Secure logging, Well known

obp-api/src/main/resources/props/sample.props.template

@@ -845,8 +845,26 @@ display_internal_errors=false
 # -- OBP OIDC OAuth 2 / OIDC ---------------------------------------------------
 # To run OBP OIDC (for developer testing) see: https://github.com/OpenBankProject/OBP-OIDC
 # OAuth2 Provider Selection (for well-known endpoint and token validation)
-# Choose which OIDC provider to use: 'keycloak' or 'obp-oidc'
-#oauth2.oidc_provider=obp-oidc
+# Configure which OIDC providers should be advertised by the /well-known endpoint.
+#
+# This property accepts a comma-separated, case-insensitive list of providers.
+# Available values:
+#   - keycloak  → advertise Keycloak well-known URL
+#   - obp-oidc  → advertise OBP-OIDC well-known URL
+#
+# Special cases:
+#   - (property missing) → show nothing
+#   - "" (empty string)  → show all available providers
+#   - none               → show nothing
+#
+# Examples:
+#   oauth2.oidc_provider=keycloak
+#   oauth2.oidc_provider=obp-oidc,keycloak
+#   oauth2.oidc_provider=
+#   oauth2.oidc_provider=none
+#
+# Default: property missing (show nothing)
+#oauth2.oidc_provider=obp-oidc,keycloak
 
 # OBP-OIDC OAuth2 Provider Settings
 #oauth2.obp_oidc.host=http://localhost:9000
@@ -1566,3 +1584,38 @@ redis_logging_circuit_breaker_reset_ms = 60000
 
 # Experimental Developer Use only
 experimental_become_user_that_created_consent=false
+
+
+### ============================================================
+### Secure Logging Masking Configuration
+### Default: true (masking ON)
+### Set to false to disable masking for a given pattern
+### ============================================================
+
+# OAuth2 / API secrets
+securelogging_mask_secret=true
+securelogging_mask_client_secret=true
+
+# Authorization / Tokens
+securelogging_mask_authorization=true
+securelogging_mask_access_token=true
+securelogging_mask_refresh_token=true
+securelogging_mask_id_token=true
+securelogging_mask_token=true
+
+# Passwords
+securelogging_mask_password=true
+
+# API keys
+securelogging_mask_api_key=true
+securelogging_mask_key=true
+securelogging_mask_private_key=true
+
+# Database
+securelogging_mask_jdbc=true
+
+# Credit card
+securelogging_mask_credit_card=true
+
+# Email addresses
+securelogging_mask_email=true

obp-api/src/main/scala/code/api/ResourceDocs1_4_0/SwaggerDefinitionsJSON.scala

@@ -3965,6 +3965,48 @@ object SwaggerDefinitionsJSON {
     )
   )
 
+  lazy val callLimitPostJsonV600 = CallLimitPostJsonV600(
+    from_date = DateWithDayExampleObject,
+    to_date = DateWithDayExampleObject,
+    api_version = Some("v6.0.0"),
+    api_name = Some("getConsumerCallLimits"),
+    bank_id = None,
+    per_second_call_limit = "100",
+    per_minute_call_limit = "1000",
+    per_hour_call_limit = "-1",
+    per_day_call_limit = "-1",
+    per_week_call_limit = "-1",
+    per_month_call_limit = "-1"
+  )
+
+  lazy val callLimitJsonV600 = CallLimitJsonV600(
+    rate_limiting_id = "80e1e0b2-d8bf-4f85-a579-e69ef36e3305",
+    from_date = DateWithDayExampleObject,
+    to_date = DateWithDayExampleObject,
+    api_version = Some("v6.0.0"),
+    api_name = Some("getConsumerCallLimits"),
+    bank_id = None,
+    per_second_call_limit = "100",
+    per_minute_call_limit = "1000",
+    per_hour_call_limit = "-1",
+    per_day_call_limit = "-1",
+    per_week_call_limit = "-1",
+    per_month_call_limit = "-1",
+    created_at = DateWithDayExampleObject,
+    updated_at = DateWithDayExampleObject
+  )
+
+  lazy val activeCallLimitsJsonV600 = ActiveCallLimitsJsonV600(
+    call_limits = List(callLimitJsonV600),
+    active_at_date = DateWithDayExampleObject,
+    total_per_second_call_limit = 100,
+    total_per_minute_call_limit = 1000,
+    total_per_hour_call_limit = -1,
+    total_per_day_call_limit = -1,
+    total_per_week_call_limit = -1,
+    total_per_month_call_limit = -1
+  )
+
   lazy val accountWebhookPostJson = AccountWebhookPostJson(
     account_id =accountIdExample.value,
     trigger_name = ApiTrigger.onBalanceChange.toString(),

obp-api/src/main/scala/code/api/util/ApiRole.scala

@@ -483,6 +483,9 @@ object ApiRole extends MdcLoggable{
   case class CanSetCallLimits(requiresBankId: Boolean = false) extends ApiRole
   lazy val canSetCallLimits = CanSetCallLimits()
 
+  case class CanDeleteRateLimiting(requiresBankId: Boolean = false) extends ApiRole
+  lazy val canDeleteRateLimiting = CanDeleteRateLimiting()
+
   case class CanCreateCustomerMessage(requiresBankId: Boolean = true) extends ApiRole
   lazy val canCreateCustomerMessage = CanCreateCustomerMessage()  
 
@@ -1168,7 +1171,8 @@ object Util {
         "CanCheckFundsAvailable", 
         "CanRefreshUser", 
         "CanReadFx", 
-        "CanSetCallLimits"
+        "CanSetCallLimits",
+        "CanDeleteRateLimiting"
       )
 
     val allowed = allowedPrefixes ::: allowedExistingNames

obp-api/src/main/scala/code/api/util/NewStyle.scala

@@ -90,6 +90,12 @@ object NewStyle extends MdcLoggable{
     def `204`(callContext: CallContext): Option[CallContext] = {
       Some(callContext.copy(httpCode = Some(204)))
     }
+    def `400`(callContext: CallContext): Option[CallContext] = {
+      Some(callContext.copy(httpCode = Some(400)))
+    }
+    def `400`(callContext: Option[CallContext]): Option[CallContext] = {
+      callContext.map(_.copy(httpCode = Some(400)))
+    }
     def `404`(callContext: CallContext): Option[CallContext] = {
       Some(callContext.copy(httpCode = Some(404)))
     }

obp-api/src/main/scala/code/api/v5_1_0/APIMethods510.scala

@@ -53,7 +53,7 @@ import com.openbankproject.commons.ExecutionContext.Implicits.global
 import com.openbankproject.commons.model._
 import com.openbankproject.commons.model.enums.{TransactionRequestStatus, _}
 import com.openbankproject.commons.util.{ApiVersion, ScannedApiVersion}
-import net.liftweb.common.Full
+import net.liftweb.common.{Empty, Full}
 import net.liftweb.http.rest.RestHelper
 import net.liftweb.json
 import net.liftweb.json.{Extraction, compactRender, parse, prettyRender}
@@ -159,22 +159,55 @@ trait APIMethods510 {
       List(apiTagApi))
 
     lazy val getOAuth2ServerWellKnown: OBPEndpoint = {
-      case "well-known" :: Nil JsonGet _ => {
-        cc =>
-          implicit val ec = EndpointContext(Some(cc))
-          for {
-            (_, callContext) <- anonymousAccess(cc)
-          } yield {
-            // Advertise the configured OIDC provider for this OBP-API instance
-            // Check if OBP-OIDC is configured, otherwise default to Keycloak
-            val oidcProvider = APIUtil.getPropsValue("oauth2.oidc_provider", "keycloak").toLowerCase match {
-              case "obp-oidc" | "obpoidc" =>
-                WellKnownUriJsonV510("obp-oidc", OBPOIDC.wellKnownOpenidConfiguration.toURL.toString)
-              case _ =>
-                WellKnownUriJsonV510("keycloak", Keycloak.wellKnownOpenidConfiguration.toURL.toString)
-            }
-            (WellKnownUrisJsonV510(List(oidcProvider)), HttpCode.`200`(callContext))
+      case "well-known" :: Nil JsonGet _ => { cc =>
+        implicit val ec = EndpointContext(Some(cc))
+        for {
+          (_, callContext) <- anonymousAccess(cc)
+        } yield {
+          // Read and normalize property
+          val providerPropBox = APIUtil.getPropsValue("oauth2.oidc_provider")
+
+          // Define available providers
+          val availableProviders = Map(
+            "obp-oidc" -> WellKnownUriJsonV510("obp-oidc", OBPOIDC.wellKnownOpenidConfiguration.toURL.toString),
+            "keycloak" -> WellKnownUriJsonV510("keycloak", Keycloak.wellKnownOpenidConfiguration.toURL.toString)
+          )
+
+          // Resolve list of providers to show
+          val providersToShow: List[WellKnownUriJsonV510] = providerPropBox match {
+            case Empty =>
+              // Property missing: show nothing
+              Nil
+
+            case Full(value) if value.trim.isEmpty =>
+              // Empty string: show all
+              availableProviders.values.toList
+
+            case Full(value) =>
+              val wanted = value
+                .split(",")
+                .map(_.trim.toLowerCase)
+                .filter(_.nonEmpty)
+                .toSet
+
+              // Special case: "none" means show nothing
+              if (wanted.contains("none")) {
+                Nil
+              } else {
+                val (known, unknown) = wanted.partition(availableProviders.contains)
+                availableProviders
+                  .filterKeys(known.contains)
+                  .values
+                  .toList
+              }
+
+            case _ =>
+              // Unexpected case, fallback to show nothing
+              Nil
           }
+
+          (WellKnownUrisJsonV510(providersToShow), HttpCode.`200`(callContext))
+        }
       }
     }