{{- define "deploykf-auth.oauth2-proxy.cfg" }}
## tcp address to listen on
http_address = "0.0.0.0:4180"

## serve a static HTTP 200 upstream on for authentication success
## (this is because we are using oauth2-proxy as an ExtAuthz to "check" each request, not pass it on)
upstreams = [
  "static://200"
]

## requests to paths matching these regex patterns will receive a 401 Unauthorized response
## when not authenticated, instead of being redirected to the login page with a 302
## (prevents background requests being redirected to the login page, and the accumulation of CSRF cookies)
api_routes = [
  ## Generic
  ## NOTE: included because most background requests contain these paths
  "/api/",
  "/apis/",

  ## Kubeflow Pipelines
  ## NOTE: included because KFP UI makes MANY background requests to these paths but because they are
  ##       not `application/json` requests, oauth2-proxy will redirect them to the login page
  "^/ml_metadata",
]

################
## branding
################
custom_sign_in_logo = "/custom-theme/logo.svg"
banner = "-"
footer = "-"

################
## proxy
################
reverse_proxy = true
real_client_ip_header = "X-Forwarded-For"

################
## logging
################
logging_filename = ""
logging_max_size = 100
logging_max_age = 7
standard_logging = true
request_logging = true
auth_logging = true

################
## upstream headers (to dex)
################
## pass headers: `Authorization`
pass_authorization_header = false

## pass headers: HTTP Basic Auth, `X-Forwarded-User`, `X-Forwarded-Email`
pass_basic_auth = false

## pass headers: `X-Forwarded-User`, `X-Forwarded-Groups`, `X-Forwarded-Email`, `X-Forwarded-Preferred-Username`
pass_user_headers = false

## pass headers: `Host`
pass_host_header = true

################
## response headers (to EnvoyFilter)
################
## set headers: `Authorization`
set_authorization_header = true

## set headers: `X-Auth-Request-User`, `X-Auth-Request-Groups`, `X-Auth-Request-Email`, `X-Auth-Request-Preferred-Username`
set_xauthrequest = true

################
## provider
################
provider = "oidc"
provider_display_name = "Dex"

client_id = {{ .Values.oauth2Proxy.oidc.clientId | quote }}
{{- if not .Values.oauth2Proxy.oidc.clientSecret.existingSecret }}
client_secret = {{ .Values.oauth2Proxy.oidc.clientSecret.value | quote }}
{{- end }}

oidc_email_claim = "email"
oidc_groups_claim = "groups"

## specify the list of scopes to request
## NOTE: offline_access enables refresh tokens (but not all dex connectors support it, notably SAML 2.0)
##       https://dexidp.io/docs/custom-scopes-claims-clients/
##       https://dexidp.io/docs/connectors/
scope = "openid email groups profile offline_access"

{{ if .Values.deployKF.gateway.tls.clientsUseHttps -}}
oidc_issuer_url = "https://{{ .Values.deployKF_helpers.deploykf_gateway.https_endpoint }}/dex"
redirect_url = "https://{{ .Values.deployKF_helpers.deploykf_gateway.https_endpoint }}/oauth2/callback"
{{- else }}
oidc_issuer_url = "http://{{ .Values.deployKF_helpers.deploykf_gateway.http_endpoint }}/dex"
redirect_url = "http://{{ .Values.deployKF_helpers.deploykf_gateway.http_endpoint }}/oauth2/callback"
{{- end }}

email_domains = ["*"]

## if false, a sign-in page is shown before redirecting to dex
{{- if .Values.oauth2Proxy.enableSignInPage }}
skip_provider_button = false
{{- else }}
skip_provider_button = true
{{- end }}

## oauth2-proxy sends "force" by default, which causes dex to always prompt for login
## https://github.com/dexidp/dex/pull/3086
prompt = "none"

## oauth2-proxy does not verify nonce claim by default
insecure_oidc_skip_nonce = false

## use PKCE code challenges
code_challenge_method = "S256"

################
## bearer token
################

## allow bearer tokens to be used for authentication
skip_jwt_bearer_tokens = true

## trust audience claims used by other known dex clients
oidc_extra_audiences = [
  {{- if .Values.dex.clients.kubeflowPipelinesSDK.enabled }}
  {{ .Values.dex.clients.kubeflowPipelinesSDK.clientId | quote }}
  {{- end }}
]

################
## cookie
################
{{- /* we prepend "__Secure-" to the cookie name for secure connections */ -}}
{{- $cookie_name := .Values.oauth2Proxy.cookie.name }}
{{- if .Values.deployKF.gateway.tls.clientsUseHttps }}
{{- $cookie_name = print "__Secure-" ($cookie_name | trimPrefix "__Secure-") }}
{{- end }}
cookie_name = {{ $cookie_name | quote }}
cookie_path = "/"
cookie_domains = []
cookie_expire = {{ .Values.oauth2Proxy.cookie.expire | quote }}
cookie_refresh = {{ .Values.oauth2Proxy.cookie.refresh | quote }}
{{- if .Values.deployKF.gateway.tls.clientsUseHttps }}
cookie_secure = true
{{- else }}
cookie_secure = false
{{- end }}
cookie_httponly = true
cookie_samesite = "lax"
cookie_csrf_expire = {{ .Values.oauth2Proxy.cookie.csrf.expire | quote }}
{{- if .Values.oauth2Proxy.cookie.csrf.perRequest }}
cookie_csrf_per_request = true
{{- else }}
cookie_csrf_per_request = false
{{- end }}
{{- if not .Values.oauth2Proxy.cookie.secret.existingSecret }}
cookie_secret = {{ .Values.oauth2Proxy.cookie.secret.value | quote }}
{{- end }}
{{- end }}

apiVersion: v1
kind: Secret
metadata:
  name: oauth2-proxy-config
  labels:
    helm.sh/chart: {{ include "deploykf-auth.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-auth.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/component: oauth2-proxy
data:
  oauth2-proxy.cfg: {{ include "deploykf-auth.oauth2-proxy.cfg" . | b64enc | quote }}
