# The following properties apply during execution of the service (except during integration tests.)
# These properties can be overridden by settings in the host system environment variables,
# which is the expected method for overriding properties of this service in environments like
# sandbox, staging, production, etc.  The values defined below are tuned/set to work for a developer
# running this service locally.


# PROJECT

spring.application.name=reporting
build.project.version=0.0.1-SNAPSHOT
build.timestamp=2026-07-04T04:16:27Z


# SERVER

server.port=8071
server.servlet.context-path=/reporting/v1
server.forward-headers-strategy=FRAMEWORK
server.max-http-request-header-size=100000


# ACTUATOR

# Spring Boot provides built in monitoring and management tools as "actuators".  These can be
# turned on/off as a whole or individually, and when on, they can be exposed via an HTTP endpoint
# or via JMX.
# Some actuators are POWERFUL AND DANGEROUS.  Do not expose actuator endpoints via the public API.
#
# See https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints
#
# By (Spring Boot) default, all endpoints are enabled with the one exception of shutdown.
#
# By (Spring Boot) default, only the health endpoint is exposed over HTTP.  We override that setting
# and expose all actuator endpoints over HTTP.  This service should always exist behind a gateway
# which does not route actuator endpoint requests.  Actuator endpoint access requires bastion access
# 'behind' the gateway.
management.endpoints.web.exposure.include=*


# LOGGING

# By default this service logs at debug level.
logging.level.io.netfoundry=DEBUG

# The Http-Audit-Log is a special logger within the DiagnosticsServletFilter which intercepts all HTTP requests
# and logs it.  At INFO level, the logs are like a traditional HTTP Access Log with a record of every API call,
# the amount of time it took to process, the response code, etc.  At DEBUG level, the full body of the request
# is logged.  At TRACE, the full body of the response is logged.
# By default, we deploy with the audit log at DEBUG level and ops uses rules in Kibana to drop the larger DEBUG
# audit log entries after a few days and retain the smaller INFO entries for a longer duration.
logging.level.Http-Audit-Log=DEBUG

# Uncomment the following common logging names in order to temporarily increase logging level.
# Please keeps these increased logging configurations commented out when submitting this file to source control.
# logging.level.io.netfoundry.common=TRACE
# logging.level.io.netfoundry.common.util.RestServiceClient=TRACE
# logging.level.org.springframework=DEBUG


# METRICS

# This service uses micrometer metrics and is generally configured to export to an elastic index.
# For local development, exporting of metrics is turned OFF via the below setting.  Sandbox, Staging, and other
# environments where there is an elastic index to which metrics should be exported ... should override this
# property (via environment variable) and set it to true.
management.defaults.metrics.export.enabled=false
# metrics configuration, applicable only when enabled.
management.elastic.metrics.export.step=PT10S
management.elastic.metrics.export.index=micrometer-metrics
management.elastic.metrics.export.index-date-format=yyyy
management.elastic.metrics.export.auto-create-index=true
management.metrics.distribution.percentiles-histogram.http.server.requests=true
management.metrics.distribution.percentiles.http.server.requests=0.5, 0.9, 0.95, 0.99
management.metrics.tags.application=reporting
management.metrics.tags.hostname=${HOSTNAME}
management.simple.metrics.export.enabled=false
management.elastic.metrics.export.enabled=true


# SERVICE AUTH0 IDENTITY

io.netfoundry.auth.provider.auth0.issuer=https://netfoundry-sandbox.auth0.com/
io.netfoundry.auth.provider.auth0.audience=http://localhost:8080/
io.netfoundry.reporting.provider.auth0.clientId=UQ2JevO33OqrtrfaaUu2tfdeSCfync7p
io.netfoundry.reporting.provider.auth0.clientSecret=t2mUrMen_KE2VwliYdTM-T8qJypcsaVqQVkG3p5mv8WIe6DAU1dLjlveXSOVw6sN


# MOP SERVICE LOCATIONS (only list services that this reporting service makes inter-service API requests to)
io.netfoundry.auth.serviceUrl=http://localhost:8095



# Let queries run for up to 60s
spring.elasticsearch.socket-timeout: 60s


# MCP SERVER

# Exposes the Customer-Connect reporting templates as MCP tools over the Streamable HTTP transport in
# STATELESS mode: a single endpoint where each JSON-RPC POST is independent — no SSE stream and no
# Mcp-Session-Id handshake. This is the right fit for a read-only, tools-only server (we never push
# server-initiated notifications), and it avoids the session-header fragility through this service's
# custom audit filter chain (DiagnosticsServletFilter). In-process over the existing servlet
# pipeline, so the auth middleware that populates AuthorizationContext from the caller's JWT applies
# unchanged on each tool POST. STDIO is disabled so the only way in is an authenticated HTTP request.
#
# The endpoint is served under the context-path: POST http://<host>/reporting/v1/mcp
spring.ai.mcp.server.enabled=true
spring.ai.mcp.server.stdio=false
spring.ai.mcp.server.protocol=STATELESS
spring.ai.mcp.server.type=SYNC
spring.ai.mcp.server.name=reporting-cc
spring.ai.mcp.server.version=0.0.1-SNAPSHOT
spring.ai.mcp.server.streamable-http.mcp-endpoint=/mcp

# Server-level instructions returned in the MCP initialize response. Advisory and host-dependent (a
# client may or may not surface it to the model), so it complements — never replaces — the per-tool
# descriptions and the server-side validation/authorization. States the surface's shape and the scope
# contract every tool shares.
spring.ai.mcp.server.instructions=This server exposes read-only Customer-Connect reporting tools that run curated, allow-listed Elasticsearch search templates. Every tool is scoped to one network and REQUIRES both networkId and networkGroupId on every call (a network belongs to a network group); obtain both from the Customer-Connect getProvider tool. Do not pass providerId — these tools scope on the network, not the provider. Time ranges use gte/lte as ISO-8601 (e.g. 2026-06-01T00:00:00Z) or relative expressions (now-7d, now). Results are the raw Elasticsearch aggregation/hit JSON. There is no generic query capability: only the named templates are callable, and only for networks you are authorized to read.

# Customer-Connect template drift check: on startup, fetch each allow-listed template from ES
# _scripts/{id}, parse its mustache placeholders, and reconcile against the declared descriptor.
# fail-on-undeclared=false logs WARN for placeholders not yet declared (discovery aid) rather than
# failing boot; a declared param missing from the live template always fails fast.
reporting.cc.drift-check.enabled=true
reporting.cc.drift-check.fail-on-undeclared=false