#
# Copyright (c) 2017, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# TODO defaults are the same as java system properties (so we can easily obtain them if defined in JVM)
http:
  proxyHost: "www-proxy-ukc1.uk.oracle.com"
  proxyPort: 80
https:
  proxyHost: "www-proxy-ukc1.uk.oracle.com"
  proxyPort: 80

security:
  # TODO
  service:
    passphrase: "${CLEAR=password}"
    private-key:
      keystore-path: "src/main/resources/keystore.p12"
      keystore-passphrase: "${CLEAR=password}"
  # TODO
  application:
    passphrase: "${CLEAR=password}"
    private-key:
      keystore-path: "src/main/resources/keystore.p12"
      keystore-passphrase: "${CLEAR=password}"

  provider-policy:
    type: "COMPOSITE"
    authentication:
      # TODO
      optional: true # if all abstain, abstain
      # TODO
      default-flag: "OPTIONAL" # success/abstain/failure
      - name: "http-signatures"
        flag: "POSITIVE" # TODO success/abstain
      - name: "google-login"
        flag: "REQUIRED" # success
    outbound:
      - name: "google-login"
      - name: "http-signatures"
  providers:
    - name: "google-login"
      # TODO - class to be optional - each provider may provide a service that is registered under the name or something like that
      # still must support class based for custom provider and for multiple instances of same provider
      # class: "io.helidon.security.google.GoogleTokenProvider"
      optional: true
      client-id: "1048216952820-6a6ke9vrbjlhngbc0al0dkj9qs9tqbk2.apps.googleusercontent.com"
    - name: "http-signatures"
      # if headers are missing in request, abstain
      http-signatures:
        optional: true
        inbound:
          keys:
            # Configuration of trust for all of our services - only leave in the ones that are allowed to call your service
            - key-id: "store"
              principal-name: "Store Service"
              hmac.secret: "${CLEAR=store-password}"
            - key-id: "checkout"
              principal-name: "Checkout Service"
              hmac.secret: "${CLEAR=checkout-password}"
            - key-id: "orders"
              principal-name: "Orders Service"
              hmac.secret: "${CLEAR=orders-password}"
        outbound:
          - name: "outbound-signature"
            hosts: ["*"]
            signature:
              key-id: "orders"
              # TODO default to service-private-key for rsa
              hmac.secret: "${CLEAR=orders-password}"
