#
# Copyright (c) 2018, 2025 Oracle and/or its affiliates.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# Security requires Helidon config

server:
  port: 7987
  # location on classpath (e.g. src/main/resources/WEB in maven)
  static.classpath:
    location: "/WEB"
    # this is optional, defaults to "/"
    context: "/web"
security:
  config.require-encryption: false
  properties:
    # This is a nice way to be able to override this with local properties or env-vars
    idcs-uri: "https://tenant-id.identity.oracle.com"
    idcs-client-id: "client-id"
    idcs-client-secret: "changeit"
    # Used as a base for redirects back to us
    frontend-uri: "http://localhost:7987"
    proxy-host: "if you need proxy"
  providers:
    - abac:
      # Adds ABAC Provider - it does not require any configuration
    - oidc:
        client-id: "${security.properties.idcs-client-id}"
        client-secret: "${security.properties.idcs-client-secret}"
        identity-uri: "${security.properties.idcs-uri}"
        # A prefix used for custom scopes
        scope-audience: "http://localhost:7987/test-application"
        proxy-host: "${security.properties.proxy-host}"
        frontend-uri: "${security.properties.frontend-uri}"
        # We want to redirect to login page (and token can be received either through cookie or header)
        redirect: true
    - idcs-role-mapper:
        multitenant: false
        oidc-config:
          # we must repeat IDCS configuration, as in this case
          # IDCS serves both as open ID connect authenticator and
          # as a role mapper. Using minimal configuration here
          client-id: "${security.properties.idcs-client-id}"
          client-secret: "${security.properties.idcs-client-secret}"
          identity-uri: "${security.properties.idcs-uri}"
  web-server:
    paths:
      - path: "/web/*"
        authenticate: true
      - path: "/service/*"
        authenticate: true
