# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

---
openapi: 3.0.3
info:
  title: Gravitino Local Users and Groups REST API
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  version: 1.3.0-SNAPSHOT
  description: |
    OpenAPI specification for local user store user and group management APIs exposed
    by the `idp-basic` plugin. Clients authenticate with Basic credentials validated against
    local user metadata. Enable local user store by registering
    `org.apache.gravitino.idp.web.rest.feature` in `gravitino.server.rest.extensionPackages`.
    Local user store is incompatible with the `simple` authenticator (the default),
    `gravitino.authenticators` must include `basic` and must not include `simple`.

servers:
  - url: "{scheme}://{host}:{port}/{basePath}"
    description: Generic base server URL, with all parts configurable.
    variables:
      scheme:
        description: The scheme of the URI, either http or https.
        default: http
      host:
        description: The host address for the specified server
        default: localhost
      port:
        description: The port used when addressing the host
        default: "8090"
      basePath:
        description: Optional prefix to be appended to all routes
        default: "api"

security:
  - BasicAuth: []

paths:
  /idp/users:
    $ref: "./idp.yaml#/paths/~1idp~1users"

  /idp/users/{user}:
    $ref: "./idp.yaml#/paths/~1idp~1users~1%7Buser%7D"

  /idp/users/{user}/password:
    $ref: "./idp.yaml#/paths/~1idp~1users~1%7Buser%7D~1password"

  /idp/users/{user}/enabled:
    $ref: "./idp.yaml#/paths/~1idp~1users~1%7Buser%7D~1enabled"

  /idp/groups:
    $ref: "./idp.yaml#/paths/~1idp~1groups"

  /idp/groups/{group}:
    $ref: "./idp.yaml#/paths/~1idp~1groups~1%7Bgroup%7D"

  /idp/groups/{group}/users:
    $ref: "./idp.yaml#/paths/~1idp~1groups~1%7Bgroup%7D~1users"

components:
  securitySchemes:
    BasicAuth:
      $ref: "../openapi.yaml#/components/securitySchemes/BasicAuth"