package com.cameleer.server.core.security;

import java.util.List;

/**
 * Persisted OIDC provider configuration.
 *
 * @param enabled      whether OIDC login is active
 * @param issuerUri    OIDC discovery issuer URL
 * @param clientId     OAuth2 client ID
 * @param clientSecret OAuth2 client secret (stored server-side only)
 * @param rolesClaim        dot-separated path to roles in the id_token (e.g. {@code realm_access.roles})
 * @param defaultRoles      fallback roles for new users with no OIDC role claim
 * @param autoSignup        whether new OIDC users are automatically created on first login
 * @param displayNameClaim  dot-separated path to display name in the id_token (e.g. {@code name}, {@code preferred_username})
 * @param userIdClaim       dot-separated path to user identifier in the id_token (default {@code sub}); e.g. {@code email}, {@code preferred_username}
 * @param audience          RFC 8707 resource indicator — sent to SPA as {@code resource} param and used for access_token {@code aud} validation
 * @param additionalScopes  extra scopes the SPA should request beyond {@code openid email profile}
 */
public record OidcConfig(
        boolean enabled,
        String issuerUri,
        String clientId,
        String clientSecret,
        String rolesClaim,
        List<String> defaultRoles,
        boolean autoSignup,
        String displayNameClaim,
        String userIdClaim,
        String audience,
        List<String> additionalScopes
) {
    public static OidcConfig disabled() {
        return new OidcConfig(false, "", "", "", "roles", List.of("VIEWER"), true, "name", "sub", "", List.of());
    }
}
