env:
  contexts:
    - name: invoice-auth
      urls:
        - https://staging.example.com
      includePaths:
        - https://staging\.example\.com/.*
      excludePaths:
        - https://staging\.example\.com/logout.*
      authentication:
        method: form
        parameters:
          loginPageUrl: https://staging.example.com/login
          loginRequestUrl: https://staging.example.com/login
          loginRequestBody: "username={%username%}&password={%password%}"
      sessionManagement:
        method: cookie
      users:
        - name: zap-user
          credentials:
            username: zap_test_user
            password: ${ZAP_PASSWORD}

jobs:
  - type: spider
    parameters:
      context: invoice-auth
      user: zap-user
      url: https://staging.example.com
      maxDuration: 5

  - type: activeScan
    parameters:
      context: invoice-auth
      user: zap-user
      policy: staging-active-authenticated
      maxRuleDurationInMins: 2
      maxScanDurationInMins: 20

  - type: report
    parameters:
      template: traditional-html
      reportDir: reports
      reportFile: zap-authenticated-report.html
