accountsConfig:
  # Since 9.7.0 the database and collection holding users, teams, invitations
  # and oauth_codes are sourced from mongoRealmAuthenticator (users-db and
  # users-collection), so accounts writes users where the authenticator reads
  # them. There is no accountsConfig key for either.

  # Application display name — used in email subjects and bodies.
  app-name: "My App"

  # JWT access token time-to-live in minutes.
  # The key and issuer are sourced automatically from jwtConfigProvider.
  jwt-ttl: 15

  # Domain used for the JWT authentication cookie (Set-Cookie: Domain=...).
  cookie-domain: dev.example.com

  # Whether the auth cookie carries the Secure attribute (HTTPS only). Since 9.6.0.
  # Default true; set false only for local HTTP development.
  cookie-secure: true

  # Name of the JWT authentication cookie.
  # Default: "rh_auth".
  cookie-name: rh_auth

  # Public URL of the frontend — used to build links in transactional emails.
  frontend-url: https://dev.example.com

  # URL the browser is redirected to after a successful auto-login
  # (email verification, invitation activation, password reset, OAuth callback).
  frontend-app-url: https://dev.example.com/app

  # Legal policy versions. Required only when using OAuth with consentsAccepted=true.
  # The OAuth callback reads these values to build the ConsentRecord passed to
  # MembershipProvider.activateViaOAuth(), so the deployment layer knows which
  # version the user accepted. Omit if you do not track consent versions via OAuth.
  # See: Consents Management.
  terms-version: "1.0"
  privacy-version: "1.0"

  # Default BCP 47 locale for email templates (used when the user document
  # has no "locale" field). Falls back to "en" if omitted.
  default-locale: en

  # Paths to custom email template HTML files (relative to the RESTHeart
  # working directory). Omit any key to use the built-in template.
  # See: Email Templates guide.
  templates:
    verification:   etc/email-templates/verification.html
    password-reset: etc/email-templates/password-reset.html
    invite:         etc/email-templates/invite.html

  # ── Membership SPI (9.4.1+) ──────────────────────────────────────────────

  # The name of the ACL variable for the active team (@team), and of the claim when "@team"
  # is listed in jwtConfigProvider/account-properties-claims. Default: "team".
  # See: Custom Membership Providers.
  team-claim-name: team

  # Role name assigned to regular (non-admin) team members.
  # Default: "member". Set to "user" if existing ACL rules use that label.
  member-role-name: member

  # System ACL role assigned to users after email verification or OAuth login.
  # New unverified users get roles: ["$unauthenticated"] — they can only access
  # public endpoints until verification assigns the real role.
  # Default: "user". Override per-team via override-accounts-default-role.
  default-role: user

  # Team role assigned to the user who creates a new team.
  # Stored in team.members[].role.
  # Default: "owner". Override per-team via override-accounts-ownership-role.
  ownership-role: owner

  # Set to false to disable the built-in membership management endpoints:
  #   POST /auth/invite, POST /auth/resend-invite,
  #   GET  /auth/teams, POST /auth/teams, POST /auth/switch-team,
  #   GET  /auth/team/members, PATCH /auth/team, DELETE /auth/team
  # Default: true
  membership-endpoints-enabled: true

  # One-off migration of existing data to the 9.12.0 membership model (memberships on the
  # team only, the user keeps the active team id). Turn it on once, restart, turn it off:
  # old `teams` arrays and `team.role` are removed from the user documents, and every
  # membership they listed that the team does not confirm is reported in the log, never added.
  # Default: false. See: Custom Membership Providers.
  migrate-memberships: false

  # Additional JWT claims propagated from request attached-parameters to tokens
  # issued by accounts endpoints (verify, activate, reset-password, switch-team, OAuth).
  # authDb is always included automatically (no need to list it here).
  # Deprecated: configure account-properties-claims in jwtConfigProvider instead, once for
  # every token path. The team claim is opt-in there, with "@team".
  account-properties-claims:
  # - srvNode  # example: attached-param set by SrvNodeEnricher in multi-team deployments

oauthConfig:
  # Master switch. Set to false to disable all OAuth endpoints while keeping
  # the configuration in place.
  enabled: true

  # Base URL of the RESTHeart API instance. Each provider's callback URL is
  # constructed as: {api-base-url}/auth/oauth/callback/{provider}
  api-base-url: https://api.example.com

  # Browser is redirected here after a successful login.
  frontend-success-url: https://app.example.com/app

  # Browser is redirected here when the OAuth flow fails (e.g. user denied
  # consent, invalid state).
  frontend-error-url: https://app.example.com/login?error=oauth_error

  providers:
    google:
      enabled: true
      client-id:     "123….apps.googleusercontent.com"
      client-secret: "GOCSPX-…"
      scope:         "openid email profile"   # optional — default for google

    github:
      enabled: true
      client-id:     "Iv1.…"
      client-secret: "…"
      scope:         "user:email"             # optional — default for github

    # Custom provider — requires a matching OAuthProvider plugin in plugins/
    # myapp:
    #   enabled: true
    #   client-id: "…"
    #   client-secret: "…"
    #   scope: "read:profile"

emails:
  enabled: true
  # Display name used in the email "From" header.
  app-name: "My App"
  # From email address.
  sender-email: noreply@example.com
  # SMTP connection settings.
  smtp-hostname: email-smtp.eu-central-1.amazonaws.com
  smtp-port: 465            # 465 = SMTPS (implicit TLS); 587 = STARTTLS
  smtp-username: AKIAxxxxxxxx
  smtp-password: secret

jwtConfigProvider:
  account-properties-claims:
    - "@team"     # quoted: @ is reserved in YAML

- roles: [user]
  predicate: path-prefix('/orders') and equals(@team.role, "owner")
  mongo:
    readFilter: {"team": "@team._id"}
    mergeRequest: {"team": "@team._id"}

{
  "_id": "ea820b",
  "accounts": {
    "app-name":         "Customer App",
    "frontend-url":     "https://app.customer.com",
    "frontend-app-url": "https://app.customer.com/app",
    "terms-version":    "2.0",
    "privacy-version":  "2.0",
    "account-properties-claims": ["consents", "plan"],
    "templates": {
      "verification":   "<html>…full HTML string…</html>",
      "password-reset": "<html>…</html>",
      "invite":         "<html>…</html>"
    },
    "oauth": {
      "google": {
        "enabled":       true,
        "client-id":     "123….apps.googleusercontent.com",
        "client-secret": "GOCSPX-…",
        "scope":         "openid email profile"
      }
    }
  }
}