{
  "version": 1,
  "apiKeys": "  alpha : alpha-secret ,\n bare-secret\n, invalid-only-id:   , :invalid-only-key, beta: beta-secret  ",
  "clients": [
    { "id": "alpha", "key": "alpha-secret" },
    { "id": "default", "key": "bare-secret" },
    { "id": "beta", "key": "beta-secret" }
  ],
  "authenticationCases": [
    {
      "name": "case insensitive bearer authenticates",
      "headers": { "authorization": "bEaReR   alpha-secret  " },
      "expected": { "client": { "id": "alpha", "key": "alpha-secret" }, "owner": "api:alpha" }
    },
    {
      "name": "legacy api key header authenticates",
      "headers": { "x-zhinian-api-key": "bare-secret" },
      "expected": { "client": { "id": "default", "key": "bare-secret" }, "owner": "api:default" }
    },
    {
      "name": "bearer takes precedence over legacy header",
      "headers": { "authorization": "Bearer beta-secret", "x-zhinian-api-key": "alpha-secret" },
      "expected": { "client": { "id": "beta", "key": "beta-secret" }, "owner": "api:beta" }
    },
    {
      "name": "invalid bearer does not fall back to legacy header",
      "headers": { "authorization": "Bearer wrong", "x-zhinian-api-key": "alpha-secret" },
      "error": { "status": 401, "message": "Invalid API key." }
    },
    {
      "name": "missing credentials are typed",
      "headers": {},
      "error": { "status": 401, "message": "Missing API key." }
    },
    {
      "name": "different length credential is invalid",
      "headers": { "authorization": "Bearer x" },
      "error": { "status": 401, "message": "Invalid API key." }
    }
  ],
  "ownerCases": [
    { "id": "tenant / 中文!?", "owner": "api:tenant_" },
    { "id": "", "owner": "api:unknown" },
    { "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "owner": "api:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "maxPartLength": 96 },
    { "id": "safe.ID:@-42", "owner": "api:safe.ID:@-42" }
  ],
  "workerCases": [
    {
      "name": "development permits an unconfigured token",
      "production": false,
      "configuredToken": "  ",
      "headers": {},
      "allowed": true
    },
    {
      "name": "production rejects an unconfigured token",
      "production": true,
      "configuredToken": "  ",
      "headers": {},
      "error": { "status": 500, "message": "Worker token is not configured." }
    },
    {
      "name": "worker header authenticates",
      "production": true,
      "configuredToken": " worker-secret ",
      "headers": { "x-zhinian-worker-token": "worker-secret" },
      "allowed": true
    },
    {
      "name": "worker header takes precedence over bearer",
      "production": true,
      "configuredToken": "worker-secret",
      "headers": { "x-zhinian-worker-token": "wrong", "authorization": "Bearer worker-secret" },
      "error": { "status": 401, "message": "Invalid worker token." }
    },
    {
      "name": "worker bearer is case insensitive",
      "production": true,
      "configuredToken": "worker-secret",
      "headers": { "authorization": "BEARER worker-secret" },
      "allowed": true
    },
    {
      "name": "invalid worker token is typed",
      "production": false,
      "configuredToken": "worker-secret",
      "headers": { "x-zhinian-worker-token": "x" },
      "error": { "status": 401, "message": "Invalid worker token." }
    }
  ]
}