.env.auth.example

# ========================================
# Zeal Authorization Configuration
# ========================================

# Enable/Disable Authorization
# Set to 'true' to enable authorization checks
ZEAL_AUTH_ENABLED=false

# Secret key for HMAC token signing (required for SDK token generation)
# Generate a secure random key: openssl rand -base64 32
ZEAL_SECRET_KEY=your-secret-key-here-change-in-production

# Authorization Mode
# Options: 'development' | 'production'
# - development: Uses mock auth with configurable defaults
# - production: Validates tokens from external identity provider
ZEAL_AUTH_MODE=development

# ========================================
# Development Mode Settings
# ========================================

# Default user for development mode
ZEAL_DEV_USER_ID=dev-user
ZEAL_DEV_TENANT_ID=dev-tenant
ZEAL_DEV_ORG_ID=dev-org
ZEAL_DEV_ROLES=user,developer
ZEAL_DEV_PERMISSIONS=workflows.read,workflows.create,nodes.read

# Allow all requests in dev mode (bypasses policies)
ZEAL_DEV_ALLOW_ALL=false

# Mock token for development (optional)
# ZEAL_DEV_TOKEN=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

# ========================================
# External Identity Provider Configuration
# ========================================
# Zeal validates tokens from your identity provider
# but does NOT handle authentication/login flows

# Primary JWT Token Validation
# AUTH_JWT_ENABLED=true (enabled by default in production)
AUTH_JWT_ISSUER=https://your-identity-provider.com
AUTH_JWT_AUDIENCE=https://api.your-app.com

# Token validation method (choose one):
# Option 1: JWKS endpoint (recommended for rotating keys)
AUTH_JWT_JWKS_URI=https://your-identity-provider.com/.well-known/jwks.json

# Option 2: Static public key
# AUTH_JWT_PUBLIC_KEY=-----BEGIN PUBLIC KEY-----...

# JWT Validation Options
AUTH_JWT_ALGORITHMS=RS256,HS256
AUTH_JWT_CLOCK_TOLERANCE=5
AUTH_VALIDATE_CUSTOM_CLAIMS=false
# AUTH_REQUIRED_CLAIMS=sub,exp,iat

# Secondary JWT Provider (optional, for migration scenarios)
# AUTH_SECONDARY_JWT_ENABLED=false
# AUTH_SECONDARY_JWT_ISSUER=https://old-provider.com
# AUTH_SECONDARY_JWT_AUDIENCE=https://api.your-app.com
# AUTH_SECONDARY_JWT_JWKS_URI=https://old-provider.com/.well-known/jwks.json

# API Key Validation (for service accounts)
AUTH_API_KEY_ENABLED=false
# AUTH_API_KEY_VALIDATION_ENDPOINT=https://your-identity-provider.com/api/keys/validate
# AUTH_API_KEY_HEADER=X-API-Key
# AUTH_API_KEY_LOCAL=false
# AUTH_API_KEY_PREFIX=zeal_

# Custom Token Validation Endpoint (for proprietary systems)
# AUTH_CUSTOM_VALIDATION_ENDPOINT=https://your-auth-service.com/validate
# AUTH_CUSTOM_VALIDATION_METHOD=POST
# AUTH_CUSTOM_VALIDATION_HEADERS={"X-Service-Key":"secret"}

# ========================================
# Token Claim Mappings
# ========================================
# Map JWT claims from your identity provider to Zeal's authorization model

# Subject identification claims
AUTH_CLAIM_SUBJECT_ID=sub,user_id,userId
AUTH_CLAIM_SUBJECT_TYPE=type
AUTH_CLAIM_EMAIL=email
AUTH_CLAIM_NAME=name

# Multi-tenancy claims
AUTH_CLAIM_TENANT=tenant_id
AUTH_CLAIM_ORGANIZATION=org_id

# Authorization claims
AUTH_CLAIM_ROLES=roles
AUTH_CLAIM_PERMISSIONS=permissions
AUTH_CLAIM_SCOPES=scope

# Group/team membership
AUTH_CLAIM_TEAMS=teams
AUTH_CLAIM_GROUPS=groups

# Session/client claims
AUTH_CLAIM_SESSION_ID=sid
AUTH_CLAIM_CLIENT_ID=client_id

# Feature-specific claims (optional)
# Workflow claims
# AUTH_CLAIM_WORKFLOW_ACCESS=workflow.access
# AUTH_CLAIM_WORKFLOW_QUOTA=workflow.quota

# Node template claims
# AUTH_CLAIM_NODE_TEMPLATE_ACCESS=nodeTemplate.access
# AUTH_CLAIM_ALLOWED_NODE_TYPES=nodeTemplate.allowedTypes

# AI/Agent claims
# AUTH_CLAIM_AGENT_ID=agent.id
# AUTH_CLAIM_AGENT_PERMISSIONS=agent.permissions

# Compliance/verification claims
# AUTH_CLAIM_COMPLIANCE_LEVEL=compliance.level
# AUTH_CLAIM_VERIFICATION_STATUS=verification.status

# Custom claim mappings (format: key1:claim.path1,key2:claim.path2)
# AUTH_CUSTOM_CLAIM_MAPPINGS=department:user.dept,clearance:security.level

# ========================================
# Policy Storage Configuration
# ========================================

# Use the same database as workflows or a separate one
ZEAL_AUTH_USE_WORKFLOW_DB=true

# If using a separate database for policies
# ZEAL_AUTH_DB_URL=postgresql://user:password@localhost:5432/zeal_auth

# Schema configuration
ZEAL_AUTH_SCHEMA_NAME=zeal_auth
ZEAL_AUTH_SCHEMA_PER_TENANT=false
ZEAL_AUTH_ENABLE_RLS=true

# ========================================
# Hierarchy Configuration
# ========================================

# Enable organizational hierarchy from claims (teams, groups, etc.)
ZEAL_AUTH_HIERARCHY_ENABLED=false
ZEAL_AUTH_HIERARCHY_CACHE_TTL=300
ZEAL_AUTH_HIERARCHY_CACHE_SIZE=1000

# ========================================
# Authorization Policy Configuration
# ========================================
# Policies define what users can do with resources
# based on claims from the identity provider

# File-based policies
ZEAL_AUTH_POLICIES_PATH=./auth-policies.yaml
ZEAL_AUTH_POLICIES_FORMAT=yaml
ZEAL_AUTH_POLICIES_WATCH=true

# Database policies
ZEAL_AUTH_POLICIES_DB=false

# External policy service (optional)
# ZEAL_AUTH_POLICIES_API_URL=https://policy-service.example.com/policies
# ZEAL_AUTH_POLICIES_API_CACHE_TTL=300

# Policy evaluation
ZEAL_AUTH_POLICY_STRATEGY=priority
ZEAL_AUTH_DEFAULT_EFFECT=deny

# ========================================
# Cache Configuration
# ========================================

# Enable caching for authorization decisions
ZEAL_AUTH_CACHE_ENABLED=true
ZEAL_AUTH_CACHE_TTL=300

# Cache provider: 'memory' | 'redis'
ZEAL_AUTH_CACHE_PROVIDER=memory

# Redis cache settings
# ZEAL_AUTH_REDIS_URL=redis://localhost:6379
# ZEAL_AUTH_REDIS_PREFIX=zeal:auth:
# ZEAL_AUTH_CACHE_HASH=sha256

# ========================================
# Audit Configuration
# ========================================

# Enable audit logging
ZEAL_AUTH_AUDIT_ENABLED=false
ZEAL_AUTH_AUDIT_LEVEL=all

# File-based audit
ZEAL_AUTH_AUDIT_FILE=true
ZEAL_AUTH_AUDIT_FILE_PATH=./logs/auth-audit.log

# Database audit
ZEAL_AUTH_AUDIT_DB=false
ZEAL_AUTH_AUDIT_TABLE=audit_logs

# Syslog audit
ZEAL_AUTH_AUDIT_SYSLOG=false
ZEAL_AUTH_SYSLOG_HOST=localhost
ZEAL_AUTH_SYSLOG_PORT=514
ZEAL_AUTH_SYSLOG_FACILITY=local0

# Audit buffering
ZEAL_AUTH_AUDIT_BUFFER=false
ZEAL_AUTH_AUDIT_BUFFER_SIZE=100
ZEAL_AUTH_AUDIT_BUFFER_FLUSH=10

# Audit sampling (1.0 = 100%, 0.1 = 10%)
ZEAL_AUTH_AUDIT_SAMPLE_RATE=1.0