server:
  port: 8050
  address: 127.0.0.1

# From where this API gatway can load roles of authenticated users?
# Look at the README file for details.
app:
  userRolesUrl: "http://localhost:8052/myservices/security/open/users/{username}/roles"

# logging:
#   level:
#     org.springframework.security: trace

spring:
  application:
    name: api-gateway

  cloud:
    gateway:
      server:
        webflux:
          globalcors:
            cors-configurations:
              '[/**]':
                allowedOrigins:
                  - "http://localhost:5173"
                allowedMethods: "*"
                allowedHeaders: "*"
                allowCredentials: true
          routes:
            # Frontend tries to access this URL when the login link is clicked.
            # If user is not logged in, user will be redirected to OAuth2 server.
            # If logged in, frontend will be reloaded.
            - id: frontend
              uri: no://op # CRITICAL: Prevents forwarding to a backend server
              predicates:
                - Path=/ui
              filters:
                - RedirectTo=302, http://localhost:5173/
            # Forward requests to backend service (OAuth2 resource server)
            - id: backend-service
              uri: http://localhost:8052
              predicates:
                - Path=/api/**
              filters:
                # 1. ALWAYS strip incoming spoof headers from the public web first
                - RemoveRequestHeader=X-User-Id
                - RemoveRequestHeader=X-User-Name
                - RemoveRequestHeader=X-User-Roles
                - RemoveRequestHeader=Authorization
                - PrefixPath=/myservices
                - TokenRelay # Add oauth (or jwt) token to request header before forwarding

  # Register this API gateway as an OAuth2 client with the OAuth2 authorization server
  security:
    oauth2:
      client:
        provider:
          platform-auth-server:
            issuer-uri: http://127.0.0.1:8051
        registration:
          api-gateway:
            provider: platform-auth-server
            client-id: api-gateway
            client-secret: "apiGatewayPassword1234"
            client-authentication-method: client_secret_basic
            authorization-grant-type: authorization_code
            redirect-uri: http://localhost:5173/bff/login/oauth2/code/api-gateway
            scope:
              - openid
              - profile

# Instead of coding a SecurityConfig class with OAuth2 configurations, com.c4-soft.springaddons dependency
# allows configuring some OAuth2 behaviour within this application.yaml file. This is just convenient.
com:
  c4-soft:
    springaddons:
      oidc:
        ops:
          - iss: http://127.0.0.1:8051
        client:
          client-uri: http://localhost:5173
          login-uri: /bff/oauth2/authorization/api-gateway
          security-matchers:
            - /**
          permit-all:
            - /login/**
            - /oauth2/**
            - /
            - /api/**
          csrf: cookie-accessible-from-js
          oauth2-redirections:
            rp-initiated-logout: ACCEPTED
          post-logout-redirect-host: http://localhost:5173
          post-logout-redirect-path: /