# Control Center Security Configuration Fragment
# JWT, RBAC, MFA, rate limiting

[[elements]]
border_top = true
border_bottom = false
name = "security_section_header"
title = "🔐 Security Configuration"
type = "section_header"

# JWT Configuration
[[elements]]
border_top = false
default = true
help = "Enable JWT authentication"
name = "jwt_enabled"
nickel_path = ["security", "jwt", "enabled"]
prompt = "Enable JWT Authentication"
type = "confirm"

[[elements]]
condition = "jwt_enabled == true"
default = "control-center"
help = "JWT token issuer identifier"
name = "jwt_issuer"
nickel_path = ["security", "jwt", "issuer"]
prompt = "JWT Issuer"
required = true
type = "text"

[[elements]]
condition = "jwt_enabled == true"
default = "provisioning"
help = "JWT token audience identifier"
name = "jwt_audience"
nickel_path = ["security", "jwt", "audience"]
prompt = "JWT Audience"
required = true
type = "text"

[[elements]]
condition = "jwt_enabled == true"
default = 3600
help = "JWT token expiration time in seconds (range: ${constraint.control_center.jwt.token_expiration.min}-${constraint.control_center.jwt.token_expiration.max})"
max = "${constraint.control_center.jwt.token_expiration.max}"
min = "${constraint.control_center.jwt.token_expiration.min}"
name = "jwt_token_expiration"
nickel_path = ["security", "jwt", "token_expiration"]
prompt = "Token Expiration (seconds)"
type = "number"

[[elements]]
condition = "jwt_enabled == true"
default = 86400
help = "JWT refresh token expiration time in seconds (range: ${constraint.control_center.jwt.refresh_expiration.min}-${constraint.control_center.jwt.refresh_expiration.max})"
max = "${constraint.control_center.jwt.refresh_expiration.max}"
min = "${constraint.control_center.jwt.refresh_expiration.min}"
name = "jwt_refresh_expiration"
nickel_path = ["security", "jwt", "refresh_expiration"]
prompt = "Refresh Token Expiration (seconds)"
type = "number"

[[elements]]
condition = "jwt_enabled == true"
default = "HS256"
help = "JWT signing method (HS256, RS256, ES256)"
name = "jwt_signing_method"
nickel_path = ["security", "jwt", "signing_method"]
options = ["HS256", "RS256", "ES256"]
prompt = "Signing Method"
type = "select"

# RBAC Configuration
[[elements]]
default = true
help = "Enable Role-Based Access Control"
name = "rbac_enabled"
nickel_path = ["security", "rbac", "enabled"]
prompt = "Enable RBAC"
type = "confirm"

[[elements]]
condition = "rbac_enabled == true"
default = true
help = "Enable role hierarchy/inheritance"
name = "rbac_hierarchy"
nickel_path = ["security", "rbac", "hierarchy"]
prompt = "Enable Role Hierarchy"
type = "confirm"

# MFA Configuration
[[elements]]
default = false
help = "Enable Multi-Factor Authentication"
name = "mfa_enabled"
nickel_path = ["security", "mfa", "enabled"]
prompt = "Enable MFA"
type = "confirm"

[[elements]]
condition = "mfa_enabled == true"
default = false
help = "Require MFA for all users"
name = "mfa_required"
nickel_path = ["security", "mfa", "required"]
prompt = "Require MFA for All Users"
type = "confirm"

# Rate Limiting
[[elements]]
default = false
help = "Enable API rate limiting"
name = "rate_limiting_enabled"
nickel_path = ["security", "rate_limiting", "enabled"]
prompt = "Enable Rate Limiting"
type = "confirm"

[[elements]]
condition = "rate_limiting_enabled == true"
default = 1000
help = "Maximum API requests per time window (range: ${constraint.control_center.rate_limiting.max_requests.min}-${constraint.control_center.rate_limiting.max_requests.max})"
max = "${constraint.control_center.rate_limiting.max_requests.max}"
min = "${constraint.control_center.rate_limiting.max_requests.min}"
name = "rate_limiting_max_requests"
nickel_path = ["security", "rate_limiting", "max_requests"]
prompt = "Max Requests per Window"
type = "number"

[[elements]]
condition = "rate_limiting_enabled == true"
default = 60
help = "Time window in seconds (range: ${constraint.control_center.rate_limiting.window_seconds.min}-${constraint.control_center.rate_limiting.window_seconds.max})"
max = "${constraint.control_center.rate_limiting.window_seconds.max}"
min = "${constraint.control_center.rate_limiting.window_seconds.min}"
name = "rate_limiting_window"
nickel_path = ["security", "rate_limiting", "window_seconds"]
prompt = "Rate Limit Window (seconds)"
type = "number"

# TLS Configuration
[[elements]]
default = false
help = "Enable TLS/SSL encryption"
name = "tls_enabled"
nickel_path = ["security", "tls", "enabled"]
prompt = "Enable TLS/SSL"
type = "confirm"

# Session Management
[[elements]]
default = true
help = "Enable session management"
name = "sessions_enabled"
nickel_path = ["security", "sessions", "enabled"]
prompt = "Enable Sessions"
type = "confirm"

[[elements]]
condition = "sessions_enabled == true"
default = 86400
help = "Session max age in seconds"
min = 300
name = "sessions_max_age"
nickel_path = ["security", "sessions", "max_age"]
prompt = "Session Max Age (seconds)"
type = "number"

[[elements]]
condition = "sessions_enabled == true"
default = true
help = "Set secure flag on session cookies"
name = "sessions_secure"
nickel_path = ["security", "sessions", "secure"]
prompt = "Secure Cookies"
type = "confirm"

[[elements]]
condition = "sessions_enabled == true"
default = true
help = "Set HttpOnly flag on session cookies"
name = "sessions_http_only"
nickel_path = ["security", "sessions", "http_only"]
prompt = "HttpOnly Cookies"
type = "confirm"
