# =============================================================================
# AutoSSO Configuration File
# =============================================================================
# This is an example configuration file for the AutoSSO multi-cloud IAM SSO
# permission automation management system.
#
# Copy this file to config.yaml and update the values according to your
# environment. Sensitive values (credentials, secrets) can be provided via
# environment variables which will override the values in this file.
#
# Environment variable format: ${ENV_VAR_NAME}
# =============================================================================

# -----------------------------------------------------------------------------
# Feishu (Lark) Integration Configuration
# -----------------------------------------------------------------------------
# Configuration for Feishu API integration, including authentication and
# approval workflow settings.
#
# Requirements: 2.1, 2.8
feishu:
  # Feishu application ID
  # Can be overridden by FEISHU_APP_ID environment variable
  app_id: "${FEISHU_APP_ID}"

  # Feishu application secret
  # Can be overridden by FEISHU_APP_SECRET environment variable
  app_secret: "${FEISHU_APP_SECRET}"

  # Approval flow definition code (from Feishu admin console)
  # This is the unique identifier for the SSO permission approval workflow
  approval_code: "81762D1E-68FE-4448-89C4-5F14288778C8"

  # Feishu group chat ID for sending notifications
  # Notifications about permission changes will be sent to this group
  chat_id: "oc_948d6d39be192f1b75ef2e218f2b0707"

  # Feishu API base URL
  # Default: https://open.feishu.cn
  # For Lark (international version), use: https://open.larksuite.com
  base_url: "https://open.feishu.cn"

  # ---------------------------------------------------------------------------
  # Form Field Mappings (Optional)
  # ---------------------------------------------------------------------------
  # Configure custom keywords for parsing approval form fields.
  # If not specified, built-in default keywords are used.
  #
  # field_mappings:
  #   # Keywords to identify email fields
  #   email:
  #     - "applicant email"
  #     - "employee email"
  #     - "user email"
  #
  #   # Keywords to identify application type fields
  #   app_type:
  #     - "application type"
  #     - "request type"
  #
  #   # Account field keywords by cloud platform
  #   account:
  #     alibaba: ["alibaba account", "alibaba cloud"]
  #     aws: ["aws account", "production account"]
  #     gcp: ["gcp project", "gcp account"]
  #     azure: ["azure subscription", "azure account"]
  #     default: ["account selection"]  # Fallback keywords
  #
  #   # Permission/role field keywords by cloud platform
  #   permission:
  #     alibaba: ["alibaba sso role", "alibaba role"]
  #     aws: ["aws sso role", "aws permission"]
  #     gcp: ["gcp role"]
  #     azure: ["azure role"]
  #     default: ["sso role", "permission"]
  #
  #   # Start time field keywords
  #   start_time:
  #     - "start time"
  #     - "begin time"
  #     - "effective from"
  #
  #   # End time field keywords
  #   end_time:
  #     - "end time"
  #     - "expire time"
  #     - "valid until"
  #
  #   # Description field keywords
  #   description:
  #     - "reason"
  #     - "description"
  #     - "justification"
  #
  #   # Keywords for detecting cloud platform type from form fields
  #   cloud_detection:
  #     gcp: ["gcp account", "gcp project"]
  #     azure: ["azure subscription", "azure account"]
  #     alibaba: ["alibaba account", "alibaba cloud"]
  #
  #   # Keywords to identify SSO application types
  #   sso_type_keywords:
  #     - "sso"
  #     - "production account application"
  #     - "temporary access"
  #
  #   # Default cloud type when no specific cloud is detected
  #   # Options: AWS, GCP, Azure, Alibaba
  #   default_cloud_type: "AWS"
  #
  #   # Custom date format strings for parsing time fields
  #   # Uses Go time format (reference time: 2006-01-02T15:04:05Z07:00)
  #   date_formats:
  #     - "2006-01-02T15:04:05Z07:00"
  #     - "2006-01-02 15:04:05"
  #     - "2006-01-02"

# -----------------------------------------------------------------------------
# Database Configuration
# -----------------------------------------------------------------------------
# MySQL database connection settings for storing approval instances,
# pending removals, and permission state.
#
# Requirements: 2.4
database:
  # Database server hostname
  # Default: 127.0.0.1
  host: "127.0.0.1"

  # Database server port
  # Default: 3306
  port: 3306

  # Database username
  # Can be overridden by DB_USER environment variable
  user: "${DB_USER}"

  # Database password
  # Can be overridden by DB_PASSWORD environment variable
  password: "${DB_PASSWORD}"

  # Database name
  # Default: security
  database: "security"

  # Maximum number of open connections to the database
  # Adjust based on your workload and database server capacity
  # Default: 10
  max_open_conns: 10

  # Maximum number of idle connections in the connection pool
  # Should be less than or equal to max_open_conns
  # Default: 5
  max_idle_conns: 5

  # Maximum lifetime of a database connection
  # Connections older than this will be closed and replaced
  # Format: duration string (e.g., "1h", "30m", "1h30m")
  # Default: 1h
  max_lifetime: "1h"

# -----------------------------------------------------------------------------
# Cloud Providers Configuration
# -----------------------------------------------------------------------------
# Configuration for each supported cloud platform provider.
# Each provider section contains credentials and account mappings.
#
# Requirements: 2.2, 2.3, 2.5, 2.6, 2.7
providers:
  # ---------------------------------------------------------------------------
  # AWS SSO (IAM Identity Center) Configuration
  # ---------------------------------------------------------------------------
  # Requirements: 2.5, 2.6
  aws:
    # ARN of the IAM Identity Center instance
    # Format: arn:aws:sso:::instance/ssoins-XXXXXXXXXX
    identity_center_arn: "arn:aws:sso:::instance/ssoins-7758e707bb6ea352"

    # Identity Store ID associated with the IAM Identity Center
    # Format: d-XXXXXXXXXX
    identity_store_id: "d-95670a3c83"

    # AWS region for SSO operations
    # Default: ap-northeast-1
    region: "ap-northeast-1"

    # List of AWS accounts managed by this system
    # Each account should have a unique ID and descriptive name
    accounts:
      - id: "557537366020"
        name: "prod-main"
        type: "prod"
      - id: "380838443567"
        name: "prod-secondary"
        type: "prod"
      # Add more AWS accounts as needed
      # - id: "123456789012"
      #   name: "dev-account"
      #   type: "dev"

  # ---------------------------------------------------------------------------
  # Google Cloud Platform (GCP) Configuration
  # ---------------------------------------------------------------------------
  # Requirements: 2.6, 2.7
  gcp:
    # Path to the GCP service account JSON credentials file
    # This service account should have permissions to manage IAM roles
    credentials_file: "./config/user.json"

    # Path to the GCP role mapping INI file
    # This file defines custom role mappings for GCP projects
    role_mapping_file: "./config/gcp_custom_role.ini"

    # List of GCP projects managed by this system
    projects:
      - id: "tidbcloud-prod-000"
        name: "tidbcloud-prod-000"
        type: "prod"
      - id: "dbaas-prod"
        name: "dbaas-prod"
        type: "prod"
      # Add more GCP projects as needed
      # - id: "my-project-dev"
      #   name: "my-project-dev"
      #   type: "dev"

  # ---------------------------------------------------------------------------
  # Microsoft Azure Configuration
  # ---------------------------------------------------------------------------
  # Requirements: 2.2, 2.6
  azure:
    # Azure AD tenant ID
    # Can be overridden by AZURE_TENANT_ID environment variable
    tenant_id: "${AZURE_TENANT_ID}"

    # Azure AD application (client) ID
    # Can be overridden by AZURE_CLIENT_ID environment variable
    client_id: "${AZURE_CLIENT_ID}"

    # Azure AD application client secret
    # Can be overridden by AZURE_CLIENT_SECRET environment variable
    client_secret: "${AZURE_CLIENT_SECRET}"

    # List of Azure subscriptions managed by this system
    # role_suffix is used for Azure role name suffix mapping
    subscriptions:
      - id: "ad881159-0593-4502-96e4-e2698b790a3d"
        name: "tidb-dedicated-prod-controlplane"
        type: "prod"
        role_suffix: ""
      - id: "efe59dff-e62f-4356-b93d-de124c967a1f"
        name: "tidb-dedicated-prod-dataplane-000"
        type: "prod"
        role_suffix: "-0"
      - id: "01f5d24b-a99c-45e1-a3e2-5ddc1e5bb71d"
        name: "tidb-o11y"
        type: "prod"
        role_suffix: "-o11y"
      # Add more Azure subscriptions as needed
      # - id: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
      #   name: "dev-subscription"
      #   type: "dev"
      #   role_suffix: "-dev"

  # ---------------------------------------------------------------------------
  # Alibaba Cloud Configuration
  # ---------------------------------------------------------------------------
  # Requirements: 2.3, 2.6
  alibaba:
    # Authentication type
    # Supported values:
    #   - access_key: AccessKey/SecretKey authentication (default)
    #   - ecs_ram_role: ECS instance RAM role authentication
    #   - ram_role_arn: RAM role ARN with STS token
    #   - oidc_role_arn: OIDC-based role authentication (for Kubernetes)
    # Default: access_key
    auth_type: "access_key"

    # -------------------------------------------------------------------------
    # Option 1: AccessKey/SecretKey Authentication (auth_type: access_key)
    # -------------------------------------------------------------------------
    # Alibaba Cloud access key ID
    # Can be overridden by ALIBABA_ACCESS_KEY_ID environment variable
    access_key_id: "${ALIBABA_ACCESS_KEY_ID}"

    # Alibaba Cloud access key secret
    # Can be overridden by ALIBABA_ACCESS_KEY_SECRET environment variable
    access_key_secret: "${ALIBABA_ACCESS_KEY_SECRET}"

    # -------------------------------------------------------------------------
    # Option 2: ECS RAM Role Authentication (auth_type: ecs_ram_role)
    # -------------------------------------------------------------------------
    # When running on ECS, the instance can assume this role automatically
    # No AccessKey/SecretKey needed
    # role_name: "AutoSSORole"

    # -------------------------------------------------------------------------
    # Option 3: RAM Role ARN Authentication (auth_type: ram_role_arn)
    # -------------------------------------------------------------------------
    # Use AccessKey/SecretKey to assume a RAM role
    # Useful for cross-account access or temporary credentials
    # role_arn: "acs:ram::1234567890:role/AutoSSORole"
    # role_session_name: "autosso-session"  # Optional, default: autosso-session

    # -------------------------------------------------------------------------
    # Option 4: OIDC Role Authentication (auth_type: oidc_role_arn)
    # -------------------------------------------------------------------------
    # For Kubernetes environments with service account tokens
    # role_arn: "acs:ram::1234567890:role/AutoSSORole"
    # oidc_provider_arn: "acs:ram::1234567890:oidc-provider/kubernetes"
    # oidc_token_file: "/var/run/secrets/tokens/alibaba-token"
    # role_session_name: "autosso-session"  # Optional

    # Cloud SSO directory ID
    # Format: d-XXXXXXXXXXXX
    directory_id: "d-00ts1z0rjv32"

    # Cloud SSO API endpoint
    # Default: cloudsso.cn-shanghai.aliyuncs.com
    # Use the endpoint closest to your region for better performance
    endpoint: "cloudsso.cn-shanghai.aliyuncs.com"

    # List of Alibaba Cloud accounts managed by this system
    accounts:
      - id: "5480039859161595"
        name: "alibaba-prod-1"
        type: "prod"
      - id: "5108739859105002"
        name: "alibaba-prod-2"
        type: "prod"
      # Add more Alibaba Cloud accounts as needed
      # - id: "1234567890123456"
      #   name: "alibaba-dev"
      #   type: "dev"

# -----------------------------------------------------------------------------
# Runtime Configuration
# -----------------------------------------------------------------------------
# Settings that control the runtime behavior of the AutoSSO system.
#
# Requirements: 9.4
runtime:
  # Interval for polling new approval instances from Feishu
  # Format: duration string (e.g., "5s", "1m", "30s")
  # Default: 5s
  poll_interval: "5s"

  # Interval for checking expired permissions
  # Format: duration string (e.g., "1h", "30m", "2h")
  # Default: 1h
  expire_check_interval: "1h"

  # Number of days to wait before revoking expired permissions
  # Users will receive expiration reminders during this grace period
  # Default: 3
  grace_period_days: 3

  # Timeout for HTTP requests to external APIs (Feishu, cloud providers)
  # Format: duration string (e.g., "10s", "30s", "1m")
  # Default: 10s
  http_timeout: "10s"

  # Maximum number of retry attempts for failed API operations
  # Uses exponential backoff between retries
  # Default: 3
  max_retries: 3

  # Logging level
  # Valid values: debug, info, warn, error
  # Default: info
  log_level: "info"

  # List of email addresses that should not have their permissions
  # automatically revoked (e.g., security team members)
  # These users will still receive expiration notifications
  whitelist_emails:
    - "security@example.com"
    # Add more whitelisted emails as needed
    # - "admin@example.com"
    # - "oncall@example.com"

# -----------------------------------------------------------------------------
# Permission Mappings (AWS)
# -----------------------------------------------------------------------------
# Mapping between Feishu permission names (as shown in approval forms)
# and actual AWS cloud platform permission/role names.
# This replaces the hardcoded Convert_Feishu_Permission function logic.
#
# Requirements: 9.6
permission_mappings:
  # ViewOnly role - read-only access to production resources
  - feishu_name: "viewonly"
    real_name: "DBaaS-Prod-ViewOnly-Role"

  # OnCall role - elevated access for on-call engineers
  - feishu_name: "oncall"
    real_name: "DBaaS-Prod-OnCall-Role"

  # OnCall BastionEC2 role - on-call access with bastion EC2 permissions
  - feishu_name: "oncall-bastionec2"
    real_name: "BaaS-Prod-OnCall-BastionEC2-Role"

  # Billing role - access to billing and cost management
  - feishu_name: "billing"
    real_name: "DBaaS-Prod-Billing-Role"

  # Prod Admin role - administrative access to production
  - feishu_name: "prod-admin"
    real_name: "DBaaS-Prod-Admin-Role"

  # Security role - security administration access
  - feishu_name: "security"
    real_name: "PingCAP-SecurityAdmin-Role"

  # Prod EC2 role - EC2 instance management in production
  - feishu_name: "prod-ec2"
    real_name: "DBaaS-Prod-EC2-Role"

  # DevUser role - developer access
  - feishu_name: "devuser"
    real_name: "DBaaS-DevUser-Role"

  # Prod Web role - web service access in production
  - feishu_name: "prod-web"
    real_name: "DBaaS-Prod-Web-Role"

  # OrgOperator role - organization operator access
  - feishu_name: "orgoperator"
    real_name: "DBaaS-Prod-OrgOperator-Role"

  # TiFlow Engine RDS role - TiFlow engine RDS access
  - feishu_name: "tiflow-engine-rds"
    real_name: "Prod-Tiflow-Engine-RDS"

  # DevLeader role - development team leader access
  - feishu_name: "devleader"
    real_name: "DBaaS-DevLeader-Role"

  # Prod Support role - production support access
  - feishu_name: "prod-support-role"
    real_name: "DBaaS-Prod-Support-Role"

  # Add more permission mappings as needed
  # - feishu_name: "developer"
  #   real_name: "DBaaS-Dev-Developer-Role"
  # - feishu_name: "readonly"
  #   real_name: "DBaaS-Prod-ReadOnly-Role"

# -----------------------------------------------------------------------------
# GCP Role Mappings
# -----------------------------------------------------------------------------
# Mapping between custom role names (as shown in Feishu approval forms)
# and actual GCP IAM roles. Each custom role can map to multiple GCP roles.
# This replaces the gcp_custom_role.ini file configuration.
#
# Requirements: 9.6, 10.4
gcp_role_mappings:
  # Example: DBaaS-Prod-ViewOnly-Role maps to multiple GCP viewer roles
  # - custom_role: "DBaaS-Prod-ViewOnly-Role"
  #   gcp_roles:
  #     - "roles/viewer"
  #     - "roles/logging.viewer"
  #     - "roles/monitoring.viewer"

  # Example: DBaaS-Prod-Admin-Role maps to multiple GCP admin roles
  # - custom_role: "DBaaS-Prod-Admin-Role"
  #   gcp_roles:
  #     - "roles/editor"
  #     - "roles/iam.securityAdmin"

  # Example: DBaaS-Prod-Security-Role maps to security-related GCP roles
  # - custom_role: "DBaaS-Prod-Security-Role"
  #   gcp_roles:
  #     - "roles/iam.securityAdmin"
  #     - "roles/securitycenter.admin"
  #     - "roles/logging.admin"

  # Add your GCP role mappings here based on your gcp_custom_role.ini file
  # Each entry should have:
  #   - custom_role: The custom role name used in Feishu approval forms
  #   - gcp_roles: List of actual GCP IAM roles to assign