#
# Copyright (c) 2019 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

grpc:
  port: 1408

security:
  providers:
    - abac:
        # prepares environment
        # executes attribute validations
        # validates that attributes were processed
        # grants/denies access to resource
        #
        ####
        # Combinations:
        # # Will fail if any attribute is not validated and if any has failed validation
        # fail-on-unvalidated: true
        # fail-if-none-validated: true
        #
        # # Will fail if there is one or more attributes present and NONE of them is validated or if any has failed validation
        # # Will NOT fail if there is at least one validated attribute and any number of not validated attributes (and NONE failed)
        # fail-on-unvalidated: false
        # fail-if-none-validated: true
        #
        # # Will fail if there is any attribute that failed validation
        # # Will NOT fail if there are no failed validation or if there are NONE validated
        # fail-on-unvalidated: false
        # fail-if-none-validated: false
        ####
        # fail if an attribute was not validated (e.g. we do not know, whether it is valid or not)
        # defaults to true
        fail-on-unvalidated: true
        # fail if none of the attributes were validated
        # defaults to true
        fail-if-none-validated: true
    - atn:
      class: "io.helidon.grpc.examples.security.abac.AtnProvider"

  grpc-server:
    # Configuration of integration with grpc server
    # The default configuration to apply to all services not explicitly configured below
    defaults:
      authenticate: true
      authorize: true
    services:
      - name: "StringService"
        methods:
          - name: "Upper"
            # Define our custom authenticator rules for the Upper method
            atn:
              - principal: "user"
                type: "USER"
                roles: ["user_role"]
                scopes: ["calendar_read", "calendar_edit"]
              - principal: "service"
                type: "SERVICE"
                roles: ["service_role"]
                scopes: ["calendar_read", "calendar_edit"]
            # Define ABAC rules for the Upper method
            abac:
              scopes: ["calendar_read", "calendar_edit"]
              time:
                time-of-day:
                  - from: "08:15:00"
                    to: "12:00:00"
                  - from: "12:30"
                    to: "17:30"
                days-of-week: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY"]
              policy:
                statement: "${env.time.year >= 2017}"


