# {{ TAIGA_CONFIG_APPEND_MARKER }}

# Trust the reverse proxy so OIDC callback URLs stay on https.
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
USE_X_FORWARDED_HOST = True

{% if lookup('objstore', application_id, 'enabled') | bool %}
DEFAULT_FILE_STORAGE = "storages.backends.s3.S3Storage"
THUMBNAIL_DEFAULT_STORAGE = DEFAULT_FILE_STORAGE
AWS_STORAGE_BUCKET_NAME = "{{ lookup('objstore', application_id, 'bucket') }}"
AWS_S3_ACCESS_KEY_ID = "{{ lookup('objstore', application_id, 'access_key') }}"
AWS_S3_SECRET_ACCESS_KEY = "{{ lookup('objstore', application_id, 'secret_key') }}"
AWS_S3_ENDPOINT_URL = "{{ lookup('objstore', application_id, 'url') }}"
AWS_S3_REGION_NAME = "{{ lookup('objstore', application_id, 'region') }}"
AWS_S3_ADDRESSING_STYLE = "path"
AWS_S3_URL_PROTOCOL = "http:"
{% endif %}

{% if TAIGA_OIDC_ENABLED | bool %}
INSTALLED_APPS += [
    "mozilla_django_oidc",
    "taiga_contrib_oidc_auth",
]

AUTHENTICATION_BACKENDS = list(AUTHENTICATION_BACKENDS) + [
    "taiga_contrib_oidc_auth.oidc.TaigaOIDCAuthenticationBackend",
]

ROOT_URLCONF = "settings.urls"

OIDC_CALLBACK_CLASS             = "taiga_contrib_oidc_auth.views.TaigaOIDCAuthenticationCallbackView"
OIDC_RP_CLIENT_ID               = "{{ OIDC.CLIENT.ID }}"
OIDC_RP_CLIENT_SECRET           = "{{ OIDC.CLIENT.SECRET }}"
OIDC_RP_SIGN_ALGO               = "RS256"
OIDC_RP_SCOPES                  = "openid profile email"
OIDC_USERNAME_CLAIM             = "{{ OIDC.ATTRIBUTES.USERNAME }}"
OIDC_OP_JWKS_ENDPOINT           = "{{ OIDC.CLIENT.CERTS }}"
OIDC_OP_AUTHORIZATION_ENDPOINT  = "{{ OIDC.CLIENT.AUTHORIZE_URL }}"
OIDC_OP_TOKEN_ENDPOINT          = "{{ OIDC.CLIENT.TOKEN_URL }}"
OIDC_OP_USER_ENDPOINT           = "{{ OIDC.CLIENT.USER_INFO_URL }}"
{% endif %}

{% if TAIGA_LDAP_ENABLED | bool %}
INSTALLED_APPS += ["taiga_contrib_ldap_auth_ext"]

LDAP_SERVER                     = "{{ LDAP.SERVER.URI | regex_replace(':\\d+$', '') }}"
LDAP_PORT                       = {{ LDAP.SERVER.PORT }}
LDAP_START_TLS                  = {{ 'True' if LDAP.SERVER.SECURITY | upper == 'TLS' else 'False' }}
LDAP_BIND_DN                    = "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
LDAP_BIND_PASSWORD              = "{{ LDAP.BIND_CREDENTIAL }}"
LDAP_SEARCH_BASE                = "{{ LDAP.DN.OU.USERS }}"
LDAP_SEARCH_FILTER_ADDITIONAL   = "{{ LDAP.FILTERS.USERS.ALL }}"
LDAP_USERNAME_ATTRIBUTE         = "{{ LDAP.USER.ATTRIBUTES.ID }}"
LDAP_EMAIL_ATTRIBUTE            = "{{ LDAP.USER.ATTRIBUTES.MAIL }}"
LDAP_FULL_NAME_ATTRIBUTE        = "{{ LDAP.USER.ATTRIBUTES.FULLNAME }}"
LDAP_SAVE_LOGIN_PASSWORD        = False
LDAP_MAP_USERNAME_TO_UID        = None
{% endif %}