# ============================================================================
# OAuth Configuration
# ============================================================================
# Two configuration modes are supported:
#
# MODE 1 (Recommended): Discovery-Based Auto-Configuration
#   - Set CLIENT_ID, CLIENT_SECRET, and OIDC_ISSUER
#   - OAuth endpoints will be automatically populated from the OIDC discovery document
#   - Reduces manual configuration and potential errors
#   - Works with modern OAuth providers (Keycloak, Okta, Azure AD, PingOne, etc.)
#
# MODE 2: Manual Configuration (for legacy OAuth systems)
#   - Set CLIENT_ID, CLIENT_SECRET, and all endpoint variables manually
#   - Use when your OAuth provider doesn't support OIDC discovery
#   - All endpoint variables must be configured
# ============================================================================

# Enable/Disable Authentication
APPMOD_AUTH_ENABLED=false                                                # set to false to disable authentication

# ============================================================================
# REQUIRED: OAuth Client Credentials (both modes)
# ============================================================================
TA_AUTH_OIDC_CLIENT_ID=your-client-id                                   # OAuth2 client ID from your OAuth provider
TA_AUTH_OIDC_CLIENT_SECRET=your-client-secret                           # OAuth2 client secret from your OAuth provider

# Note: AMA_RBAC_ENABLED and AMA_AUDIT_ENABLED are automatically set when running Application Modernization Accelerator
# They are NOT set when running Transformation Advisor

# AMA_RBAC_ENABLED defaults to false for AMA
AMA_RBAC_ENABLED=false
# AMA_AUDIT_ENABLED defaults to false for AMA
AMA_AUDIT_ENABLED=false

# TA_AUTH_OIDC_CALLBACK_URI is required for OAuth login redirect handling.
# If left empty, installation will derive it from TA_PUBLIC_ACCESSIBLE_UI_URL
# after .env has been fully resolved.
TA_AUTH_OIDC_CALLBACK_URI=

# ============================================================================
# OPTIONAL: OIDC Issuer URL (enables auto-population - MODE 1)
# ============================================================================
# If set, the system will attempt to fetch the OIDC discovery document from:
#   {TA_AUTH_OIDC_ISSUER}/.well-known/openid-configuration
# and automatically populate all OAuth endpoint variables below.
#
# Examples:
#   Keycloak:       TA_AUTH_OIDC_ISSUER=https://keycloak.example.com/realms/myrealm
#   Okta:           TA_AUTH_OIDC_ISSUER=https://your-org.okta.com
#   Azure AD:       TA_AUTH_OIDC_ISSUER=https://login.microsoftonline.com/your-tenant-id/v2.0
#   PingOne:        TA_AUTH_OIDC_ISSUER=https://auth.pingone.com/your-env-id/as
#   PingFederate:   TA_AUTH_OIDC_ISSUER=https://pingfederate.example.com:9031
#
TA_AUTH_OIDC_ISSUER=https://your-oauth-server.com/realms/your-realm

# ============================================================================
# MANUAL ENDPOINT CONFIGURATION (MODE 2)
# ============================================================================
# These variables are OPTIONAL if TA_AUTH_OIDC_ISSUER is set and discovery succeeds.
# They are REQUIRED if:
#   - TA_AUTH_OIDC_ISSUER is not set, OR
#   - Your OAuth provider doesn't support OIDC discovery, OR
#   - You want to override auto-discovered values
#
# Uncomment and configure these variables for manual configuration:
# ============================================================================

#TA_AUTH_IDENTITY_REQUEST_ENDPOINT=https://account.example.com          # endpoint to request identity of the OAuth2 Server, no trailing /
#TA_AUTH_IDENTITY_REQUEST_ENDPOINT_PATH=/api/oauth2/authorize           # path of the endpoint to request identity to OAuth2 Server, with leading /
#TA_AUTH_IDENTITY_REQUEST_ENDPOINT_SCOPE=openid                         # OAuth2 scope
#TA_AUTH_CALLBACK_STATE_PREFIX_PADDING=                                 # some OAuth2 state requires minimum length, default to empty

#TA_AUTH_TOKEN_REQUEST_ENDPOINT=https://api.example.com                 # endpoint to request token of the OAuth2 Server, no trailing /
#TA_AUTH_TOKEN_REQUEST_ENDPOINT_PATH=/oauth2/token                      # path of the endpoint to request token of the OAuth2 Server, with leading /

#TA_AUTH_TOKEN_VERIFICATION_ENDPOINT=https://api.example.com            # endpoint to verify tokens of the OAuth2 Server, no trailing /
#TA_AUTH_TOKEN_VERIFICATION_ENDPOINT_PATH=/oauth2/userinfo              # path to the endpoint to verify tokens of the OAuth2 Server, with leading /

#TA_AUTH_TOKEN_REVOCATION_ENDPOINT=https://api.example.com              # endpoint to revoke tokens of the OAuth2 Server, no trailing /
#TA_AUTH_TOKEN_REVOCATION_ENDPOINT_PATH=/oauth2/revoke                  # path to the endpoint to revoke tokens of the OAuth2 Server, with leading /

#TA_AUTH_END_SESSION_ENDPOINT=https://api.example.com                   # endpoint to end session of the OAuth2 Server, no trailing /
#TA_AUTH_END_SESSION_ENDPOINT_PATH=/oauth2/logout                       # path to the endpoint to end session of the OAuth2 Server, with leading /

#TA_OCP_API_ENDPOINT=https://api.example.com                            # required only if the token revocation endpoint points to OpenShift Container Platform, no trailing /

# ============================================================================
# Security Keys (auto-generated if empty)
# ============================================================================
TA_API_KEY=                                                             # required for authentication and TLS, keep empty to auto-generate
TA_PRIVATE_KEY=                                                         # base64 encoded private key (PEM format), keep empty to auto-generate
TA_PUBLIC_KEY=                                                          # base64 encoded public key (CRT format), keep empty to auto-generate
TA_AES_IV=                                                              # AES IV (128 bits, hex), keep empty to auto-generate
TA_AES_KEY=                                                             # AES key (256 bits, hex), keep empty to auto-generate