#
# Copyright (c) 2017, 2019 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

#
# It is possible to provide default config values, here.
#

server:
  port: 8380

security:
  providers:
    - abac:
        # prepares environment
        # executes attribute validations
        # validates that attributes were processed
        # grants/denies access to resource
        #
        ####
        # Combinations:
        # # Will fail if any attribute is not validated and if any has failed validation
        # fail-on-unvalidated: true
        # fail-if-none-validated: true
        #
        # # Will fail if there is one or more attributes present and NONE of them is validated or if any has failed validation
        # # Will NOT fail if there is at least one validated attribute and any number of not validated attributes (and NONE failed)
        # fail-on-unvalidated: false
        # fail-if-none-validated: true
        #
        # # Will fail if there is any attribute that failed validation
        # # Will NOT fail if there are no failed validation or if there are NONE validated
        # fail-on-unvalidated: false
        # fail-if-none-validated: false
        ####
        # fail if an attribute was not validated (e.g. we do not know, whether it is valid or not)
        # defaults to true
        fail-on-unvalidated: true
        # fail if none of the attributes were validated
        # defaults to true
        fail-if-none-validated: true
#        policy-validator:
#          validators:
#          - class: "io.helidon.security.abac.policy.DefaultPolicyValidator"
#          my-custom-policy-engine:
#            some-key: "some value"
#            another-key: "another value"
    - atn:
      class: "io.helidon.security.examples.abac.AtnProvider"
  web-server:
    defaults:
    paths:
      - path: "/query"
        audit: true
      - path: "/noRoles"
        methods: ["get"]
        authenticate: true
      - path: "/user[/{*}]"
        methods: ["get"]
        # implies authentication and authorization
        abac:
          scopes: ["calendar_read", "calendar_edit"]
          time:
            time-of-day:
              - from: "08:15:00"
                to: "12:00:00"
              - from: "12:30"
                to: "17:30"
            days-of-week: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY"]
          policy:
            #statement: "hasScopes('calendar_read','calendar_edit') AND timeOfDayBetween('8:15', '17:30')"
            #ref: "service/policy_id"
            statement: "object.owner == subject.principal.id"
          resource: "com.oracle.ResourceProvider"



