version: 1
metadata:
  name: Million Miles Authentik POC
entries:
  - model: authentik_flows.flow
    id: mm-custom-authentication-flow
    identifiers:
      slug: mm-custom-authentication-flow
    attrs:
      name: Million Miles Custom Authentication
      title: Million Miles
      designation: authentication
      authentication: none
      layout: stacked
      denied_action: message_continue

  - model: authentik_stages_password.passwordstage
    id: mm-custom-authentication-password
    identifiers:
      name: mm-custom-authentication-password
    attrs:
      backends:
        - authentik.core.auth.InbuiltBackend
      failed_attempts_before_cancel: 5
      allow_show_password: true

  - model: authentik_stages_identification.identificationstage
    id: mm-custom-authentication-identification
    identifiers:
      name: mm-custom-authentication-identification
    attrs:
      user_fields:
        - email
        - username
      case_insensitive_matching: true
      show_matched_user: false
      password_stage: !KeyOf mm-custom-authentication-password

  - model: authentik_stages_user_login.userloginstage
    id: mm-custom-authentication-login
    identifiers:
      name: mm-custom-authentication-login
    attrs:
      session_duration: hours=8

  - model: authentik_flows.flowstagebinding
    identifiers:
      target: !KeyOf mm-custom-authentication-flow
      stage: !KeyOf mm-custom-authentication-identification
      order: 10
    attrs:
      re_evaluate_policies: true
      invalid_response_action: retry
      policy_engine_mode: all

  - model: authentik_flows.flowstagebinding
    identifiers:
      target: !KeyOf mm-custom-authentication-flow
      stage: !KeyOf mm-custom-authentication-login
      order: 20
    attrs:
      re_evaluate_policies: true
      invalid_response_action: retry
      policy_engine_mode: all

  - model: authentik_providers_oauth2.oauth2provider
    id: mm-custom-frontend-provider
    identifiers:
      name: Million Miles Custom Frontend
    attrs:
      name: Million Miles Custom Frontend
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
      client_type: confidential
      client_id: mm-custom-frontend
      client_secret: mm-custom-secret
      access_code_validity: minutes=10
      access_token_validity: minutes=5
      refresh_token_validity: days=30
      include_claims_in_id_token: true
      issuer_mode: per_provider
      sub_mode: hashed_user_id
      signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
      redirect_uris:
        - url: http://localhost:3000/auth/callback
          matching_mode: strict
      property_mappings:
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]

  - model: authentik_core.application
    id: mm-custom-frontend-application
    identifiers:
      slug: mm-custom-frontend
    attrs:
      name: Million Miles
      slug: mm-custom-frontend
      provider: !KeyOf mm-custom-frontend-provider
      policy_engine_mode: any