# Authentication types for Snowflake.
#
# One profile per type: set ETL_CRAFT_AUTH to the one you use.
#   password  verified
#   token     verified: a Programmatic Access Token (needs a network policy)
#   key_file  RSA key pair: the private key's path, and its passphrase if it has one
#   oauth     the connector's OAUTH_CLIENT_CREDENTIALS against your identity
#             provider's token_url
#   sso       the connector's external browser login: interactive only
#   sts       WORKLOAD_IDENTITY with the AWS provider: the ambient AWS identity,
#             no stored secret
#
# Types marked verified have run against a live service in this project. The
# others follow the vendor's documentation and are untested here: they can be
# used, but success is not guaranteed, and `etl-craft doctor` says so.
#
# Each setting is marked `# variable` or `# value`. A variable is looked up in
# the secrets source (here: the process environment); when it is not set, the
# text itself is used, so `Profile: dev` is simply dev. A secret must always
# be a variable that is set. `etl-craft doctor` lists every value used as
# written that looks like a variable name.
#
# Complete and loadable as written: tests/unit/test_config_examples.py loads every
# file in this directory, for every profile it declares.

Secrets:
  Source_type: environment             # value
  Profile: ETL_CRAFT_AUTH              # variable — the profile names the authentication type to use

Orchestration:
  Mode: local                          # value
  Task_timeout_seconds: 21600          # value
  Max_parallel_tasks: 8                # value
  Enforce_sla: false                   # value

Engine:
  Profile: dev                         # value — this file varies only the login, not the Engine DB
  dev:
    jdbc_url: jdbc:sqlite:etl-craft-engine.db  # value
    schema: main                       # value — SQLite: the database file is the schema

Warehouse:
  Name: Snowflake                      # value
  Table_format: native                 # value
  password:
    user: WAREHOUSE_USER               # variable
    account: WAREHOUSE_ACCOUNT         # variable
    database: WAREHOUSE_DATABASE       # variable
    schema: WAREHOUSE_SCHEMA           # variable
    warehouse: WAREHOUSE_WAREHOUSE     # variable
    role: WAREHOUSE_ROLE               # variable
    auth_mode: password                # value
    secret: WAREHOUSE_SECRET           # variable, required: a secret is never used as written
  token:
    user: WAREHOUSE_USER               # variable
    account: WAREHOUSE_ACCOUNT         # variable
    database: WAREHOUSE_DATABASE       # variable
    schema: WAREHOUSE_SCHEMA           # variable
    warehouse: WAREHOUSE_WAREHOUSE     # variable
    role: WAREHOUSE_ROLE               # variable
    token: WAREHOUSE_TOKEN             # variable, required: a secret is never used as written — auth_mode is token
  key_file:
    user: WAREHOUSE_USER               # variable
    account: WAREHOUSE_ACCOUNT         # variable
    database: WAREHOUSE_DATABASE       # variable
    schema: WAREHOUSE_SCHEMA           # variable
    warehouse: WAREHOUSE_WAREHOUSE     # variable
    role: WAREHOUSE_ROLE               # variable
    auth_mode: key_file                # value
    key_file: WAREHOUSE_KEY_FILE       # variable
    secret: WAREHOUSE_SECRET           # variable — the key's passphrase; leave the line out for a key without one
  oauth:
    user: WAREHOUSE_USER               # variable
    account: WAREHOUSE_ACCOUNT         # variable
    database: WAREHOUSE_DATABASE       # variable
    schema: WAREHOUSE_SCHEMA           # variable
    warehouse: WAREHOUSE_WAREHOUSE     # variable
    role: WAREHOUSE_ROLE               # variable
    auth_mode: oauth                   # value
    client_id: WAREHOUSE_CLIENT_ID     # variable
    secret: WAREHOUSE_SECRET           # variable, required: a secret is never used as written — the client secret
    token_url: WAREHOUSE_TOKEN_URL     # variable
    scope: WAREHOUSE_SCOPE             # variable
  sso:
    user: WAREHOUSE_USER               # variable
    account: WAREHOUSE_ACCOUNT         # variable
    database: WAREHOUSE_DATABASE       # variable
    schema: WAREHOUSE_SCHEMA           # variable
    warehouse: WAREHOUSE_WAREHOUSE     # variable
    role: WAREHOUSE_ROLE               # variable
    auth_mode: sso                     # value
  sts:
    user: WAREHOUSE_USER               # variable
    account: WAREHOUSE_ACCOUNT         # variable
    database: WAREHOUSE_DATABASE       # variable
    schema: WAREHOUSE_SCHEMA           # variable
    warehouse: WAREHOUSE_WAREHOUSE     # variable
    role: WAREHOUSE_ROLE               # variable
    auth_mode: sts                     # value