# Env-aware config values:
# - Hardcoded values still work: `base_url: http://localhost:3000`
# - Inline env reference: `${ENV_NAME}`
# - Inline env reference with fallback: `${ENV_NAME:-default}`
# - Every config key can also be overridden by env via:
#   ATHENA_AUTH_CONFIG__<SECTION>__<FIELD> (env always wins over YAML)
#   Example: ATHENA_AUTH_CONFIG__AUTH__BASE_URL
# Legacy aliases still work for compatibility: BASE_URL, AUTH_BASE_PATH, PUBLIC_AUTH_BASE_PATH, TRUSTED_ORIGINS.
auth:
  # Optional runtime values. Env vars always take final precedence.
  base_url: ${BASE_URL:-http://localhost:3000}
  base_path: ${AUTH_BASE_PATH:-/api/auth}
  # Public-facing auth path for generated email/callback URLs. Useful when the
  # server handles `/` internally but a proxy exposes auth under `/api/auth`.
  public_base_path: ${PUBLIC_AUTH_BASE_PATH:-/api/auth}
  password:
    argon2:
      memory_cost: 1024
      time_cost: 2
      parallelism: 1
  trusted_origins:
  - ${PRIMARY_TRUSTED_ORIGIN:-http://localhost:*}
  - https://*.athena-db.com
  - https://*.athena-cluster.com
  - https://athena-auth-*-suits-finance.vercel.app
  - https://app.formations.company
  - https://speedrun-formations.vercel.app
  - https://xbp.app
  - https://*.xbp.app

  avatar_storage:
    enabled: false
    bucket: avatars
    endpoint: https://storage.example.com
    access_key: ${AVATAR_S3_ACCESS_KEY:-}
    secret_key: ${AVATAR_S3_SECRET_KEY:-}
    url_style: path
    prefix_path: auth
    file_key_template: "{kind}/{entity_id}/{sha256}.{extension}"

  session:
    # Session lifetime and refresh policy.
    expires_in_seconds: 604800 # 7 days
    update_age_seconds: 86400 # 1 day; set 0 to refresh expiry on every request
    disable_session_refresh: false
    fresh_age_seconds: 0 # set > 0 to require "fresh" sessions for sensitive flows

    # Cookie/session token behavior.
    cookie_name: athena-auth.session-token
    cookie_domain: ${ATHENA_AUTH_COOKIE_DOMAIN:-}
    cookie_secure: true
    cookie_http_only: true
    cookie_same_site: lax # strict | lax | none

    # Headers trusted when extracting the real client IP.
    trusted_proxy_headers:
    - x-forwarded-for
    - x-real-ip
    - cf-connecting-ip

    ip:
      headers:
      - x-forwarded-for
      - x-real-ip
      disable_tracking: false # Set true to force NULL session ip_address values.
      denylist: [] # Optional exact IP literals blocked in Axum middleware before auth dispatch.

    intelligence:
      enabled: true
      detect_country_change: true
      geoip:
        enabled: true
        provider: ipwhois # ipwhois | ipapi
        base_url: https://ipwho.is
        # If provider=ipapi, set base_url: https://ipapi.co
        # api_key: your-provider-key
        # api_key_env: ATHENA_AUTH_GEOIP_API_KEY
        api_key_header: x-api-key
        timeout_ms: 2500
        cache_ttl_seconds: 86400 # 24h cache at IP level

observability:
  metrics:
    enabled: true
    path: /metrics
    dashboard_enabled: true
    dashboard_path: /metrics/view
    prefix: athena_auth
  loki:
    enabled: true
    url: https://loki.xbp.app
    tenant_id: ""
    labels:
      service: athena-auth
      environment: local

multitenancy:
  enabled: false
  header_name: x-athena-tenant
  default_tenant: default
  schema_mapping:
    users: users
    sessions: sessions

  tenants:
    default:
      database_url_env: DATABASE_URL
      search_path: athena
      schema_mapping:
        users: tenant_users
    # tenant_a:
    #   database_url_env: ATHENA_AUTH_TENANT_A_DATABASE_URL
    #   search_path: tenant_a,athena
    #   schema_mapping:
    #     users: tenant_a_users

schema_detection:
  enabled: true
  auth_schema: ${ATHENA_AUTH_SCHEMA:-athena}
  write_mapping_file: true
  output_path: schema-mapping.generated.yaml
  min_column_match_ratio: 0.6
  # Ranked fallbacks per logical table. The detector checks these in order.

  table_substitutions:
    users:
    - user
    sessions:
    - session
    accounts:
    - account
    verifications:
    - verification
    invitations:
    - invitation
    two_factor:
    - two_factor
    api_keys:
    - api_key
    passkeys:
    - passkey
    email_send_failures:
    - email_send_failure
    admin_audit_logs:
    - admin_audit_log
    ip_profiles:
    - ip_profile
    session_ip_profiles:
    - session_ip_profile
