#
# Copyright (c) 2017, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

#
# It is possible to provide default config values, here.
#

webserver:
  port: 8380

security:
  providers:
    - abac:
      # prepares environment
      # executes attribute validations
      # validates that attributes were processed
      # grants/denies access to resource
      #
      ####
      # Combinations:
      # # Will fail if any attribute is not validated and if any has failed validation
      # fail-on-unvalidated: true
      # fail-if-none-validated: true
      #
      # # Will fail if there is one or more attributes present and NONE of them is validated or if any has failed validation
      # # Will NOT fail if there is at least one validated attribute and any number of not validated attributes (and NONE failed)
      # fail-on-unvalidated: false
      # fail-if-none-validated: true
      #
      # # Will fail if there is any attribute that failed validation
      # # Will NOT fail if there are no failed validation or if there are NONE validated
      # fail-on-unvalidated: false
      # fail-if-none-validated: false
      ####
      # fail if an attribute was not validated (e.g. we do not know, whether it is valid or not)
      # defaults to true
      fail-on-unvalidated: true
      # fail if none of the attributes were validated
      # defaults to true
      fail-if-none-validated: true
      policy-validator:
        validators:
        - class: "io.helidon.security.abac.policy.DefaultPolicyValidator"
          - class: "..."
        my-custom-policy-engine:
          some-key: "some value"
          another-key: "another value"
  web-server:
    defaults:
    paths:
      - path: "/query"
        audit: true
      - path: "/noRoles"
        methods: ["get"]
        authenticate: true
      - path: "/user[/{*}]"
        methods: ["get"]
        # implies authentication and authorization
        abac:
          scopes: ["calendar_read", "calendar_edit"]
          time:
            time-of-day:
              - from: "08:15:00"
                to: "12:00:00"
              - from: "12:30"
                to: "17:30"
            days-of-week: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY"]
          policy:
            #statement: "hasScopes('calendar_read','calendar_edit') AND timeOfDayBetween('8:15', '17:30')"
            #ref: "service/policy_id"
            statement: "object.owner == subject.principal.id"
          resource: "com.oracle.ResourceProvider"



