variables:
    USER_DATABASE_EXCEL: $GRAMEXDATA/apps/guide/auth.xlsx
    USER_DATABASE_URL: sqlite:///$GRAMEXDATA/apps/guide/auth.db
    USER_DATABASE_TABLE: users
    USER_DATABASE_USERCOLUMN: user
    USER_DATABASE_PASSWORDCOLUMN: password
    USER_DATABASE_SALT: abc

url:
    auth/logout:
        pattern: /$YAMLURL/logout
        handler: LogoutHandler
        kwargs:
            log:
                fields: [session.id, current_user.email, request.remote_ip, request.headers.User-Agent]

    auth/simple:
        pattern: /$YAMLURL/simple
        handler: SimpleAuth
        kwargs:
            template: $YAMLPATH/simple.html     # This has the login form
            credentials:
                alpha: alpha                    # User: alpha has password: alpha
                beta: beta                      # Similarly for beta
            redirect:
                query: next
                header: Referer
                url: /$YAMLURL

    auth/ajax:
        pattern: /$YAMLURL/ajax
        handler: FileHandler
        kwargs:
            path: $YAMLPATH/ajax.html
            template: true

    auth/google:
        pattern: /$YAMLURL/google
        handler: GoogleAuth
        kwargs:
            # Credentials for s.anand/gramex-guide
            # https://console.developers.google.com/apis/credentials/oauthclient/817932882244-gdr59t3mpqh5554d1bgdjuh38g6a7ahh.apps.googleusercontent.com?project=gramex-guide
            # callback: /auth/google on localhost:9988/, localhost:9999/, learn.gramener.com/guide/
            key: 817932882244-gdr59t3mpqh5554d1bgdjuh38g6a7ahh.apps.googleusercontent.com
            secret: lwArXkw21KCqDPuJrel-WeQO
            # Scope list: https://developers.google.com/identity/protocols/googlescopes
            scope:
                - https://www.googleapis.com/auth/contacts.readonly
                - https://www.googleapis.com/auth/gmail.readonly
                - https://www.googleapis.com/auth/calendar.readonly
                - https://www.googleapis.com/auth/drive.readonly
                - https://www.googleapis.com/auth/spreadsheets.readonly
                - https://www.googleapis.com/auth/cloud-translation
            log:
                fields: [session.id, current_user.email, request.remote_ip, request.headers.User-Agent]
            redirect:
                query: next
                header: Referer
                url: /$YAMLURL

    auth/contacts:
        pattern: /$YAMLURL/contacts
        handler: FunctionHandler
        kwargs:
            function: authutil.contacts
            headers:
                Content-Type: application/json

    auth/facebook:
        pattern: /$YAMLURL/facebook
        handler: FacebookAuth
        kwargs:
            # Test app (localhost:9988): https://developers.facebook.com/apps/794214110679951/settings/
            # key: '794214110679951'
            # secret: 'a026887ed94aef25f2f637bf154349df'

            # Production app: https://developers.facebook.com/apps/163328100435225/settings/
            key: '163328100435225'
            secret: 'c71c7e17d5a16ce7662ec75858e9631f'
            log:
                fields: [session.id, current_user.name, request.remote_ip, request.headers.User-Agent]
            redirect:
                query: next
                header: Referer
                url: /$YAMLURL

    auth/twitter:
        pattern: /$YAMLURL/twitter
        handler: TwitterAuth
        kwargs:
            # Test app (127.0.0.1:9988): https://apps.twitter.com/app/12449610/keys
            # key: XkCVNZD5sfWECxHGAGnlHGQFa
            # secret: yU00bx5dHYMbge9IyO5H1KeC5uFnWndntG7u6CH6O4HDZHQg0p

            # Production app: https://apps.twitter.com/app/9510381/keys
            key: 5Ab9olPCo8OA8S1R2BY29FAxB
            secret: BgRPCvxaQsYU3QivHvrthwQA1vwDr22UQDLuUK8egqvgUid1md
            log:
                fields: [session.id, current_user.username, request.remote_ip, request.headers.User-Agent]
            redirect:
                query: next
                header: Referer
                url: /$YAMLURL

    auth/ldap:
        pattern: /$YAMLURL/ldap                 # Map this URL
        handler: LDAPAuth                       # to the LDAP auth handler
        kwargs:
            template: $YAMLPATH/ldap.html       # This has the login form
            host: ipa.demo1.freeipa.org         # Server to connect to
            use_ssl: true                       # Whether to use SSL or not
            user: 'uid={user},cn=users,cn=accounts,dc=demo1,dc=freeipa,dc=org'
            password: '{password}'
            log:
                fields: [session.id, current_user.dn, request.remote_ip, request.headers.User-Agent]
            action:
                function: ensure_single_session
            redirect:
                query: next
                header: Referer
                url: /$YAMLURL
                external: true

    auth/ldap-bind:
        pattern: /$YAMLURL/ldap-bind            # Map this URL
        handler: LDAPAuth                       # to the LDAP auth handler
        kwargs:
            template: $YAMLPATH/ldap.html       # This has the login form
            host: ipa.demo1.freeipa.org         # Server to connect to
            use_ssl: true                       # Whether to use SSL or not
            bind:                               # Bind to the server with this ID/password
                user: 'uid=admin,cn=users,cn=accounts,dc=demo1,dc=freeipa,dc=org'
                password: 'Secret123'
            search:
                base: 'dc=demo1,dc=freeipa,dc=org'  # Search within this domain
                filter: '(mail={user})'             # by email ID, rather than uid
                password: '{password}'              # Use the password field as password
            log:
                fields: [session.id, current_user.dn, request.remote_ip, request.headers.User-Agent]
            action:
                function: ensure_single_session
            redirect:
                query: next
                header: Referer
                url: /$YAMLURL
                external: true

    auth/ldap2:
        pattern: /$YAMLURL/ldap2
        handler: LDAPAuth
        kwargs:
            template: $YAMLPATH/ldap.html
            host: ldap.forumsys.com
            use_ssl: false
            user: 'uid={user},dc=example,dc=com'
            password: '{password}'
            redirect:
                query: next
                header: Referer
                url: /$YAMLURL
                external: true

    auth/dbsimple:
        pattern: /$YAMLURL/dbsimple           # Map this URL
        handler: DBAuth                       # to the DBAuth handler
        kwargs:
            url: $USER_DATABASE_EXCEL
            user:
                column: $USER_DATABASE_USERCOLUMN
            password:
                column: $USER_DATABASE_PASSWORDCOLUMN
                function: passlib.hash.sha256_crypt.encrypt(content, salt="$USER_DATABASE_SALT")
            redirect:
                query: next
                header: Referer
                url: /$YAMLURL/

    auth/db:
        pattern: /$YAMLURL/db
        handler: DBAuth
        kwargs:
            # This is created by schedule.create-user-database
            url: $USER_DATABASE_URL
            table: $USER_DATABASE_TABLE
            template: $YAMLPATH/db.html
            user:
                column: $USER_DATABASE_USERCOLUMN
                arg: user
            password:
                column: $USER_DATABASE_PASSWORDCOLUMN
                arg: password
                function: passlib.hash.sha256_crypt.encrypt(content, salt="$USER_DATABASE_SALT")
            forgot:
                email_from: gramex-guide-auth     # Name of the email service to use for sending emails
                key: forgot                       # ?forgot= is used as the forgot password parameter
                arg: email                        # ?email= is used to submit the email ID of the user
                minutes_to_expiry: 15             # Minutes after which the link will expire
                email_column: email               # The database column that contains the email ID
                email_subject: Gramex forgot password       # Subject of the email
                email_as: "Gramex Guide <gramex.guide@gmail.com>"   # Emails will be sent as if from this ID
                email_text: |
                    This is an email from Gramex guide.
                    You clicked on the forgot password like for user {user}.
                    Visit this link to reset the password: {reset_url}
            signup: true
                # key: signup
                # validate: authutil.signup_validate(handler, args)
            redirect:
                query: next
                header: Referer
                url: /$YAMLURL

    auth/user:
        pattern: /$YAMLURL/user
        handler: FunctionHandler
        kwargs:
            function: json.dumps(handler.session['user'])
            kwargs:
                indent: 4
            headers:
                Content-Type: application/json

    auth/session:
        pattern: /$YAMLURL/session
        handler: FunctionHandler
        kwargs:
            function: authutil.store_value
            headers:
                Content-Type: application/json

    auth/must-login:
        pattern: /$YAMLURL/must-login
        handler: FileHandler
        kwargs:
            path: $YAMLPATH/secret.html
            auth: true

    auth/dotcom:
        pattern: /$YAMLURL/dotcom
        handler: FileHandler
        kwargs:
            path: $YAMLPATH/secret.html
            auth:
                condition:                          # Allow only if condition is true
                    function: handler.current_user.email.endswith('.com')
    auth/dotorg:
        pattern: /$YAMLURL/dotorg
        handler: FileHandler
        kwargs:
            path: $YAMLPATH/secret.html
            auth:
                condition:                          # Allow only if condition is true
                    function: handler.current_user.email.endswith('.org')

    auth/en-male:
        pattern: /$YAMLURL/en-male
        handler: FileHandler
        kwargs:
            path: $YAMLPATH/secret.html
            auth:
                membership:           # The following user object keys must match
                    gender: male      # user.gender must be male
                    locale: [en, es]  # user.locale must be en or es

    auth/use-simple:
        pattern: /$YAMLURL/use-simple
        handler: FileHandler
        kwargs:
            path: $YAMLPATH/secret.html
            auth:
                login_url: /$YAMLURL/simple

    auth/expiry:
        pattern: /$YAMLURL/expiry
        handler: SimpleAuth
        kwargs:
            session_expiry: 0.0003          # Session expires in 26 seconds
            credentials: {alpha: alpha}
            template: $YAMLPATH/expiry.html # Use this login template for the demo
            redirect: /$YAMLURL/expiry

    auth/inactive:
        pattern: /$YAMLURL/inactive
        handler: SimpleAuth
        kwargs:
            session_inactive: 0.00003         # Must visit every 2.6 seconds
            credentials: {alpha: alpha}
            template: $YAMLPATH/inactive.html # Use this login template for the demo
            redirect: /$YAMLURL/inactive

    auth/customexpiry:
        pattern: /$YAMLURL/customexpiry
        handler: SimpleAuth
        kwargs:
            session_expiry:
              default: 1          # the default session expiry is set to 1 day
              key: remember       # When ?remember= is submitted on login
              values:             # if ?remember=...
                  sec: 0.000115   # 10 seconds
                  min: 0.0007     # 60.48 seconds
                  day: 1          # ...day, it expires in 1 day
                  week: 7         # ...week, it expires in 7 days
                  month: 31       # ...month, it expires in 31 days
                  "on": 31        # If ?remember=on, expire after 31 days (checkbox)
            credentials: {alpha: alpha, beta: beta}
            template: $YAMLPATH/customexpiry.html   # Use this login template for the demo
            redirect: /$YAMLURL/customexpiry

    auth/otp:
        pattern: /$YAMLURL/otp
        handler: FileHandler
        kwargs:
            path: $YAMLPATH/otp.html
            template: true
            headers:
              Cache-Control: no-cache

    auth/unauthorized-template:
        pattern: /$YAMLURL/unauthorized-template
        handler: FileHandler
        kwargs:
            path: $YAMLPATH/secret.html
            auth:
                membership:                     # Pick an unlikely condition to test template
                    donkey: king                # This condition will usually be false
                template: $YAMLPATH/403-template.html   # Render template for forbidden users

    auth/gitlab:
        pattern: /$YAMLURL/gitlab
        handler: OAuth2
        kwargs:
          # https://code.gramener.com/admin/applications/3
          client_id: 'cc177f42cf432a7e961c317bd9e784b08d2bc27a2028b0487ee53732ea3a4ddf'
          client_secret: '00186a6c4c8bb77b3f961b158fb5e4b49738b7efdfbe61b8d19285d66149f8b9'
          authorize:
            url: 'https://code.gramener.com/oauth/authorize'
          access_token:
            url: 'https://code.gramener.com/oauth/token'
            body:
              grant_type: 'authorization_code'
          user_info:
            url: 'https://code.gramener.com/api/v4/user'
            headers:
              Authorization: 'Bearer {access_token}'
          redirect:
              query: next
              header: Referer
              url: /$YAMLURL

    auth/github:
      pattern: /$YAMLURL/github
      handler: OAuth2
      kwargs:
        # https://github.com/settings/connections/applications/a4ffb7fd2c4b05e04457
        client_id: a4ffb7fd2c4b05e04457
        client_secret: 198a4ec063bac3dfe01136368184930f8aa93a4a
        authorize:
          url: https://github.com/login/oauth/authorize
          scope: [repo, gist, user]
        access_token:
          url: https://github.com/login/oauth/access_token
        user_info:
          url: https://api.github.com/user
          headers:
            Authorization: 'token {access_token}'
          redirect:
              query: next
              header: Referer
              url: /$YAMLURL

      auth/googleoauth2:
        pattern: /$YAMLPATH/googleoauth2
        handler: OAuth2
        kwargs:
          client_id: 817932882244-gdr59t3mpqh5554d1bgdjuh38g6a7ahh.apps.googleusercontent.com
          client_secret: lwArXkw21KCqDPuJrel-WeQO
          authorize:
            url: https://accounts.google.com/o/oauth2/auth
            scope:
              - profile
              - email
          access_token:
            url: https://accounts.google.com/o/oauth2/token
            body:
              grant_type: authorization_code
          user_info:
            url: https://www.googleapis.com/oauth2/v1/userinfo
            headers:
              Authorization: 'Bearer {access_token}'

    auth/lookup-attributes:
        pattern: /$YAMLURL/lookup-attributes
        handler: SimpleAuth
        kwargs:
            template: $YAMLPATH/simple.html
            credentials:
                alpha: alpha
                beta: beta
            lookup:
                url: $YAMLPATH/lookup.xlsx      # Add attributes from Excel file
                id: user                        # by lookup up the 'id' in the 'user' column
            redirect:
                query: next
                header: Referer
                url: /$YAMLURL

    auth/sms:
        pattern: /$YAMLURL/sms
        handler: SMSAuth
        kwargs:
          service: exotel
          message: 'This is a test message being sent using Exotel with a (%s) and (00000). If this is being abused, report to 08088919888'
          redirect:
              query: next
              header: Referer
              url: /$YAMLURL

    auth/email:
        pattern: /$YAMLURL/email
        handler: EmailAuth
        kwargs:
          service: gramex-guide-auth
          subject: 'OTP for Gramex Guide'
          body: 'The OTP for {user} is {password}. Visit {link}'
          redirect:
              query: next
              header: Referer
              url: /$YAMLURL

schedule:
    create-user-database:
        function: authutil.create_user_database     # Run this function
        kwargs:                                     # Pass the following parameters
            url: $USER_DATABASE_URL
            table: $USER_DATABASE_TABLE
            user: $USER_DATABASE_USERCOLUMN
            password: $USER_DATABASE_PASSWORDCOLUMN
            salt: $USER_DATABASE_SALT
            excel: $USER_DATABASE_EXCEL
        startup: true

import:
  auth/apps:
    path: '*/gramex.yaml'
    namespace: [url, schedule, cache, import]

email:
    gramex-guide-auth:
        type: gmail
        email: gramex.guide@gmail.com       # Generic email ID used to test e-mails
        password: tlpmupxnhucitpte          # App-specific password created for Gramex guide

sms:
  exotel:
    # See https://my.exotel.com/gramener2/settings/site#api-settings
    type: exotel
    sid: gramener2
    token: 13f359bf07b9882cea149547960a11536e2a3ad6
