app:
  name: security-center
  environment: development
  version: 0.1.0

http:
  host: 0.0.0.0
  port: 8080
  read_timeout: 15s
  write_timeout: 15s
  shutdown_timeout: 10s
  allowed_origins:
    - http://localhost:3000
    - http://127.0.0.1:3000
    - http://localhost:3001
    - http://127.0.0.1:3001
  # Override with SECURITY_CENTER_HTTP_ALLOWED_ORIGINS or SC_ALLOWED_ORIGINS
  # Example: http://localhost:3000,http://127.0.0.1:3000,http://localhost:3001,http://127.0.0.1:3001

log:
  level: info
  format: json

auth:
  bypass_sso: true # set to false in production
  dev_user:
    id: dev-user
    email: dev.user@example.com
    name: Development User
    roles:
      - admin

database:
  dsn: ""
  max_open_conns: 50
  max_idle_conns: 10
  conn_max_lifetime: 1h

redis:
  addr: ""
  password: ""
  db: 0
  dial_timeout: 5s
  read_timeout: 2s
  write_timeout: 2s

jwt:
  access_secret: changeme
  refresh_secret: changeme
  access_token_ttl: 24h
  refresh_token_ttl: 168h
  refresh_grace_period: 15m
  signing_algorithm: HS256
  issuer: security-center
  clock_skew_seconds: 60
  allow_insecure_secret: true

oauth:
  enabled: false
  provider: auth0 # auth0 | google
  # Auth0 settings (preferred)
  auth0_domain: your-tenant.auth0.com
  auth0_client_id: your-auth0-client-id
  auth0_client_secret: your-auth0-client-secret
  auth0_audience: https://api.security-center.example.com
  # Google settings (legacy / migration)
  google_client_id: your-google-client-id
  google_client_secret: your-google-client-secret
  # Legacy keys for backward compatibility (used if google_* values are empty)
  client_id: your-google-client-id
  client_secret: your-google-client-secret
  redirect_url: http://localhost:3000/auth/callback # frontend callback page exchanges code via /api/v1/auth/<provider>/callback
  scopes:
    - openid
    - profile
    - email
  bypass_provider: false  # Set to true to skip real OAuth in development
  bypass_google: false    # Legacy flag; treated the same as bypass_provider

scan:
  scanner:
    enabled: false
    base_url: ""
    api_token: ""
    callback_token: ""
    timeout: 10s
    user_agent: security-center-scan-client
    max_targets_per_batch: 1000
    max_campaign_targets: 50000
    campaign_submit_concurrency: 2
    campaign_dispatcher_interval: 5s
    allow_non_public_targets: false

agent:
  enabled: true
  key_prefix: "sk-agent-"
  allow_permanent_key: false   # 生产必须 false
  quota_enabled: false         # Phase 3 开启
  default_quota_rpm: 0

audit:
  retention_days: 90           # audit_logs 保留天数; <=0 时按 90 兜底