# Meguri instance configuration. The process refuses to start without it (MEGURI_CONFIG_FILE).
# This file is the only place that defines workspaces and which identity-provider groups give
# which role; there is no UI or API for either. The OIDC client secret is NOT stored here: set
# MEGURI_OIDC_CLIENT_SECRET in the deployment secret store.
#
# Applied by the migrate Job (or a single process without MEGURI_SKIP_MIGRATIONS) at every release.
# Unknown fields and invalid values are rejected at startup.

auth:
  # Lets ordinary password accounts (created by an instance administrator) sign in.
  # Keep false in production where everyone signs in through SSO.
  password_login: false

  # Break-glass instance administrators. Omit this whole block in production; add it only to get
  # back in when SSO is broken, then remove it again. While present, the generated password is
  # written to the log of the process that synchronized the configuration (the migrate Job), and
  # anyone who can read that log can sign in as an instance administrator. The password is derived
  # from a database-held secret, the username and the current UTC hour; it rotates every hour.
  # bootstrap_admin:
  #   usernames: [rescue]

# OpenID Connect provider. Confidential client, authorization-code flow with PKCE.
# Redirect URI to register: {MEGURI_PUBLIC_URL}/api/oidc/callback
oidc:
  issuer: https://sso.example.internal/realms/corp   # HTTPS; discovery is read from <issuer>/.well-known/openid-configuration
  client_id: meguri
  scopes: [openid, profile, email]                   # default; must include openid; email links people planned by email
  # Where the groups are. A dotted path into the token claims (for example realm_access.roles).
  # Keycloak: add a "Group Membership" mapper with this claim name, "Add to ID token" and
  # "Add to userinfo" on. Matching below is by exact string, so "Full group path" decides
  # whether values look like /payments/leads or leads.
  groups_claim: groups
  groups_sources: [id_token, userinfo]               # searched in this order

# Groups whose members are instance administrators: they see and may act in every enabled
# workspace, manage password users and delete disabled workspaces. Not tied to any workspace.
instance_admin_groups:
  - /meguri/admins

# Workspaces. `key` is the permanent identifier (3-64 characters: a-z, 0-9, hyphen); never reuse
# it for something else. `name` is unique and is what people see; changing it renames the
# workspace. A workspace that exists without a key and has exactly this name is adopted.
# Removing an entry here DISABLES the workspace (nobody can open it, nothing is published, data is
# kept); listing it again re-enables it. Deleting it for good is a manual action on the
# instance administrator's page.
workspaces:
  - key: payments
    name: Payments
    # Workspace administrators (team leads): every permission in this workspace only. At least one group.
    admin_groups:
      - /payments/leads
    # Employees: the workspace's employee permission set, by default calendar, schedule editing
    # and replacement requests. Administrators change that set in the workspace settings.
    member_groups:
      - /payments/team

  - key: customer-support
    name: Customer Support
    admin_groups:
      - /support/leads
    member_groups:
      - /support/team
      - /support/contractors