlet (>=3.5.1,<4.0.0)",
     "casbin (>=1.43.0,<2.0.0)",
     "fastapi-limiter (==0.1.6)",
-    "redis (>=8.0.0,<9.0.0)"
+    "redis (>=8.0.0,<9.0.0)",
+    "jinja2 (>=3.1.6,<4.0.0)",
+    "boto3 (>=1.43.34,<2.0.0)",
+    "sendgrid (>=6.12.5,<7.0.0)"
 ]
 
 [tool.poetry]
 
@@ -2,9 +2,9 @@
 from datetime import datetime
 from uuid import UUID
 
-from src.core.utils.cursor import CursorDirection
 from src.modules.authorization.domain.entities.permission import Permission
 from src.modules.authorization.domain.entities.role import Role
+from src.shared.utils.cursor import CursorDirection
 
 
 class AuthorizationService(ABC):
 
@@ -1,6 +1,6 @@
 from uuid import UUID
 
-from sqlalchemy import ForeignKey, String, UniqueConstraint
+from sqlalchemy import String, UniqueConstraint
 from sqlalchemy.orm import Mapped, mapped_column
 
 from src.shared.database.mixin.timestamp import SoftDeleteMixin, TimeStampMixin
@@ -14,10 +14,7 @@ class PermissionModel(Base, TimeStampMixin, SoftDeleteMixin):
     )
 
     key: Mapped[str] = mapped_column(String(255), unique=True, index=True)
-    resource_id: Mapped[UUID] = mapped_column(
-        ForeignKey("authorization_resources.id"),
-        index=True,
-    )
+    resource_id: Mapped[UUID] = mapped_column(index=True)
     resource: Mapped[str] = mapped_column(String(100), index=True)
     action: Mapped[str] = mapped_column(String(100), index=True)
     description: Mapped[str | None] = mapped_column(String(255), nullable=True)
@@ -1,6 +1,6 @@
 from uuid import UUID
 
-from sqlalchemy import ForeignKey, UniqueConstraint
+from sqlalchemy import UniqueConstraint
 from sqlalchemy.orm import Mapped, mapped_column
 
 from src.shared.database.model import Base
@@ -16,8 +16,5 @@ class RolePermissionModel(Base):
         ),
     )
 
-    role_id: Mapped[UUID] = mapped_column(ForeignKey("roles.id"), index=True)
-    permission_id: Mapped[UUID] = mapped_column(
-        ForeignKey("permissions.id"),
-        index=True,
-    )
+    role_id: Mapped[UUID] = mapped_column(index=True)
+    permission_id: Mapped[UUID] = mapped_column(index=True)
@@ -1,6 +1,6 @@
 from uuid import UUID
 
-from sqlalchemy import ForeignKey, UniqueConstraint
+from sqlalchemy import UniqueConstraint
 from sqlalchemy.orm import Mapped, mapped_column
 
 from src.shared.database.model import Base
@@ -12,5 +12,5 @@ class UserHasRoleModel(Base):
         UniqueConstraint("user_id", "role_id", name="uq_user_has_roles_user_id_role_id"),
     )
 
-    user_id: Mapped[UUID] = mapped_column(ForeignKey("users.id"), index=True)
-    role_id: Mapped[UUID] = mapped_column(ForeignKey("roles.id"), index=True)
+    user_id: Mapped[UUID] = mapped_column(index=True)
+    role_id: Mapped[UUID] = mapped_column(index=True)
@@ -4,7 +4,6 @@
 from sqlalchemy import and_, delete, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from src.core.utils.cursor import CursorDirection
 from src.core.authorization.infrastructure.models.casbin_rule_model import (
     CasbinRuleModel,
 )
@@ -24,6 +23,7 @@
 from src.modules.authorization.domain.entities.permission import Permission
 from src.modules.authorization.domain.entities.resource import AuthorizationResource
 from src.modules.authorization.domain.entities.role import Role
+from src.shared.utils.cursor import CursorDirection
 
 
 class SQLAlchemyCasbinPolicyRepository:
 
@@ -6,9 +6,9 @@
     SQLAlchemyCasbinPolicyRepository,
 )
 from src.core.authorization.permissions import permission_key
-from src.core.utils.cursor import CursorDirection
 from src.modules.authorization.domain.entities.permission import Permission
 from src.modules.authorization.domain.entities.role import Role
+from src.shared.utils.cursor import CursorDirection
 
 CASBIN_MODEL_TEXT = """
 [request_definition]