# yaml-language-server: $schema=../vendor/symfony/dependency-injection/Loader/schema/services.schema.json
parameters:
    keycloak.base_url: '%env(KEYCLOAK_BASE_URL)%'
    keycloak.realm: '%env(KEYCLOAK_REALM)%'
    keycloak.client_id: '%env(KEYCLOAK_CLIENT_ID)%'
    keycloak.client_secret: '%env(KEYCLOAK_CLIENT_SECRET)%'
    keycloak.redirect_uri: '%env(KEYCLOAK_REDIRECT_URI)%'
    keycloak.post_logout_redirect: '%env(KEYCLOAK_POST_LOGOUT_REDIRECT)%'

    # Allowlist of Appsmith apps this BFF will redirect back to. An app's
    # permissions are the Keycloak roles on the bff client sharing its
    # `role_prefix`; the prefix is stripped when they're reported to the app,
    # so `app-sandbox-write` becomes "write". Adding a permission means
    # creating the role in Keycloak — nothing to change here. `access_role`
    # is the single role required to enter the app at all.
    # Keep prefixes non-overlapping across apps, or roles bleed between them.
    # Add one entry per app you build. Never accept a return URL from the
    # request itself — always resolve through this map.
    appsmith.apps:
        app-sandbox:
            url: '%env(APP_SANDBOX_LOGIN_URL)%'
            role_prefix: 'app-sandbox-'
            access_role: 'app-sandbox-access'

    # Named backends the proxy can forward to. A request picks one via the
    # X-Backend header; omitting it uses "default". Add BACKEND_<KEY>_URL to
    # .env and one entry here per backend. Any app may call any backend key
    # — the backend is expected to do its own authorization off the roles
    # claim in the forwarded access token (see README).
    backends:
        default:
            url: '%env(BACKEND_BASE_URL)%'

services:
    _defaults:
        autowire: true
        autoconfigure: true
        bind:
            $kcBaseUrl: '%keycloak.base_url%'
            $kcRealm: '%keycloak.realm%'
            $kcClientId: '%keycloak.client_id%'
            $kcClientSecret: '%keycloak.client_secret%'
            $kcRedirectUri: '%keycloak.redirect_uri%'

    App\:
        resource: '../src/'
        exclude:
            - '../src/Kernel.php'

    App\Session\BffSessionStore:
        arguments:
            $cache: '@bff.session_cache'

    App\Security\AppRegistry:
        arguments:
            $apps: '%appsmith.apps%'

    App\Security\BackendRegistry:
        arguments:
            $backends: '%backends%'

    App\Controller\AuthController:
        arguments:
            $postLogoutRedirect: '%keycloak.post_logout_redirect%'