Authentication Configuration

[auth.mode]
type = "none"

[auth.mode]
type = "api_key"

[auth.mode]
type = "idp"

# API key in X-API-Key header
curl -H "X-API-Key: gw_live_abc123..." https://gateway.example.com/v1/chat/completions

# API key in Authorization: Bearer header (format-based detection)
curl -H "Authorization: Bearer gw_live_abc123..." https://gateway.example.com/v1/chat/completions

# JWT in Authorization: Bearer header (routed to org's IdP for validation)
curl -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..." https://gateway.example.com/v1/chat/completions

[auth.mode]
type = "iap"
identity_header = "X-Forwarded-User"
email_header = "X-Forwarded-Email"
name_header = "X-Forwarded-Name"
groups_header = "X-Forwarded-Groups"
require_identity = true

[server.trusted_proxies]
cidrs = ["173.245.48.0/20", "103.21.244.0/22", "103.22.200.0/22", "103.31.4.0/22"]

[auth.mode]
type = "iap"
identity_header = "Cf-Access-Authenticated-User-Email"
email_header = "Cf-Access-Authenticated-User-Email"

[server.trusted_proxies]
cidrs = ["10.0.0.0/8"]

[auth.mode]
type = "iap"
identity_header = "X-Forwarded-User"
email_header = "X-Forwarded-Email"
groups_header = "X-Forwarded-Groups"

[auth.mode]
type = "iap"
identity_header = "X-Forwarded-User"

[auth.mode.jwt_assertion]
header = "Cf-Access-Jwt-Assertion"
jwks_url = "https://acme-corp.cloudflareaccess.com/cdn-cgi/access/certs"
issuer = "https://acme-corp.cloudflareaccess.com"
audience = "your-audience-id"

[auth.api_key]
header_name = "X-API-Key"
key_prefix = "gw_"
generation_prefix = "gw_live_"
hash_algorithm = "sha256"
cache_ttl_secs = 300

# X-API-Key header
curl -H "X-API-Key: gw_live_abc123..." https://gateway.example.com/v1/chat/completions

# Authorization header (OpenAI-compatible)
curl -H "Authorization: Bearer gw_live_abc123..." https://gateway.example.com/v1/chat/completions

curl -X POST https://gateway.example.com/admin/v1/api-keys \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ML Pipeline Key",
    "owner": {"type": "organization", "org_id": "..."},
    "scopes": ["chat", "embeddings"]
  }'

{
  "allowed_models": ["gpt-4*", "claude-3-opus"]
}

{
  "ip_allowlist": ["10.0.0.0/8", "192.168.1.100", "2001:db8::/32"]
}

{
  "rate_limit_rpm": 100,
  "rate_limit_tpm": 50000
}

curl -X POST https://gateway.example.com/admin/v1/api-keys/{key_id}/rotate \
  -H "Content-Type: application/json" \
  -d '{"grace_period_seconds": 86400}'

[auth.session]
cookie_name = "__gw_session"
duration_secs = 604800     # 7 days
secure = true
same_site = "lax"
secret = "${SESSION_SECRET}"

[auth.rbac]
enabled = true
default_effect = "deny"
role_claim = "roles"
org_claim = "groups"
team_claim = "groups"
project_claim = "project_ids"

[auth.rbac.role_mapping]
"Administrator" = "admin"
"Developer" = "user"

[auth.rbac.audit]
log_allowed = false
log_denied = true

[[auth.rbac.policies]]
name = "super-admin-full-access"
description = "Super admins have unrestricted access"
resource = "*"
action = "*"
condition = "'super_admin' in subject.roles"
effect = "allow"
priority = 100

[[auth.rbac.policies]]
name = "deny-self-delete"
description = "Users cannot delete themselves"
resource = "user"
action = "delete"
condition = "subject.user_id == context.resource_id"
effect = "deny"
priority = 200  # High priority, evaluated first

[[auth.rbac.policies]]
name = "org-admin-manage-org"
description = "Org admins can manage their own organization"
resource = "organization"
action = "*"
condition = "'org_admin' in subject.roles && context.org_id in subject.org_ids"
effect = "allow"
priority = 80

[[auth.rbac.policies]]
name = "org-isolation"
description = "Users can only access resources in their organizations"
resource = "*"
action = "*"
condition = "context.org_id == null || context.org_id in subject.org_ids"
effect = "allow"
priority = 10

[[auth.rbac.policies]]
name = "user-manage-own-api-keys"
description = "Users can manage their own API keys"
resource = "api_key"
action = "*"
condition = "context.owner_id == subject.user_id"
effect = "allow"
priority = 40

[auth.rbac.gateway]
enabled = true
default_effect = "allow"

[auth.mode]
type = "idp"

[auth.api_key]
key_prefix = "gw_"

[[auth.rbac.policies]]
name = "restrict-premium-models"
description = "Premium models require premium role"
resource = "model"
action = "use"
condition = """
  context.model != null &&
  context.model.startsWith('gpt-4') &&
  !('premium' in subject.roles)
"""
effect = "deny"
priority = 90

[[auth.rbac.policies]]
name = "admin-all-models"
description = "Admins can use any model"
resource = "model"
action = "use"
condition = "'admin' in subject.roles"
effect = "allow"
priority = 100

[[auth.rbac.policies]]
name = "basic-token-limit"
description = "Basic users limited to 1000 tokens"
resource = "model"
action = "use"
condition = """
  context.request != null &&
  context.request.max_tokens > 1000 &&
  !('premium' in subject.roles)
"""
effect = "deny"
priority = 85

# Function calling requires tools_enabled role
[[auth.rbac.policies]]
name = "tools-feature-gate"
description = "Function calling requires tools_enabled role"
resource = "model"
action = "use"
condition = """
  context.request != null &&
  context.request.has_tools &&
  !('tools_enabled' in subject.roles)
"""
effect = "deny"
priority = 85

# RAG/file search requires rag_enabled role
[[auth.rbac.policies]]
name = "rag-feature-gate"
description = "File search requires rag_enabled role"
resource = "model"
action = "use"
condition = """
  context.request != null &&
  context.request.has_file_search &&
  !('rag_enabled' in subject.roles)
"""
effect = "deny"
priority = 85

[[auth.rbac.policies]]
name = "reasoning-premium"
description = "High reasoning effort requires premium role"
resource = "model"
action = "use"
condition = """
  context.request != null &&
  context.request.reasoning_effort == 'high' &&
  !('premium' in subject.roles)
"""
effect = "deny"
priority = 85

[[auth.rbac.policies]]
name = "vision-feature-gate"
description = "Image input requires vision role"
resource = "model"
action = "use"
condition = """
  context.request != null &&
  context.request.has_images &&
  !('vision' in subject.roles)
"""
effect = "deny"
priority = 85

# Limit image count for free tier
[[auth.rbac.policies]]
name = "image-count-limit"
description = "Free tier limited to 2 images per request"
resource = "model"
action = "use"
condition = """
  context.request != null &&
  context.request.image_count > 2 &&
  !('premium' in subject.roles)
"""
effect = "deny"
priority = 85

# Restrict HD quality to premium
[[auth.rbac.policies]]
name = "hd-images-premium"
description = "HD image quality requires premium role"
resource = "model"
action = "use"
condition = """
  context.request != null &&
  context.request.image_quality == 'hd' &&
  !('premium' in subject.roles)
"""
effect = "deny"
priority = 85

[[auth.rbac.policies]]
name = "tts-character-limit"
description = "TTS limited to 1000 characters for basic tier"
resource = "model"
action = "use"
condition = """
  context.request != null &&
  context.request.character_count > 1000 &&
  !('tts_extended' in subject.roles)
"""
effect = "deny"
priority = 85

[[auth.rbac.policies]]
name = "business-hours-only"
description = "API access restricted to business hours for non-admins"
resource = "model"
action = "use"
condition = """
  !('admin' in subject.roles) &&
  (context.now.hour < 9 || context.now.hour > 17)
"""
effect = "deny"
priority = 80

[auth.bootstrap]
# Pre-shared API key for initial setup (only works when no users exist)
api_key = "${HADRIAN_BOOTSTRAP_KEY}"

# Domains automatically verified when SSO config is created (skips DNS verification)
auto_verify_domains = ["acme.com", "acme.io"]

[auth.bootstrap]
admin_identities = ["alice@acme.com", "bob@acme.com"]

[auth.bootstrap.initial_org]
slug = "acme-corp"
name = "Acme Corporation"
admin_identities = ["alice@acme.com"]

[auth.bootstrap]
api_key = "${HADRIAN_BOOTSTRAP_KEY}"
auto_verify_domains = ["acme.com"]

[auth.bootstrap.initial_org]
slug = "acme-corp"
name = "Acme Corporation"
admin_identities = ["admin@acme.com"]

[auth.bootstrap.initial_api_key]
name = "production-api-key"

[auth.bootstrap.initial_org]
slug = "acme-corp"
name = "Acme Corporation"
admin_identities = ["admin@acme.com"]

[auth.bootstrap.initial_org.sso]
provider_type = "oidc"
issuer = "https://accounts.google.com"
client_id = "${OIDC_CLIENT_ID}"
client_secret = "${OIDC_CLIENT_SECRET}"
redirect_uri = "https://gateway.example.com/auth/callback"
discovery_url = "https://accounts.google.com/.well-known/openid-configuration"
allowed_email_domains = ["acme.com"]

# Run bootstrap against the database
hadrian bootstrap --config hadrian.toml

# Preview what would be created without making changes
hadrian bootstrap --config hadrian.toml --dry-run

# Example: capture the generated API key
API_KEY=$(hadrian bootstrap --config hadrian.toml 2>/dev/null)
echo "Generated key: $API_KEY"

[auth.emergency]
enabled = true
allowed_ips = ["10.0.0.0/8"]  # Optional: restrict to admin network

[[auth.emergency.accounts]]
id = "emergency-admin-1"
name = "Primary Emergency Admin"
key = "${EMERGENCY_KEY_1}"
email = "admin@acme.com"
roles = ["_emergency_admin", "super_admin"]

[auth.emergency.rate_limit]
max_attempts = 5
window_secs = 900
lockout_secs = 3600

curl -H "X-Emergency-Key: $EMERGENCY_KEY" https://gateway.example.com/admin/v1/organizations

[auth.mode]
type = "none"

[auth.mode]
type = "api_key"

[auth.api_key]
header_name = "X-API-Key"
key_prefix = "gw_"
cache_ttl_secs = 300

[auth.mode]
type = "idp"

[auth.api_key]
key_prefix = "gw_"
cache_ttl_secs = 300

[auth.session]
secure = true
secret = "${SESSION_SECRET}"

[auth.rbac]
enabled = true
default_effect = "deny"
role_claim = "roles"
org_claim = "groups"

[[auth.rbac.policies]]
name = "super-admin"
resource = "*"
action = "*"
condition = "'super_admin' in subject.roles"
effect = "allow"
priority = 100

[[auth.rbac.policies]]
name = "org-member-access"
resource = "*"
action = "*"
condition = "context.org_id in subject.org_ids"
effect = "allow"
priority = 50

[auth.bootstrap]
api_key = "${HADRIAN_BOOTSTRAP_KEY}"
auto_verify_domains = ["acme.com"]

[server.trusted_proxies]
cidrs = ["173.245.48.0/20", "103.21.244.0/22", "103.22.200.0/22", "103.31.4.0/22"]

[auth.mode]
type = "iap"
identity_header = "Cf-Access-Authenticated-User-Email"
email_header = "Cf-Access-Authenticated-User-Email"

[auth.mode.jwt_assertion]
header = "Cf-Access-Jwt-Assertion"
jwks_url = "https://acme-corp.cloudflareaccess.com/cdn-cgi/access/certs"
issuer = "https://acme-corp.cloudflareaccess.com"
audience = "your-app-audience-tag"

[auth.api_key]
key_prefix = "gw_"

[auth.mode]
type = "idp"

[auth.api_key]
key_prefix = "gw_"
cache_ttl_secs = 300

[auth.session]
secure = true
secret = "${SESSION_SECRET}"

[auth.rbac]
enabled = true
default_effect = "deny"
role_claim = "roles"
org_claim = "groups"
team_claim = "groups"

[auth.rbac.audit]
log_allowed = false
log_denied = true

# Deny policies (high priority)
[[auth.rbac.policies]]
name = "deny-self-delete"
resource = "user"
action = "delete"
condition = "subject.user_id == context.resource_id"
effect = "deny"
priority = 200

# Super admin (priority 100)
[[auth.rbac.policies]]
name = "super-admin"
resource = "*"
action = "*"
condition = "'super_admin' in subject.roles"
effect = "allow"
priority = 100

# Org admin (priority 80)
[[auth.rbac.policies]]
name = "org-admin"
resource = "*"
action = "*"
condition = "'org_admin' in subject.roles && context.org_id in subject.org_ids"
effect = "allow"
priority = 80

# Team admin (priority 60)
[[auth.rbac.policies]]
name = "team-admin"
resource = "*"
action = "*"
condition = "'team_admin' in subject.roles && context.team_id in subject.team_ids"
effect = "allow"
priority = 60

# User self-service (priority 40)
[[auth.rbac.policies]]
name = "user-own-resources"
resource = "*"
action = "*"
condition = "context.owner_id == subject.user_id"
effect = "allow"
priority = 40

# Read access for org members (priority 20)
[[auth.rbac.policies]]
name = "org-member-read"
resource = "*"
action = "read"
condition = "context.org_id in subject.org_ids"
effect = "allow"
priority = 20

[auth.rbac.gateway]
enabled = true
default_effect = "allow"

[auth.bootstrap]
admin_identities = ["admin@acme.com"]

[auth.bootstrap.initial_org]
slug = "acme-corp"
name = "Acme Corporation"
admin_identities = ["admin@acme.com"]

[auth.bootstrap.initial_api_key]
name = "admin-key"

[auth.mode]
type = "idp"

[auth.api_key]
key_prefix = "gw_"
cache_ttl_secs = 300

# No global JWT config -- per-org SSO configs provide JWT validation for each org's IdP.

[auth.session]
secure = true
same_site = "lax"
secret = "${SESSION_SECRET}"

[auth.rbac]
enabled = true
default_effect = "deny"

[[auth.rbac.policies]]
name = "super-admin"
resource = "*"
action = "*"
condition = "'super_admin' in subject.roles"
effect = "allow"
priority = 100

[[auth.rbac.policies]]
name = "org-isolation"
resource = "*"
action = "*"
condition = "context.org_id in subject.org_ids"
effect = "allow"
priority = 10

[auth.bootstrap]
api_key = "${HADRIAN_BOOTSTRAP_KEY}"
auto_verify_domains = ["acme.com", "globex.io"]