config_schema.json

{
  "$defs": {
    "IvaType": {
      "description": "The type of IVA",
      "enum": [
        "Phone",
        "Fax",
        "PostalAddress",
        "InPerson"
      ],
      "title": "IvaType",
      "type": "string"
    },
    "TOTPAlgorithm": {
      "description": "Hash algorithm used for TOTP code generation",
      "enum": [
        "sha1",
        "sha256",
        "sha512"
      ],
      "title": "TOTPAlgorithm",
      "type": "string"
    },
    "UserWithIVA": {
      "additionalProperties": false,
      "description": "User with external ID and associated IVA.",
      "properties": {
        "ext_id": {
          "description": "The external ID of the user",
          "title": "Ext Id",
          "type": "string"
        },
        "name": {
          "description": "The full name of the user",
          "title": "Name",
          "type": "string"
        },
        "email": {
          "description": "The email address of the user",
          "title": "Email",
          "type": "string"
        },
        "iva_type": {
          "$ref": "#/$defs/IvaType",
          "description": "The type of the validation address of the user"
        },
        "iva_value": {
          "description": "The actual validation address of the user",
          "title": "Iva Value",
          "type": "string"
        }
      },
      "required": [
        "ext_id",
        "name",
        "email",
        "iva_type",
        "iva_value"
      ],
      "title": "UserWithIVA",
      "type": "object"
    }
  },
  "additionalProperties": false,
  "description": "Modifies the original Settings class provided by the user",
  "properties": {
    "auth_events_topic": {
      "default": "auth",
      "description": "The name of the topic for authentication related events",
      "title": "Auth Events Topic",
      "type": "string"
    },
    "second_factor_recreated_event_type": {
      "default": "second_factor_recreated",
      "description": "The event type for recreation of the second factor for authentication",
      "title": "Second Factor Recreated Event Type",
      "type": "string"
    },
    "iva_events_topic": {
      "default": "ivas",
      "description": "The name of the topic for IVA related events",
      "title": "Iva Events Topic",
      "type": "string"
    },
    "iva_state_changed_event_type": {
      "default": "iva_state_changed",
      "description": "The event type for IVA state changes",
      "title": "Iva State Changed Event Type",
      "type": "string"
    },
    "dataset_deletion_event_topic": {
      "default": "metadata_datasets",
      "description": "the topic of the event announcing dataset deletions",
      "title": "Dataset Deletion Event Topic",
      "type": "string"
    },
    "dataset_deletion_event_type": {
      "default": "dataset_deleted",
      "description": "the type of the event announcing dataset deletions",
      "title": "Dataset Deletion Event Type",
      "type": "string"
    },
    "claims_collection": {
      "default": "claims",
      "description": "Name of the collection for user claims",
      "title": "Claims Collection",
      "type": "string"
    },
    "users_collection": {
      "default": "users",
      "description": "Name of the collection for users",
      "title": "Users Collection",
      "type": "string"
    },
    "user_tokens_collection": {
      "default": "user_tokens",
      "description": "Name of the collection for user tokens",
      "title": "User Tokens Collection",
      "type": "string"
    },
    "ivas_collection": {
      "default": "ivas",
      "description": "Name of the collection for IVAs",
      "title": "Ivas Collection",
      "type": "string"
    },
    "user_events_topic": {
      "default": "users",
      "description": "The name of the topic for user related events",
      "title": "User Events Topic",
      "type": "string"
    },
    "service_name": {
      "default": "auth_service",
      "description": "Short name of this service",
      "title": "Service Name",
      "type": "string"
    },
    "service_instance_id": {
      "description": "A string that uniquely identifies this instance across all instances of this service. This is included in log messages.",
      "examples": [
        "germany-bw-instance-001"
      ],
      "title": "Service Instance Id",
      "type": "string"
    },
    "kafka_servers": {
      "description": "A list of connection strings to connect to Kafka bootstrap servers.",
      "examples": [
        [
          "localhost:9092"
        ]
      ],
      "items": {
        "type": "string"
      },
      "title": "Kafka Servers",
      "type": "array"
    },
    "kafka_security_protocol": {
      "default": "PLAINTEXT",
      "description": "Protocol used to communicate with brokers. Valid values are: PLAINTEXT, SSL.",
      "enum": [
        "PLAINTEXT",
        "SSL"
      ],
      "title": "Kafka Security Protocol",
      "type": "string"
    },
    "kafka_ssl_cafile": {
      "default": "",
      "description": "Certificate Authority file path containing certificates used to sign broker certificates. If a CA is not specified, the default system CA will be used if found by OpenSSL.",
      "title": "Kafka Ssl Cafile",
      "type": "string"
    },
    "kafka_ssl_certfile": {
      "default": "",
      "description": "Optional filename of client certificate, as well as any CA certificates needed to establish the certificate's authenticity.",
      "title": "Kafka Ssl Certfile",
      "type": "string"
    },
    "kafka_ssl_keyfile": {
      "default": "",
      "description": "Optional filename containing the client private key.",
      "title": "Kafka Ssl Keyfile",
      "type": "string"
    },
    "kafka_ssl_password": {
      "default": "",
      "description": "Optional password to be used for the client private key.",
      "format": "password",
      "title": "Kafka Ssl Password",
      "type": "string",
      "writeOnly": true
    },
    "generate_correlation_id": {
      "default": true,
      "description": "A flag, which, if False, will result in an error when inbound requests don't possess a correlation ID. If True, requests without a correlation ID will be assigned a newly generated ID in the correlation ID middleware function.",
      "examples": [
        true,
        false
      ],
      "title": "Generate Correlation Id",
      "type": "boolean"
    },
    "kafka_max_message_size": {
      "default": 1048576,
      "description": "The largest message size that can be transmitted, in bytes. Only services that have a need to send/receive larger messages should set this.",
      "examples": [
        1048576,
        16777216
      ],
      "exclusiveMinimum": 0,
      "title": "Kafka Max Message Size",
      "type": "integer"
    },
    "kafka_max_retries": {
      "default": 0,
      "description": "The maximum number of times to immediately retry consuming an event upon failure. Works independently of the dead letter queue.",
      "examples": [
        0,
        1,
        2,
        3,
        5
      ],
      "minimum": 0,
      "title": "Kafka Max Retries",
      "type": "integer"
    },
    "kafka_enable_dlq": {
      "default": false,
      "description": "A flag to toggle the dead letter queue. If set to False, the service will crash upon exhausting retries instead of publishing events to the DLQ. If set to True, the service will publish events to the DLQ topic after exhausting all retries",
      "examples": [
        true,
        false
      ],
      "title": "Kafka Enable DLQ",
      "type": "boolean"
    },
    "kafka_dlq_topic": {
      "default": "dlq",
      "description": "The name of the topic used to resolve error-causing events.",
      "examples": [
        "dlq"
      ],
      "title": "Kafka DLQ Topic",
      "type": "string"
    },
    "kafka_retry_backoff": {
      "default": 0,
      "description": "The number of seconds to wait before retrying a failed event. The backoff time is doubled for each retry attempt.",
      "examples": [
        0,
        1,
        2,
        3,
        5
      ],
      "minimum": 0,
      "title": "Kafka Retry Backoff",
      "type": "integer"
    },
    "mongo_dsn": {
      "description": "MongoDB connection string. Might include credentials. For more information see: https://naiveskill.com/mongodb-connection-string/",
      "examples": [
        "mongodb://localhost:27017"
      ],
      "format": "multi-host-uri",
      "minLength": 1,
      "title": "Mongo Dsn",
      "type": "string"
    },
    "db_name": {
      "default": "auth-db",
      "description": "the name of the database located on the MongoDB server",
      "examples": [
        "auth-db",
        "user-management",
        "users-and-claims"
      ],
      "title": "Db Name",
      "type": "string"
    },
    "mongo_timeout": {
      "anyOf": [
        {
          "exclusiveMinimum": 0,
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Timeout in seconds for API calls to MongoDB. The timeout applies to all steps needed to complete the operation, including server selection, connection checkout, serialization, and server-side execution. When the timeout expires, PyMongo raises a timeout exception. If set to None, the operation will not time out (default MongoDB behavior).",
      "examples": [
        300,
        600,
        null
      ],
      "title": "Mongo Timeout"
    },
    "log_level": {
      "default": "INFO",
      "description": "The minimum log level to capture.",
      "enum": [
        "CRITICAL",
        "ERROR",
        "WARNING",
        "INFO",
        "DEBUG",
        "TRACE"
      ],
      "title": "Log Level",
      "type": "string"
    },
    "log_format": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "If set, will replace JSON formatting with the specified string format. If not set, has no effect. In addition to the standard attributes, the following can also be specified: timestamp, service, instance, level, correlation_id, and details",
      "examples": [
        "%(timestamp)s - %(service)s - %(level)s - %(message)s",
        "%(asctime)s - Severity: %(levelno)s - %(msg)s"
      ],
      "title": "Log Format"
    },
    "log_traceback": {
      "default": true,
      "description": "Whether to include exception tracebacks in log messages.",
      "title": "Log Traceback",
      "type": "boolean"
    },
    "max_iva_verification_attempts": {
      "default": 10,
      "description": "Maximum number of verification attempts for an IVA",
      "title": "Max Iva Verification Attempts",
      "type": "integer"
    },
    "totp_issuer": {
      "default": "GHGA",
      "description": "Issuer name for TOTP provisioning URIs",
      "title": "Totp Issuer",
      "type": "string"
    },
    "totp_image": {
      "anyOf": [
        {
          "format": "uri",
          "minLength": 1,
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "URL of the PNG image provided in the TOTP provisioning URIs",
      "examples": [
        "https://www.ghga.de/logo.png"
      ],
      "title": "Totp Image"
    },
    "totp_algorithm": {
      "$ref": "#/$defs/TOTPAlgorithm",
      "default": "sha1"
    },
    "totp_digits": {
      "default": 6,
      "description": "Number of digits used for the TOTP code",
      "maximum": 12,
      "minimum": 6,
      "title": "Totp Digits",
      "type": "integer"
    },
    "totp_interval": {
      "default": 30,
      "description": "Time interval in seconds for generating TOTP codes",
      "maximum": 300,
      "minimum": 10,
      "title": "Totp Interval",
      "type": "integer"
    },
    "totp_tolerance": {
      "default": 1,
      "description": "Number of intervals to check before and after the current time",
      "maximum": 10,
      "minimum": 0,
      "title": "Totp Tolerance",
      "type": "integer"
    },
    "totp_attempts_per_code": {
      "default": 3,
      "description": "Maximum number of attempts to verify an individual TOTP code",
      "maximum": 10,
      "minimum": 1,
      "title": "Totp Attempts Per Code",
      "type": "integer"
    },
    "totp_max_failed_attempts": {
      "default": 10,
      "description": "Maximum number of consecutive failed attempts to verify TOTP codes",
      "maximum": 100,
      "minimum": 1,
      "title": "Totp Max Failed Attempts",
      "type": "integer"
    },
    "totp_secret_size": {
      "default": 32,
      "description": "Size of the Base32 encoded TOTP secrets",
      "maximum": 256,
      "minimum": 24,
      "title": "Totp Secret Size",
      "type": "integer"
    },
    "totp_encryption_key": {
      "anyOf": [
        {
          "format": "password",
          "type": "string",
          "writeOnly": true
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Base64 encoded key used to encrypt TOTP secrets",
      "title": "Totp Encryption Key"
    },
    "session_id_bytes": {
      "default": 24,
      "description": "Number of bytes to be used for a session ID.",
      "title": "Session ID size",
      "type": "integer"
    },
    "csrf_token_bytes": {
      "default": 24,
      "description": "Number of bytes to be used for a CSRF token.",
      "title": "CSRF token size",
      "type": "integer"
    },
    "session_timeout_seconds": {
      "default": 3600,
      "description": "Session timeout in seconds",
      "title": "Session timeout",
      "type": "integer"
    },
    "session_max_lifetime_seconds": {
      "default": 43200,
      "description": "Maximum lifetime of a session in seconds",
      "title": "Max. session duration",
      "type": "integer"
    },
    "auth_key": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "internal public key for user management (key pair for auth adapter)",
      "title": "Auth Key"
    },
    "auth_algs": {
      "default": [
        "ES256"
      ],
      "description": "A list of all algorithms used for signing GHGA internal tokens.",
      "items": {
        "type": "string"
      },
      "title": "Auth Algs",
      "type": "array"
    },
    "auth_check_claims": {
      "default": {
        "id": null,
        "name": null,
        "email": null,
        "iat": null,
        "exp": null
      },
      "description": "A dict of all GHGA internal claims that shall be verified.",
      "title": "Auth Check Claims",
      "type": "object"
    },
    "auth_map_claims": {
      "additionalProperties": {
        "type": "string"
      },
      "default": {},
      "description": "A mapping of claims to attributes in the GHGA auth context.",
      "title": "Auth Map Claims",
      "type": "object"
    },
    "host": {
      "default": "127.0.0.1",
      "description": "IP of the host.",
      "title": "Host",
      "type": "string"
    },
    "port": {
      "default": 8080,
      "description": "Port to expose the server on the specified host",
      "title": "Port",
      "type": "integer"
    },
    "auto_reload": {
      "default": false,
      "description": "A development feature. Set to `True` to automatically reload the server upon code changes",
      "title": "Auto Reload",
      "type": "boolean"
    },
    "workers": {
      "default": 1,
      "description": "Number of workers processes to run.",
      "title": "Workers",
      "type": "integer"
    },
    "api_root_path": {
      "default": "",
      "description": "Root path at which the API is reachable. This is relative to the specified host and port.",
      "title": "Api Root Path",
      "type": "string"
    },
    "openapi_url": {
      "default": "/openapi.json",
      "description": "Path to get the openapi specification in JSON format. This is relative to the specified host and port.",
      "title": "Openapi Url",
      "type": "string"
    },
    "docs_url": {
      "default": "/docs",
      "description": "Path to host the swagger documentation. This is relative to the specified host and port.",
      "title": "Docs Url",
      "type": "string"
    },
    "cors_allowed_origins": {
      "anyOf": [
        {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "A list of origins that should be permitted to make cross-origin requests. By default, cross-origin requests are not allowed. You can use ['*'] to allow any origin.",
      "examples": [
        [
          "https://example.org",
          "https://www.example.org"
        ]
      ],
      "title": "Cors Allowed Origins"
    },
    "cors_allow_credentials": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Indicate that cookies should be supported for cross-origin requests. Defaults to False. Also, cors_allowed_origins cannot be set to ['*'] for credentials to be allowed. The origins must be explicitly specified.",
      "examples": [
        [
          "https://example.org",
          "https://www.example.org"
        ]
      ],
      "title": "Cors Allow Credentials"
    },
    "cors_allowed_methods": {
      "anyOf": [
        {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "A list of HTTP methods that should be allowed for cross-origin requests. Defaults to ['GET']. You can use ['*'] to allow all standard methods.",
      "examples": [
        [
          "*"
        ]
      ],
      "title": "Cors Allowed Methods"
    },
    "cors_allowed_headers": {
      "anyOf": [
        {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "A list of HTTP request headers that should be supported for cross-origin requests. Defaults to []. You can use ['*'] to allow all headers. The Accept, Accept-Language, Content-Language and Content-Type headers are always allowed for CORS requests.",
      "examples": [
        []
      ],
      "title": "Cors Allowed Headers"
    },
    "api_ext_path": {
      "default": "/api/auth",
      "description": "external API path for the auth related endpoints (user, session and TOTP management)",
      "title": "Api Ext Path",
      "type": "string"
    },
    "auth_ext_keys": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "external public key set for auth adapter (used only by the auth adapter, determined using OIDC discovery if None)",
      "title": "Auth Ext Keys"
    },
    "auth_ext_algs": {
      "default": [
        "RS256",
        "ES256"
      ],
      "description": "allowed algorithms for signing external tokens",
      "items": {
        "type": "string"
      },
      "title": "Auth Ext Algs",
      "type": "array"
    },
    "basic_auth_credentials": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "credentials for basic authentication, separated by whitespace",
      "title": "Basic Auth Credentials"
    },
    "basic_auth_realm": {
      "default": "GHGA Data Portal",
      "description": "realm for basic authentication",
      "title": "Basic Auth Realm",
      "type": "string"
    },
    "allow_read_paths": {
      "default": [
        "/.well-known/*",
        "/service-logo.png"
      ],
      "description": "paths that are public or use their own authentication mechanism",
      "items": {
        "type": "string"
      },
      "title": "Allow Read Paths",
      "type": "array"
    },
    "allow_write_paths": {
      "default": [],
      "description": "paths for writing that use their own authentication mechanism",
      "items": {
        "type": "string"
      },
      "title": "Allow Write Paths",
      "type": "array"
    },
    "provide_apis": {
      "default": [],
      "description": "Which REST APIs should be provided.",
      "examples": [
        "[\"ext_auth\"]",
        "[\"users\"]",
        "[\"claims\"]"
      ],
      "items": {
        "enum": [
          "ext_auth",
          "users",
          "claims"
        ],
        "type": "string"
      },
      "title": "Provide APIs",
      "type": "array"
    },
    "run_consumer": {
      "default": false,
      "description": "Whether the service should run as an event consumer",
      "examples": [
        "false",
        "true"
      ],
      "title": "Run Consumer",
      "type": "boolean"
    },
    "add_as_data_stewards": {
      "default": [],
      "description": "A list of of data stewards to seed the claims repository with. All other data steward claims will be removed. This is only used with the claims API.",
      "items": {
        "$ref": "#/$defs/UserWithIVA"
      },
      "title": "Add As Data Stewards",
      "type": "array"
    },
    "oidc_authority_url": {
      "default": "https://login.aai.lifescience-ri.eu/oidc/",
      "description": "external OIDC authority URL used by the auth adapter",
      "format": "uri",
      "maxLength": 2083,
      "minLength": 1,
      "title": "Oidc Authority Url",
      "type": "string"
    },
    "oidc_issuer": {
      "default": "https://login.aai.lifescience-ri.eu/oidc/",
      "description": "external OIDC issuer for access tokens used by the auth adapter (URL format with or without end slash, determined using OIDC discovery if empty)",
      "title": "Oidc Issuer",
      "type": "string"
    },
    "oidc_userinfo_endpoint": {
      "anyOf": [
        {
          "format": "uri",
          "maxLength": 2083,
          "minLength": 1,
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": "https://login.aai.lifescience-ri.eu/oidc/userinfo",
      "description": "external OIDC userinfo endpoint used by the auth adapter (determined using OIDC discovery if None)",
      "title": "Oidc Userinfo Endpoint"
    },
    "oidc_client_id": {
      "default": "ghga-data-portal",
      "description": "the registered OIDC client ID",
      "title": "Oidc Client Id",
      "type": "string"
    },
    "organization_url": {
      "default": "https://ghga.de",
      "description": "the URL used as source for internal claims",
      "format": "uri",
      "maxLength": 2083,
      "minLength": 1,
      "title": "Organization Url",
      "type": "string"
    }
  },
  "required": [
    "service_instance_id",
    "kafka_servers",
    "mongo_dsn"
  ],
  "title": "ModSettings",
  "type": "object"
}