'use strict';
// Example SSO secrets for the theta-env unified stack. Copy to
// ./config/sso-secrets.js (NOT this file — ./config/ is gitignored) and edit.
// `./setup.sh` generates ./config/sso-secrets.js for you on first run; this file
// documents the shape for manual editing / reference.
//
// The SSO app reads this via @simpleworkjs/conf (docker-entrypoint.sh sets
// CONF_SECRETS to point at it). The app ignores the extra stack/bootstrap/
// serviceAccountPass keys (read by the orchestrator). Back this up off-host —
// it holds all SSO secrets. Never commit ./config/.

module.exports = {
	name: 'SSO Manager',                       // shown in UI + outbound email
	ldap: {
		url: 'ldap://localhost:389',           // the bundled slapd (in-container)
		bindDN: 'cn=admin,dc=example,dc=com',   // slapd root DN
		bindPassword: 'CHANGE-ME',             // slapd root + app bind password
		userBase: 'ou=people,dc=example,dc=com',
		groupBase: 'ou=groups,dc=example,dc=com',
		// ldapsHost: 'ldap.internal.example.com', // optional: internal-only hostname
		// shown on /integrations for direct LDAPS binds. Empty -> derive from issuer.
		// ldapsPort: 636,
	},
	smtp: {                                   // optional; leave host '' to skip
		host: '', port: 587, secure: false,
		user: '', pass: '', from: '',
	},
	oauth: {
		issuer: 'https://sso.example.com',     // browser-facing SSO URL
		jwtSecret: 'CHANGE-ME',                 // signs all tokens — keep secret
		token_lifetime: { access_token: 3600, refresh_token: 2592000 },
	},
	// Without this, @simpleworkjs/orm falls back to './config/inventory.sqlite'
	// (relative to the app's /app cwd) -- inside the container's ephemeral
	// layer, not any mounted volume, so every Resource/site/host/service/oauth
	// row (the whole Directory Management page) would be silently wiped on
	// every container recreate. /data is already a persisted volume (Redis
	// lives there too), so this just co-locates the sqlite file with it.
	orm: {
		dialect: 'sqlite',
		storage: '/data/inventory.sqlite',
	},

	// ── Orchestrator-only (ignored by the app; read by setup.sh + bootstrap) ──
	stack: {
		ldapBaseDn: 'dc=example,dc=com',       // slapd suffix (drives seed OUs)
		ldapDomain: 'example.com',             // default cert CN + issuer host
		ldapCertCn: '',                         // cert CN; '' -> defaults to ldapDomain
		ssoHost: 'sso.example.com',            // public SSO hostname
		proxyHost: 'proxy.example.com',         // public proxy hostname
	},
	bootstrap: {
		adminUid: 'admin',                     // first SSO admin username
		adminPass: 'CHANGE-ME',                // first SSO admin password
		adminEmail: 'admin@proxy.example.com', // first SSO admin email
	},
	serviceAccountPass: 'CHANGE-ME',         // LDAP password the proxy binds with
};