app:
  name: security-center
  environment: development
  version: 0.1.0

http:
  host: 0.0.0.0
  port: 8080
  read_timeout: 15s
  write_timeout: 15s
  shutdown_timeout: 10s
  allowed_origins:
    - http://localhost:3000
    - http://127.0.0.1:3000
    - http://localhost:3001
    - http://127.0.0.1:3001

log:
  level: info
  format: json

auth:
  bypass_sso: true
  dev_user:
    id: dev-user
    email: dev.user@example.com
    name: Development User
    roles:
      - admin

database:
  # Connection string can be overridden by SECURITY_CENTER_DATABASE_DSN env var
  dsn: "root:@tcp(127.0.0.1:3306)/security_center?parseTime=true"
  max_open_conns: 50
  max_idle_conns: 10
  conn_max_lifetime: 1h

redis:
  addr: "127.0.0.1:6379"
  # Password can be overridden by SECURITY_CENTER_REDIS_PASSWORD env var
  password: ""
  db: 0
  dial_timeout: 5s
  read_timeout: 2s
  write_timeout: 2s

secrets:
  # Provider can be "env", "aws_secrets_manager", etc.
  provider: "env"
  # Configuration for specific providers
  aws:
    region: "us-east-1"
    secret_prefix: "security-center/"

jwt:
  access_secret: changeme
  refresh_secret: changeme
  access_token_ttl: 24h
  refresh_token_ttl: 168h
  refresh_grace_period: 15m
  signing_algorithm: HS256
  issuer: security-center
  clock_skew_seconds: 60
  allow_insecure_secret: true

oauth:
  enabled: false
  provider: auth0 # auth0 | google
  # Auth0 settings (preferred)
  auth0_domain: your-tenant.auth0.com
  auth0_client_id: your-auth0-client-id
  auth0_client_secret: your-auth0-client-secret
  auth0_audience: https://api.security-center.local
  # Google settings (legacy / migration)
  google_client_id: your-google-client-id
  google_client_secret: your-google-client-secret
  # Legacy keys for backward compatibility (used if google_* values are empty)
  client_id: your-google-client-id
  client_secret: your-google-client-secret
  redirect_url: http://localhost:3000/auth/callback # frontend callback page exchanges code via /api/v1/auth/<provider>/callback
  scopes:
    - openid
    - profile
    - email
  bypass_provider: true  # Set to true to skip real OAuth in development
  bypass_google: true    # Legacy flag; treated the same as bypass_provider

storage:
  provider: s3
  s3:
    enabled: false                       # set true to enable S3 uploads
    bucket: "your-bucket-name"           # e.g., security-center-uploads
    region: "us-east-1"                  # falls back to AWS_REGION env var
    access_key_id: ""                    # optional, otherwise uses env/instance role
    secret_access_key: ""                # optional, otherwise uses env/instance role
    endpoint: ""                         # optional custom endpoint (for S3-compatible)
    public_endpoint: ""                  # optional: sign presigned URLs with this externally reachable endpoint (e.g., http://localhost:19000 for local MinIO); empty = sign with endpoint
    use_path_style: false                # true for MinIO/compat endpoints
    base_url: ""                         # optional public base URL override (e.g., https://cdn.example.com)
    upload_prefix: "vuln-uploads/"       # prefix for uploaded files
    presign_ttl: 15m                     # validity of presigned PUT URL

agent:
  enabled: true
  key_prefix: "sk-agent-"
  allow_permanent_key: false   # 生产必须 false
  quota_enabled: false         # Phase 3 开启
  default_quota_rpm: 0