% Generated by roxygen2: do not edit by hand
% Please edit documentation in R/auth.R
\name{auth_config}
\alias{auth_config}
\title{Create an authentication configuration}
\usage{
auth_config(
  client_id = Sys.getenv("OIDC_CLIENT_ID"),
  issuer = oidc_issuer(),
  allowed_emails = NULL,
  allowed_domains = NULL,
  custom_validator = NULL
)
}
\arguments{
\item{client_id}{The OIDC client ID (application ID). Validated against the
\code{aud} claim in JWTs. Defaults to the \code{OIDC_CLIENT_ID} environment variable.}

\item{issuer}{The OIDC issuer URL. This is used to discover the provider's
public keys via the \code{.well-known/openid-configuration} endpoint, and to
validate the \code{iss} claim in JWTs. Defaults to the \code{OIDC_ISSUER}
environment variable, falling back to Google
(\code{"https://accounts.google.com"}).}

\item{allowed_emails}{Character vector of allowed email addresses. When set,
a token is rejected unless it carries an \code{email} claim with
\code{email_verified} explicitly \code{TRUE}.}

\item{allowed_domains}{Character vector of allowed email domains
(e.g., "mycompany.com"). Subject to the same verified-email requirement as
\code{allowed_emails}.}

\item{custom_validator}{Function(claims) returning TRUE/FALSE for
custom validation logic. Receives the decoded JWT claims as a list.}
}
\value{
An object of class \code{"autosync_auth_config"}.
}
\description{
Creates a configuration object for enabling OIDC JWT authentication
on an autosync server. When enabled, clients must include a valid JWT
(ID token) as a Bearer token in the Authorization header of the WebSocket
upgrade request. Connections without valid credentials are rejected
immediately at connection time.
}
\details{
Works with any OIDC-compliant identity provider: Google, Microsoft Entra,
Okta, Auth0, etc.
}
\examples{
# Google (default issuer)
auth_config(
  client_id = "123456789.apps.googleusercontent.com",
  allowed_domains = "mycompany.com"
)

# Microsoft Entra
auth_config(
  client_id = "abcdef-1234-5678",
  issuer = "https://login.microsoftonline.com/common/v2.0",
  allowed_emails = "alice@mycompany.com"
)

# Custom validator
auth_config(
  client_id = "0oaXXXXXXXX",
  issuer = "https://dev-123456.okta.com/oauth2/default",
  custom_validator = function(claims) "editors" \%in\% claims$groups
)

}
