Security

[auth.gateway]
type = "api_key"

[auth.gateway.api_key]
header_name = "X-API-Key"         # Header to check (or "Authorization")
key_prefix = "gw_"                # Required prefix for all keys
hash_algorithm = "sha256"         # "sha256" or "argon2"
cache_ttl_secs = 60               # Cache valid keys for 60 seconds

# Using X-API-Key header
curl -H "X-API-Key: gw_live_abc123..." https://gateway/v1/chat/completions

# Using Authorization header (OpenAI-compatible)
curl -H "Authorization: Bearer gw_live_abc123..." https://gateway/v1/chat/completions

[auth.gateway]
type = "jwt"

[auth.gateway.jwt]
issuer = "https://auth.example.com"
audience = ["api", "gateway"]             # Single value or array
jwks_url = "https://auth.example.com/.well-known/jwks.json"
jwks_refresh_secs = 3600                  # Refresh JWKS every hour
identity_claim = "sub"                    # Claim for user identity
org_claim = "org_ids"                     # Optional: organization membership
allowed_algorithms = ["RS256", "ES256"]   # Algorithm allowlist

[auth.admin]
type = "oidc"

[auth.admin.oidc]
issuer = "https://auth.example.com"
client_id = "hadrian"
client_secret = "${OIDC_CLIENT_SECRET}"
redirect_uri = "https://gateway.example.com/auth/callback"
scopes = ["openid", "email", "profile", "groups"]

# Claim mapping
identity_claim = "sub"              # User identity
org_claim = "org_ids"               # Organization membership
groups_claim = "groups"             # Group membership

# Session settings
[auth.admin.oidc.session]
cookie_name = "__gw_session"
duration_secs = 604800              # 7 days
secure = true                       # HTTPS only
same_site = "lax"                   # CSRF protection

[auth.admin.oidc.session]
store = "cache"                     # Use Redis cache for sessions

[server]
trusted_proxies = ["10.0.0.1", "10.0.0.2", "192.168.1.0/24"]

[auth.admin]
type = "proxy_auth"

[auth.admin.proxy_auth]
identity_header = "CF-Access-Authenticated-User-Email"
email_header = "X-Forwarded-Email"
name_header = "X-Forwarded-Name"
groups_header = "X-Forwarded-Groups"    # Comma-separated or JSON array
require_identity = true

# Optional: Also validate JWT assertion from proxy
[auth.admin.proxy_auth.jwt_assertion]
header = "CF-Access-JWT-Assertion"
jwks_url = "https://your-team.cloudflareaccess.com/cdn-cgi/access/certs"
issuer = "https://your-team.cloudflareaccess.com"
audience = "your-application-audience"

[auth.gateway]
type = "multi"

[auth.gateway.api_key]
header_name = "X-API-Key"
key_prefix = "gw_"

[auth.gateway.jwt]
issuer = "https://auth.example.com"
audience = "api"
jwks_url = "https://auth.example.com/.well-known/jwks.json"

# Try API key first, fall back to JWT
order = ["api_key", "jwt"]

[auth.rbac]
enabled = true
default_effect = "deny"           # "allow" or "deny" when no policy matches
role_claim = "roles"              # JWT claim containing roles
org_claim = "org_ids"             # Organization membership claim
team_claim = "team_ids"           # Team membership claim
project_claim = "project_ids"     # Project membership claim

# Map IdP role names to internal names
[auth.rbac.role_mapping]
"Administrator" = "admin"
"Developer" = "member"
"Viewer" = "readonly"

[[auth.rbac.policies]]
name = "admin-full-access"
description = "Admins can do anything"
resource = "*"                    # Matches all resources
action = "*"                      # Matches all actions
effect = "allow"
priority = 100
condition = "'admin' in subject.roles"

[[auth.rbac.policies]]
name = "org-member-read"
description = "Organization members can read their org's resources"
resource = "organization"
action = "read"
effect = "allow"
priority = 50
condition = "context.org_id != null && context.org_id in subject.org_ids"

[[auth.rbac.policies]]
name = "deny-self-delete"
description = "Users cannot delete themselves"
resource = "user"
action = "delete"
effect = "deny"
priority = 200                    # High priority deny
condition = "subject.user_id == context.resource_id"

// Role-based access
"admin" in subject.roles;

// Multiple roles (OR)
"super_admin" in subject.roles || "admin" in subject.roles;

// Organization membership
context.org_id != null && context.org_id in subject.org_ids;

// Cross-org isolation (single org users)
subject.org_ids.size() == 1 && context.org_id in subject.org_ids;

// Email domain restriction
subject.email != null && subject.email.endsWith("@company.com");

// Resource ownership
context.resource_id == subject.user_id;

// Team lead access within team
context.team_id != null && context.team_id in subject.team_ids && "team_lead" in subject.roles;

// Project member access
context.project_id != null && context.project_id in subject.project_ids;

[auth.rbac.audit]
log_allowed = false               # Only log denials by default
log_denied = true                 # Always log authorization failures

[features.file_processing]
max_file_size_mb = 10  # Default: 10 MB

[features.file_processing.virus_scan]
enabled = true
backend = "clamav"

[features.file_processing.virus_scan.clamav]
host = "localhost"
port = 3310
timeout_ms = 30000

[features.file_processing]
max_file_size_mb = 10
mode = "queue"

[features.file_processing.virus_scan]
enabled = true
backend = "clamav"

[features.file_processing.virus_scan.clamav]
host = "clamav"
port = 3310

[features.guardrails]
enabled = true

[features.guardrails.input]
enabled = true
mode = "blocking"

[features.guardrails.input.provider]
type = "openai_moderation"

# Environment variables
api_key = "${OPENAI_API_KEY}"
client_secret = "${OIDC_CLIENT_SECRET}"

# Or use HashiCorp Vault
[secrets.vault]
address = "https://vault.example.com"
mount_path = "secret"
secret_path = "hadrian/gateway"