accountsConfig:
  # MongoDB database where users, teams and oauth_codes are stored.
  # Must match mongoRealmAuthenticator.users-db in restheart.yml.
  db: 8x5

  # Application display name — used in email subjects and bodies.
  app-name: "My App"

  # JWT access token time-to-live in minutes.
  # The key and issuer are sourced automatically from jwtConfigProvider.
  jwt-ttl: 15

  # Domain used for the JWT authentication cookie (Set-Cookie: Domain=...).
  cookie-domain: dev.example.com

  # Public URL of the frontend — used to build links in transactional emails.
  frontend-url: https://dev.example.com

  # URL the browser is redirected to after a successful auto-login
  # (email verification, invitation activation, password reset, OAuth callback).
  frontend-app-url: https://dev.example.com/app

  # Legal policy versions. Activation and registration validate the submitted
  # consent versions against these values; bump when T&C or Privacy Policy changes.
  terms-version: "1.0"
  privacy-version: "1.0"

  # Default BCP 47 locale for email templates (used when the user document
  # has no "locale" field). Falls back to "en" if omitted.
  default-locale: en

  # Paths to custom email template HTML files (relative to the RESTHeart
  # working directory). Omit any key to use the built-in template.
  # See: Email Templates guide.
  templates:
    verification:   etc/email-templates/verification.html
    password-reset: etc/email-templates/password-reset.html
    invite:         etc/email-templates/invite.html

  # ── Membership SPI (9.4.1+) ──────────────────────────────────────────────

  # JWT claim name used to carry the active tenant identifier.
  # Default: "tenant". Change to e.g. "org" if your domain uses organisations.
  # See: Custom Membership Providers.
  tenant-claim-name: tenant

  # Role name assigned to regular (non-admin) team members.
  # Default: "member". Set to "user" if existing ACL rules use that label.
  member-role-name: member

  # System ACL role assigned to users after email verification or OAuth login.
  # New unverified users get roles: ["$unauthenticated"] — they can only access
  # public endpoints until verification assigns the real role.
  # Default: "user". Override per-tenant via override-accounts-default-role.
  default-role: user

  # Team role assigned to the user who creates a new team.
  # Stored in user.tenants[].role and team.members[].role.
  # Default: "owner". Override per-tenant via override-accounts-ownership-role.
  ownership-role: owner

  # Set to false to disable the built-in membership management endpoints:
  #   POST /auth/invite, POST /auth/resend-invite,
  #   GET  /auth/tenants, POST /auth/switch-tenant
  # Default: true
  membership-endpoints-enabled: true

  # Additional JWT claims propagated from request attached-parameters to tokens
  # issued by accounts endpoints (verify, activate, reset-password, switch-tenant, OAuth).
  # Mirrors jwtTokenManager.account-properties-claims: use the same list so that
  # all token-issuance paths produce identical JWTs.
  # authDb is always included automatically (no need to list it here).
  account-properties-claims:
  # - srvNode  # example: attached-param set by SrvNodeEnricher in multi-tenant deployments

oauthConfig:
  # Master switch. Set to false to disable all OAuth endpoints while keeping
  # the configuration in place.
  enabled: true

  # Base URL of the RESTHeart API instance. Each provider's callback URL is
  # constructed as: {api-base-url}/auth/oauth/callback/{provider}
  api-base-url: https://api.example.com

  # Browser is redirected here after a successful login.
  frontend-success-url: https://app.example.com/app

  # Browser is redirected here when the OAuth flow fails (e.g. user denied
  # consent, invalid state).
  frontend-error-url: https://app.example.com/login?error=oauth_error

  providers:
    google:
      enabled: true
      client-id:     "123….apps.googleusercontent.com"
      client-secret: "GOCSPX-…"
      scope:         "openid email profile"   # optional — default for google

    github:
      enabled: true
      client-id:     "Iv1.…"
      client-secret: "…"
      scope:         "user:email"             # optional — default for github

    # Custom provider — requires a matching OAuthProvider plugin in plugins/
    # myapp:
    #   enabled: true
    #   client-id: "…"
    #   client-secret: "…"
    #   scope: "read:profile"

ermes:
  enabled: true
  # Display name used in the email "From" header.
  app-name: "My App"
  # From email address.
  sender-email: noreply@example.com
  # SMTP connection settings.
  smtp-hostname: email-smtp.eu-central-1.amazonaws.com
  smtp-port: 465            # 465 = SMTPS (implicit TLS); 587 = STARTTLS
  smtp-username: AKIAxxxxxxxx
  smtp-password: secret

{
  "_id": "ea820b",
  "accounts": {
    "app-name":         "Customer App",
    "frontend-url":     "https://app.customer.com",
    "frontend-app-url": "https://app.customer.com/app",
    "templates": {
      "verification":   "<html>…full HTML string…</html>",
      "password-reset": "<html>…</html>",
      "invite":         "<html>…</html>"
    },
    "oauth": {
      "google": {
        "enabled":       true,
        "client-id":     "123….apps.googleusercontent.com",
        "client-secret": "GOCSPX-…"
      }
    }
  }
}