#
# Copyright (c) 2016, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# Full configuration of security - with defaults mentioned and documented meanings
security:
  # If set to false, the trace available through SecurityContext.getTracer() is a no-op
  tracing.enabled: false
  provider-policy:
    # Possible types: FIRST (default), COMPOSITE or CLASS
    # FIRST: first provider in the list is the default one
    # COMPOSITE: a list of providers for authentication and outbound security
    # CLASS: an explicit class name of a class implementing io.helidon.security.spi.ProviderSelectionPolicy
    type: "COMPOSITE"
    # if set to true, this will be the default provider used for authentication. If set to false, this provider
    # will be used only in case it is explicitly required on a protected resource
    default: true
    # Name of this provider to use when referenced with explicit name
    name: "composite"
    authentication:
      # list of authentication providers
      # flag:
      # REQUIRED (default) - provider must succeed, otherwise the whole composite fails
      # OPTIONAL - provider must succeed or abstain
      # MAY_FAIL - provider can succeed, abstain or fail
      # SUFFICIENT - provider must succeed or abstain. If succeeds, no further provider is called
      # FORBIDDEN - provider must abstain or fail
      # MUST_FAIL - provider must fail
      - name: "google-login"
        flag: "OPTIONAL"
    authorization:
      - name: "roles"
        flag: "MAY_FAIL"
    # Outbound does not support flags
    outbound:
      - name: "google-login"
      - name: "http-signatures"
  providers:
    # default authentication provider (by name) - useful when more providers are configured that support both atn and atz
    # only makes sense when selection policy is "FIRST"
    default-authentication-provider: "google-login"
    # default authorization provider (by name) - useful when more providers are configured that support both atn and atz
    default-authorization-provider: "roles"
    # A list of configured security providers with their configuration
    - google-login:
        client-id: "..."
        token:
          header: "GoogleToken"
          regexp: "(.*)"
    - name: "roles"
      class: "io.helidon.security.roles.RolesProvider"
    # Equivalent to the one above (as roles provider maps "roles" configuration to itself through spi)
    - http-signatures:
        # specific configuration of this provider
        optional: true
        # The following options can restrict width of a provider.
        # By default they are all true for interfaces the provider implements
        is-authentication-provider: false
        is-authorization-provider: true
        is-client-security-provider: false
        is-audit-provider: false
    - abac:
      # attribute based access control
      # prepares environment
      # executes attribute validations
      # validates that attributes were processed
      # grants/denies access to resource
      #
      ####
      # Combinations:
      # # Will fail if any attribute is not validated and if any has failed validation
      # fail-on-unvalidated: true
      # fail-if-none-validated: true
      #
      # # Will fail if there is one or more attributes present and NONE of them is validated or if any has failed validation
      # # Will NOT fail if there is at least one validated attribute and any number of not validated attributes (and NONE failed)
      # fail-on-unvalidated: false
      # fail-if-none-validated: true
      #
      # # Will fail if there is any attribute that failed validation
      # # Will NOT fail if there are no failed validation or if there are NONE validated
      # fail-on-unvalidated: false
      # fail-if-none-validated: false
      ####
      # fail if an attribute was not validated (e.g. we do not know, whether it is valid or not)
      # defaults to true
      fail-on-unvalidated: true
      # fail if none of the attributes were validated
      # defaults to true
      fail-if-none-validated: true
      scope-validator:
        # each sub-key of abac key other than the ones above is a configuration
        # of an AttributeValidator ("small" security provider responsible for validating attribute(s)
        operator: OR
  environment:
    # possible modification of real time for security enforcement
    server-time:
      # can shift time if needed (before explicit values are applied
      # shift-by-seconds: -1020
      #
      # if configured, will override actual value, if not set, current value is used
      #
      # definition of a time zone (that is valid for ZoneId.of())
      # this will move the time to the specific timezone (same instant)
      # Time zone is applied first, everything else after
      # time-zone: Europe/Prague
      time-zone: "Australia/Darwin"
      year: 2017
      # 1 for January, 12 for December
      month: 9
      # day of month (1 - 31)
      day-of-month: 6
      # hour of day (0 - 23)
      hour-of-day: 13
      # minute of hour (0 - 59)
      minute: 0
      # second of minute (0-59)
      second: 0
      # millisecond of minute (0-999)
      # millisecond: 0
