%% ----------------------------------------------------------------------------
%% RabbitMQ HTTP Authorization
%% ----------------------------------------------------------------------------

{mapping, "auth_http.http_method", "rabbitmq_auth_backend_http.http_method",
    [{datatype, {enum, [get,post]}}]}.

{mapping, "auth_http.user_path", "rabbitmq_auth_backend_http.user_path",
    [{datatype, string}, {validators, ["uri"]}]}.

{mapping, "auth_http.vhost_path", "rabbitmq_auth_backend_http.vhost_path",
    [{datatype, string}, {validators, ["uri"]}]}.

{mapping, "auth_http.resource_path", "rabbitmq_auth_backend_http.resource_path",
    [{datatype, string}, {validators, ["uri"]}]}.

{mapping, "auth_http.topic_path", "rabbitmq_auth_backend_http.topic_path",
    [{datatype, string}, {validators, ["uri"]}]}.

{mapping, "auth_http.request_timeout", "rabbitmq_auth_backend_http.request_timeout",
    [{datatype, integer}]}.

{mapping, "auth_http.connection_timeout", "rabbitmq_auth_backend_http.connection_timeout",
    [{datatype, integer}]}.

{mapping, "auth_http.authorization_failure_disclosure", "rabbitmq_auth_backend_http.authorization_failure_disclosure", [
    {datatype, {enum, [true, false]}}]}.

%% TLS options

{mapping, "auth_http.ssl_options", "rabbitmq_auth_backend_http.ssl_options", [
    {datatype, {enum, [none]}}
]}.

{translation, "rabbitmq_auth_backend_http.ssl_options",
fun(Conf) ->
    case cuttlefish:conf_get("auth_http.ssl_options", Conf, undefined) of
        none -> [];
        _    -> cuttlefish:invalid("Invalid auth_http.ssl_options")
    end
end}.

{mapping, "auth_http.ssl_options.verify", "rabbitmq_auth_backend_http.ssl_options.verify", [
    {datatype, {enum, [verify_peer, verify_none]}}]}.

{mapping, "auth_http.ssl_options.fail_if_no_peer_cert", "rabbitmq_auth_backend_http.ssl_options.fail_if_no_peer_cert", [
    {datatype, {enum, [true, false]}}]}.

{mapping, "auth_http.ssl_options.cacertfile", "rabbitmq_auth_backend_http.ssl_options.cacertfile",
    [{datatype, string}, {validators, ["pem_file"]}]}.

{mapping, "auth_http.ssl_options.certfile", "rabbitmq_auth_backend_http.ssl_options.certfile",
    [{datatype, string}, {validators, ["pem_file"]}]}.

{mapping, "auth_http.ssl_options.cert", "rabbitmq_auth_backend_http.ssl_options.cert",
    [{datatype, string}]}.

{translation, "rabbitmq_auth_backend_http.ssl_options.cert",
fun(Conf) ->
    list_to_binary(cuttlefish:conf_get("auth_http.ssl_options.cert", Conf))
end}.

{mapping, "auth_http.ssl_options.client_renegotiation", "rabbitmq_auth_backend_http.ssl_options.client_renegotiation",
    [{datatype, {enum, [true, false]}}]}.

{mapping, "auth_http.ssl_options.crl_check", "rabbitmq_auth_backend_http.ssl_options.crl_check",
    [{datatype, [{enum, [true, false, peer, best_effort]}]}]}.

{mapping, "auth_http.ssl_options.depth", "rabbitmq_auth_backend_http.ssl_options.depth",
    [{datatype, integer}, {validators, ["byte"]}]}.

{mapping, "auth_http.ssl_options.dh", "rabbitmq_auth_backend_http.ssl_options.dh",
    [{datatype, string}]}.

{translation, "rabbitmq_auth_backend_http.ssl_options.dh",
fun(Conf) ->
    list_to_binary(cuttlefish:conf_get("auth_http.ssl_options.dh", Conf))
end}.

{mapping, "auth_http.ssl_options.dhfile", "rabbitmq_auth_backend_http.ssl_options.dhfile",
    [{datatype, string}, {validators, ["file_accessible"]}]}.

{mapping, "auth_http.ssl_options.honor_cipher_order", "rabbitmq_auth_backend_http.ssl_options.honor_cipher_order",
    [{datatype, {enum, [true, false]}}]}.

{mapping, "auth_http.ssl_options.honor_ecc_order", "rabbitmq_auth_backend_http.ssl_options.honor_ecc_order",
    [{datatype, {enum, [true, false]}}]}.

{mapping, "auth_http.ssl_options.key.RSAPrivateKey", "rabbitmq_auth_backend_http.ssl_options.key",
    [{datatype, string}]}.

{mapping, "auth_http.ssl_options.key.DSAPrivateKey", "rabbitmq_auth_backend_http.ssl_options.key",
    [{datatype, string}]}.

{mapping, "auth_http.ssl_options.key.PrivateKeyInfo", "rabbitmq_auth_backend_http.ssl_options.key",
    [{datatype, string}]}.

{translation, "rabbitmq_auth_backend_http.ssl_options.key",
fun(Conf) ->
    case cuttlefish_variable:filter_by_prefix("auth_http.ssl_options.key", Conf) of
        [{[_,_,Key], Val}|_] -> {list_to_atom(Key), list_to_binary(Val)};
        _ -> undefined
    end
end}.

{mapping, "auth_http.ssl_options.keyfile", "rabbitmq_auth_backend_http.ssl_options.keyfile",
    [{datatype, string}, {validators, ["pem_file"]}]}.

{mapping, "auth_http.ssl_options.log_alert", "rabbitmq_auth_backend_http.ssl_options.log_alert",
    [{datatype, {enum, [true, false]}}]}.

{mapping, "auth_http.ssl_options.password", "rabbitmq_auth_backend_http.ssl_options.password",
    [{datatype, [tagged_binary, binary]}]}.

{mapping, "auth_http.ssl_options.psk_identity", "rabbitmq_auth_backend_http.ssl_options.psk_identity",
    [{datatype, string}]}.

{mapping, "auth_http.ssl_options.reuse_sessions", "rabbitmq_auth_backend_http.ssl_options.reuse_sessions",
    [{datatype, {enum, [true, false]}}]}.

{mapping, "auth_http.ssl_options.secure_renegotiate", "rabbitmq_auth_backend_http.ssl_options.secure_renegotiate",
    [{datatype, {enum, [true, false]}}]}.

{mapping, "auth_http.ssl_options.versions.$version", "rabbitmq_auth_backend_http.ssl_options.versions",
    [{datatype, atom}]}.

{translation, "rabbitmq_auth_backend_http.ssl_options.versions",
fun(Conf) ->
    Settings = cuttlefish_variable:filter_by_prefix("auth_http.ssl_options.versions", Conf),
    [ V || {_, V} <- Settings ]
end}.

{mapping, "auth_http.ssl_options.ciphers.$cipher", "rabbitmq_auth_backend_http.ssl_options.ciphers",
    [{datatype, string}]}.

{translation, "rabbitmq_auth_backend_http.ssl_options.ciphers",
fun(Conf) ->
    Settings = cuttlefish_variable:filter_by_prefix("auth_http.ssl_options.ciphers", Conf),
    lists:reverse([V || {_, V} <- Settings])
end}.

{mapping, "auth_http.ssl_options.sni", "rabbitmq_auth_backend_http.ssl_options.server_name_indication",
    [{datatype, [{enum, [none]}, string]}]}.

{translation, "rabbitmq_auth_backend_http.ssl_options.server_name_indication",
fun(Conf) ->
    case cuttlefish:conf_get("auth_http.ssl_options.sni", Conf, undefined) of
        undefined -> cuttlefish:unset();
        none      -> cuttlefish:unset();
        Hostname  -> Hostname
    end
end}.

{mapping, "auth_http.ssl_options.hostname_verification", "rabbitmq_auth_backend_http.ssl_hostname_verification", [
    {datatype, {enum, [wildcard, none]}}]}.
