# Increase buffer size for large headers (only if you encounter large upstream headers)
proxy_buffers 8 16k;        # optional, only if needed for big headers
proxy_buffer_size 32k;      # optional, only if needed for big headers

# Protect the whole site
location / {
    # application upstream (fill in your upstream; in NPM this is handled by proxy_pass to your container)
    proxy_pass          $forward_scheme://$server:$port;  # placeholder used by NPM Advanced config

    # Enforce SSO via internal subrequest
    auth_request        /auth;                             # subrequest to internal /auth
    error_page          401 = @sso_signin;                 # handle 401 by redirecting to SSO

    # Optionally forward user attributes from SSO (if SSO returns headers)
    auth_request_set    $sso_user   $upstream_http_x_user;
    auth_request_set    $sso_user_uuid  $upstream_http_x_user_uuid;
    auth_request_set    $sso_displayname $upstream_http_x_user_displayname;
    
    proxy_set_header    X-User      $sso_user;
    proxy_set_header    X-User-UUID        $sso_user_uuid;
    proxy_set_header    X-User-Displayname $sso_displayname;
}

# Internal auth subrequest endpoint
location = /auth {
    internal;                                               # only subrequests can hit this
    proxy_pass              http://guard/auth_request;  # your SSO check URL

    proxy_pass_request_body off;                            # discard body for subrequest
    proxy_set_header        Content-Length "";              # required with body off

    # Send original request context to SSO
    proxy_set_header        X-Original-URI   $request_uri;  # original path+query
    proxy_set_header        Host             $host;         # preserve host if SSO needs it
    proxy_set_header        X-Original-Method $request_method; # optional, if your SSO uses it

    # Forward cookies if the SSO relies on session cookies from the protected domain
    proxy_set_header        Cookie          $http_cookie;   # forward inbound cookies to SSO
}

# Sign-in redirect on 401 from SSO
location @sso_signin {
    internal;
    # Redirect to your SSO login/start page with return-to; adjust to your SSO’s expected param
    return 302 https://guard.example.com/login?proxy=true&redirect_uri=$scheme://$http_host$request_uri;  # preserve full URL
}