# JWT authentication configuration fragment
# Conditional: when auth_method == "jwt"

[[elements]]
help = "Secret key for signing JWT tokens (min 8 characters, use strong random string)"
name = "jwt_secret"
nickel_path = ["provisioning", "security", "auth", "jwt", "secret"]
placeholder = "your-secret-key-here"
prompt = "JWT secret key"
required = true
type = "password"
when = "auth_method == jwt"

[[elements]]
default = "HS256"
help = "Algorithm for signing JWT tokens"
name = "jwt_algorithm"
nickel_path = ["provisioning", "security", "auth", "jwt", "algorithm"]
options = ["HS256", "HS384", "HS512", "RS256", "RS384", "RS512"]
prompt = "JWT signing algorithm"
required = true
type = "select"
when = "auth_method == jwt"

[[elements]]
custom_type = "u32"
default = "3600"
help = "JWT token expiration time in seconds (300-86400)"
maximum = "86400"
minimum = "300"
name = "jwt_expiry_seconds"
nickel_path = ["provisioning", "security", "auth", "jwt", "expiry_seconds"]
prompt = "Token expiry (seconds)"
required = true
type = "custom"
when = "auth_method == jwt"

[[elements]]
help = "Issuer claim for JWT tokens (e.g., 'my-api')"
name = "jwt_issuer"
nickel_path = ["provisioning", "security", "auth", "jwt", "issuer"]
placeholder = "my-api"
prompt = "JWT issuer"
required = false
type = "text"
when = "auth_method == jwt"
