'use strict';
// Example proxy secrets for the theta-env unified stack. Copy to
// ./config/proxy-secrets.js (NOT this file — ./config/ is gitignored) and edit.
// `./setup.sh` generates ./config/proxy-secrets.js for you on first run and the
// bootstrap writes the OAuth client clientId/clientSecret back into it; this
// file documents the shape for manual editing / reference.
//
// The proxy app reads this via @simpleworkjs/conf (docker-entrypoint.sh
// symlinks it to /app/conf/secrets.js). Never commit ./config/.

module.exports = {
	oidc: {
		enabled: true,
		issuer: 'https://sso.example.com',
		authorizationEndpoint: 'https://sso.example.com/oauth/authorize',
		// token/userinfo use the internal docker-network URL (no TLS hairpin):
		tokenEndpoint: 'http://sso-manager:3001/oauth/token',
		userinfoEndpoint: 'http://sso-manager:3001/oauth/userinfo',
		endSessionEndpoint: 'https://sso.example.com/oauth/logout',
		clientId: 'FILLED-IN-BY-BOOTSTRAP',      // leave as-is; bootstrap sets it
		clientSecret: 'FILLED-IN-BY-BOOTSTRAP',   // leave as-is; bootstrap sets it
		redirectUri: 'https://proxy.example.com/api/auth/oidc/callback',
		scopes: ['openid', 'profile', 'email', 'groups'],
		groupsClaim: 'groups',
		usernameClaim: 'preferred_username',
	},
	ldap: {
		// LDAPS over the docker network; the SSO's self-signed cert is trusted
		// via tlsOptions.rejectUnauthorized:false.
		url: 'ldaps://sso-manager:636',
		bindDN: 'cn=ldapclient,ou=people,dc=example,dc=com',
		// MUST equal serviceAccountPass in sso-secrets.js (the proxy binds as
		// that service account). setup.sh keeps them in sync on generation.
		bindPassword: 'CHANGE-ME',
		searchBase: 'ou=people,dc=example,dc=com',
		userFilter: '(objectClass=posixAccount)',
		userNameAttribute: 'uid',
		tlsOptions: { rejectUnauthorized: false },
	},
	auth: {
		adminGroups: ['app_sso_admin'],         // SSO group -> global proxy admin
		adminUsers: ['proxyadmin2'],            // local anti-lockout admin
		groupRoleMap: {},
	},
	stack: {
		ssoHost: 'sso.example.com',
		proxyHost: 'proxy.example.com',
	},
};