# OxiCloud test-server env file for the SSO-only auto-redirect test.
#
# Used by BOTH runners on port 8090 / IdP 1081:
#   * tests/oidc/run-sso-only.sh — automated, drives Hurl assertions
#     (server-side /login 302 + RP-initiated logout post_logout_url shape).
#   * tests/oidc/run-manual-sso-only.sh — human-run browser eyeball to
#     confirm zero login-form flash before the redirect fires.
#
# What makes it "SSO-only":
#   * OXICLOUD_AUTH_METHODS=oidc — allowlist is [Oidc] only. Password
#     and magic-link are both hard-off at the deployment level; the
#     fail-fast validator in config.rs refuses to boot if `oidc` is in
#     the list without OXICLOUD_OIDC_ENABLED=true (or vice versa in a
#     future major).
#   * OXICLOUD_AUTH_POLICIES=auto_redirect_if_standalone_oidc — the
#     policy switch that makes GET /login return a server-side 302 to
#     /api/auth/oidc/authorize BEFORE the SPA loads (no form flash).
#     Interception lives in src/interfaces/web/mod.rs.
#
# Distinct ports (8090 / IdP 1081) so it doesn't collide with a
# concurrently running `just api-test` (which uses 8087 / IdP 1080) or a
# local `cargo run` dev server.
#
# `--config` makes the binary read THIS file verbatim — there is no
# auto-merge with server.env, so every variable the server needs has
# to be repeated here (same rationale as server-with-oidc.env).

# ── Shared test config (mirrors server.env) ────────────────────────────────
DATABASE_URL=postgres://oxicloud_test:oxicloud_test@localhost:5433/oxicloud_test
OXICLOUD_DB_CONNECTION_STRING=postgres://oxicloud_test:oxicloud_test@localhost:5433/oxicloud_test
OXICLOUD_STATIC_PATH=./static
OXICLOUD_JWT_SECRET=test-secret-do-not-use-in-prod-minimum-32-chars
OXICLOUD_ENABLE_AUTH=true
OXICLOUD_ENABLE_TRASH=true
OXICLOUD_ENABLE_SEARCH=true
OXICLOUD_ENABLE_FILE_SHARING=true
OXICLOUD_ENABLE_MUSIC=true
OXICLOUD_EXPOSE_SYSTEM_USERS=true
OXICLOUD_WOPI_ENABLED=false
OXICLOUD_NEXTCLOUD_ENABLED=true

RUST_LOG="warn,audit=info,oxicloud::infrastructure::services::oidc_service=info,oxicloud::application::services::auth_application_service=info"

OXICLOUD_RATE_LIMIT_REFRESH_MAX=3600
OXICLOUD_RATE_LIMIT_LOGIN_MAX=3600
OXICLOUD_RATE_LIMIT_REGISTER_MAX=3600
OXICLOUD_TRUST_PROXY_CIDR=0.0.0.0/0

# Mock SMTP — kept wired even though magic-link login is disabled under the
# OIDC master rule, so the invite/mail transport doesn't 503 unconfigured.
OXICLOUD_SMTP_MOCK=true
OXICLOUD_SMTP_HOST=localhost
OXICLOUD_SMTP_PORT=25
OXICLOUD_SMTP_FROM='OxiCloud Tests <test@oxicloud.local>'
OXICLOUD_SMTP_TLS=none
OXICLOUD_ALLOW_EXTERNAL_USERS=true

# ── OIDC client wired at the fake-idp sidecar (SSO-only) ───────────────────
# tests/oidc/fake_idp/server.js (panva/node-oidc-provider) publishes the
# issuer at the root URL; discovery is at /.well-known/openid-configuration
# under it. Update the `clients[0].client_id` field there in tandem if you
# rename the client.
OXICLOUD_OIDC_ENABLED=true
OXICLOUD_OIDC_ISSUER_URL=http://localhost:1081
OXICLOUD_OIDC_CLIENT_ID=oxicloud-test
OXICLOUD_OIDC_CLIENT_SECRET=test-client-secret-not-used-in-prod
# The IdP redirects back to this exact URL after auto-approving; must
# match the OxiCloud server's actual host + port.
OXICLOUD_OIDC_REDIRECT_URI=http://localhost:8090/api/auth/oidc/callback
OXICLOUD_OIDC_SCOPES="openid profile email"
# Frontend redirect target after a successful callback. The backend
# appends `/login?oidc_code=…` to this base, so the value here is the
# SPA origin only.
OXICLOUD_OIDC_FRONTEND_URL=http://localhost:8090
OXICLOUD_OIDC_AUTO_PROVISION=true
OXICLOUD_OIDC_PROVIDER_NAME=MockSSO-Only
# Group-to-role mapping — same fake-idp claim shape as server-with-oidc.env.
OXICLOUD_OIDC_ADMIN_GROUPS=admin-users

# Modern SSO-only mechanism (preferred over legacy
# OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true, which still works but is a
# per-flag toggle instead of the composable allowlist below).
#
# AUTH_METHODS=oidc restricts the effective allowlist to [Oidc]. Password
# and magic-link both refuse at the endpoint layer. Combined with the
# OIDC master rule (magic-link hard-off whenever OIDC is enabled) this
# closes every non-SSO login path.
OXICLOUD_AUTH_METHODS=oidc

# AUTH_POLICIES: additive switches to auth behavior. The
# auto_redirect_if_standalone_oidc token makes GET /login return a 302
# to /api/auth/oidc/authorize (server-side, via web-layer middleware) so
# the SPA never renders. Loop-guards are built in — a Location or
# ?error= query on /login falls through to the SPA shell.
OXICLOUD_AUTH_POLICIES=auto_redirect_if_standalone_oidc

OXICLOUD_REQUIRE_VERIFIED_EMAIL=false