# Env-aware config values:
# - Hardcoded values still work: `base_url: http://localhost:3000`
# - Inline env reference: `${ENV_NAME}`
# - Inline env reference with fallback: `${ENV_NAME:-default}`
# - Every config key can also be overridden by env via:
#   ATHENA_AUTH_CONFIG__<SECTION>__<FIELD> (env always wins over YAML)
#   Example: ATHENA_AUTH_CONFIG__AUTH__BASE_URL
# Legacy aliases still work for compatibility: BASE_URL, AUTH_BASE_PATH, PUBLIC_AUTH_BASE_PATH, TRUSTED_ORIGINS.
auth:
  # Optional runtime values. Env vars always take final precedence.
  base_url: ${BASE_URL:-http://localhost:3000}
  base_path: ${AUTH_BASE_PATH:-/api/auth}
  # Public-facing auth path for generated email/callback URLs. Useful when the
  # server handles `/` internally but a proxy exposes auth under `/api/auth`.
  public_base_path: ${PUBLIC_AUTH_BASE_PATH:-/api/auth}
  # Scheme-less public hosts default to https. Localhost-style hosts and values
  # with sslmode=disable default to http.
  trusted_origins:
    - ${PRIMARY_TRUSTED_ORIGIN:-http://localhost:3000}
    - http://localhost:3001
    - https://app.formations.company
    - https://speedrun-formations.vercel.app

  avatar_storage:
    enabled: false
    bucket: avatars
    endpoint: https://storage.example.com
    access_key: ${AVATAR_S3_ACCESS_KEY:-}
    secret_key: ${AVATAR_S3_SECRET_KEY:-}
    url_style: path
    prefix_path: auth
    file_key_template: "{kind}/{entity_id}/{sha256}.{extension}"

  password:
    argon2:
      # Tuned for fast interactive logins while still using Argon2id.
      # All values can also be overridden by env:
      # ATHENA_AUTH_CONFIG__AUTH__PASSWORD__ARGON2__MEMORY_COST
      # ATHENA_AUTH_CONFIG__AUTH__PASSWORD__ARGON2__TIME_COST
      # ATHENA_AUTH_CONFIG__AUTH__PASSWORD__ARGON2__PARALLELISM
      memory_cost: 1024
      time_cost: 2
      parallelism: 1

  passkey:
    # Optional WebAuthn Related Origin Requests allowlist.
    # Exposed as `GET /.well-known/webauthn` with JSON `{ "origins": [...] }`.
    # Env override: PASSKEY_RELATED_ORIGINS=https://one.example.com,https://two.example.com
    related_origins: []

  session:
    # Session lifetime and refresh policy.
    expires_in_seconds: 604800 # 7 days
    update_age_seconds: 86400 # 1 day; set 0 to refresh expiry on every request
    disable_session_refresh: false
    fresh_age_seconds: 0 # set > 0 to require "fresh" sessions for sensitive flows

    # Cookie/session token behavior.
    cookie_name: athena-auth.session-token
    # Shared parent-domain cookie for direct sibling-subdomain auth.
    # Example: `.athena-auth.com` shares one session between
    # `auth.athena-auth.com` and `ui.athena-auth.com`.
    # This widens the cookie trust boundary to every controlled subdomain under the parent.
    cookie_domain: ${ATHENA_AUTH_COOKIE_DOMAIN:-}
    cookie_secure: true
    cookie_http_only: true
    cookie_same_site: lax # strict | lax | none

    # Headers trusted when extracting the real client IP.
    trusted_proxy_headers:
      - x-forwarded-for
      - x-real-ip
      - cf-connecting-ip

    ip:
      headers:
        - x-forwarded-for
        - x-real-ip
      disable_tracking: false # Set true to force NULL session ip_address values.

    intelligence:
      enabled: false
      detect_country_change: true
      geoip:
        enabled: false
        provider: ipwhois # ipwhois | ipapi
        base_url: https://ipwho.is
        # If provider=ipapi, set base_url: https://ipapi.co
        # api_key: your-provider-key
        # api_key_env: ATHENA_AUTH_GEOIP_API_KEY
        api_key_header: x-api-key
        timeout_ms: 2500
        cache_ttl_seconds: 86400 # 24h cache at IP level

observability:
  metrics:
    enabled: true
    path: /metrics
    dashboard_enabled: true
    dashboard_path: /metrics/view
    prefix: athena_auth
  loki:
    enabled: false
    url: http://localhost:3100
    tenant_id: ""
    labels:
      service: athena-auth
      environment: local
  logging:
    format: pretty # pretty | json
    wide_events: true
    environment: local
    region: ""
    deployment_id: ""
    instance_id: ""
    commit_hash: ""

multitenancy:
  enabled: false
  header_name: x-athena-tenant
  default_tenant: default
  schema_mapping:
    users: users
    sessions: sessions
  tenants:
    default:
      database_url_env: DATABASE_URL
      search_path: athena
      schema_mapping:
        users: tenant_users
    # tenant_a:
    #   database_url_env: ATHENA_AUTH_TENANT_A_DATABASE_URL
    #   search_path: tenant_a,athena
    #   schema_mapping:
    #     users: tenant_a_users

schema_detection:
  enabled: false
  auth_schema: ${ATHENA_AUTH_SCHEMA:-athena}
  write_mapping_file: false
  output_path: schema-mapping.generated.yaml
  min_column_match_ratio: 0.6
  # Ranked fallbacks per logical table. The detector checks these in order.
  table_substitutions:
    users:
      - user
      - auth_users
    sessions:
      - session
      - auth_sessions
