%% ----------------------------------------------------------------------------
%% RabbitMQ HTTP Authorization
%% ----------------------------------------------------------------------------

{mapping, "auth_http.http_method", "rabbitmq_auth_backend_http.http_method",
    [{datatype, {enum, [get,post]}}]}.

{mapping, "auth_http.user_path", "rabbitmq_auth_backend_http.user_path",
    [{datatype, string}, {validators, ["uri"]}]}.

{mapping, "auth_http.vhost_path", "rabbitmq_auth_backend_http.vhost_path",
    [{datatype, string}, {validators, ["uri"]}]}.

{mapping, "auth_http.resource_path", "rabbitmq_auth_backend_http.resource_path",
    [{datatype, string}, {validators, ["uri"]}]}.

{mapping, "auth_http.topic_path", "rabbitmq_auth_backend_http.topic_path",
    [{datatype, string}, {validators, ["uri"]}]}.

{mapping, "auth_http.request_timeout", "rabbitmq_auth_backend_http.request_timeout",
    [{datatype, integer}]}.

{mapping, "auth_http.connection_timeout", "rabbitmq_auth_backend_http.connection_timeout",
    [{datatype, integer}]}.

{mapping, "auth_http.authorization_failure_disclosure", "rabbitmq_auth_backend_http.authorization_failure_disclosure", [
    {datatype, boolean}]}.

%% TLS options

{include_partial, {rabbit, "ssl_options"},
    [{prefix, "auth_http.ssl_options"},
     {app_prefix, "rabbitmq_auth_backend_http.ssl_options"},
     {disable_with, none}]}.

%% `key.*` is kept inline so the no-match branch stays the atom
%% `undefined`, matching the historical (and buggy) translation shape.

{mapping, "auth_http.ssl_options.key.RSAPrivateKey",
    "rabbitmq_auth_backend_http.ssl_options.key",
    [{datatype, string}]}.

{mapping, "auth_http.ssl_options.key.DSAPrivateKey",
    "rabbitmq_auth_backend_http.ssl_options.key",
    [{datatype, string}]}.

{mapping, "auth_http.ssl_options.key.PrivateKeyInfo",
    "rabbitmq_auth_backend_http.ssl_options.key",
    [{datatype, string}]}.

{translation, "rabbitmq_auth_backend_http.ssl_options.key",
fun(Conf) ->
    case cuttlefish_variable:filter_by_prefix(
           "auth_http.ssl_options.key", Conf) of
        [{[_,_,Key], Val}|_] -> {list_to_atom(Key), list_to_binary(Val)};
        _ -> undefined
    end
end}.

%% auth_http extras on top of the shared partial.

{mapping, "auth_http.ssl_options.client_renegotiation",
    "rabbitmq_auth_backend_http.ssl_options.client_renegotiation",
    [{datatype, boolean}]}.

{mapping, "auth_http.ssl_options.honor_cipher_order",
    "rabbitmq_auth_backend_http.ssl_options.honor_cipher_order",
    [{datatype, boolean}]}.

{mapping, "auth_http.ssl_options.honor_ecc_order",
    "rabbitmq_auth_backend_http.ssl_options.honor_ecc_order",
    [{datatype, boolean}]}.

{mapping, "auth_http.ssl_options.sni", "rabbitmq_auth_backend_http.ssl_options.server_name_indication",
    [{datatype, [{enum, [none]}, string]}]}.

{translation, "rabbitmq_auth_backend_http.ssl_options.server_name_indication",
fun(Conf) ->
    case cuttlefish:conf_get("auth_http.ssl_options.sni", Conf, undefined) of
        undefined -> cuttlefish:unset();
        none      -> cuttlefish:unset();
        Hostname  -> Hostname
    end
end}.

{mapping, "auth_http.ssl_options.hostname_verification", "rabbitmq_auth_backend_http.ssl_hostname_verification", [
    {datatype, {enum, [wildcard, none]}}]}.

%% No-op stub: pre-3.8.0 cuttlefish silently ignored unknown validator names,
%% so call sites referencing "uri" performed no check. 3.8.0 rejects undefined
%% names; this preserves the original accept-all behaviour.
{validator, "uri", "URI string (no additional validation)",
 fun(_Uri) -> true end}.
