auth:
  base_url: ${BASE_URL:-http://localhost:3000}
  base_path: ${AUTH_BASE_PATH:-/api/auth}
  public_base_path: ${PUBLIC_AUTH_BASE_PATH:-/api/auth}
  trusted_origins:
    - ${PRIMARY_TRUSTED_ORIGIN:-http://localhost:3000}
    - http://localhost:3001

  password:
    argon2:
      memory_cost: 1024
      time_cost: 2
      parallelism: 1

  passkey:
    related_origins: []

  session:
    expires_in_seconds: 604800
    update_age_seconds: 86400
    disable_session_refresh: false
    fresh_age_seconds: 0
    cookie_name: athena-auth.session-token
    cookie_domain: ${ATHENA_AUTH_COOKIE_DOMAIN:-}
    cookie_secure: false
    cookie_http_only: true
    cookie_same_site: lax
    trusted_proxy_headers:
      - x-forwarded-for
      - x-real-ip
      - cf-connecting-ip
    ip:
      headers:
        - x-forwarded-for
        - x-real-ip
      disable_tracking: false
    intelligence:
      enabled: false
      detect_country_change: true
      geoip:
        enabled: false
        provider: ipwhois
        base_url: https://ipwho.is
        api_key_header: x-api-key
        timeout_ms: 2500
        cache_ttl_seconds: 86400

observability:
  metrics:
    enabled: true
    path: /metrics
    dashboard_enabled: true
    dashboard_path: /metrics/view
    prefix: athena_auth
  loki:
    enabled: false
    url: http://localhost:3100
    tenant_id: ""
    labels:
      service: athena-auth
      environment: docker
  logging:
    format: pretty
    wide_events: true
    environment: docker
    region: ""
    deployment_id: ""
    instance_id: ""
    commit_hash: ""

multitenancy:
  enabled: false
  header_name: x-athena-tenant
  default_tenant: default
  schema_mapping:
    users: users
    sessions: sessions
  tenants:
    default:
      database_url_env: DATABASE_URL
      search_path: athena
      schema_mapping:
        users: tenant_users

schema_detection:
  enabled: false
  auth_schema: ${ATHENA_AUTH_SCHEMA:-athena}
  write_mapping_file: false
  output_path: schema-mapping.generated.yaml
  min_column_match_ratio: 0.6
  table_substitutions:
    users:
      - user
    sessions:
      - session
    accounts:
      - account
    verifications:
      - verification
