---
# ############################################
# ## Identity and Access Management (IAM)  ###
# ############################################
# Developer guide for the OIDC variable tree, claim rules, and the per-app
# vs. shared client-template policy:
# @see docs/contributing/design/iam/oidc.md

# ############################################
# ## OIDC                                  ###
# ############################################
# @see https://en.wikipedia.org/wiki/OpenID_Connect

# Helper Variables:
_oidc_client_realm: "{{ OIDC_OVERRIDE.CLIENT.REALM if OIDC_OVERRIDE is defined and OIDC_OVERRIDE.CLIENT is defined and OIDC_OVERRIDE.CLIENT.REALM is defined else
  SOFTWARE_DOMAIN }}"
_oidc_url: "{{ ( OIDC_OVERRIDE.URL if (OIDC_OVERRIDE is defined and OIDC_OVERRIDE.URL is defined) else (lookup('tls', 'web-app-keycloak', 'url.base')) ).rstrip('/')
  }}"
_oidc_client_issuer_url: "{{ _oidc_url ~ '/realms/' ~ _oidc_client_realm }}"
_oidc_client_id: "{{ OIDC_OVERRIDE.CLIENT.ID if OIDC_OVERRIDE is defined and OIDC_OVERRIDE.CLIENT is defined and OIDC_OVERRIDE.CLIENT.ID is defined else SOFTWARE_DOMAIN
  }}"
_oidc_account_url: "{{ _oidc_client_issuer_url ~ '/account' }}"
_oidc_protocol_oidc: "{{ _oidc_client_issuer_url ~ '/protocol/openid-connect' }}"

defaults_oidc:
  URL: "{{ _oidc_url }}"
  CLIENT:
    ID: "{{ _oidc_client_id }}" # Client identifier, typically matching your primary domain
    SECRET: "{{ lookup('config', 'web-app-keycloak', 'secrets.credentials.oidc_client_secret', '') }}" # Defaults to the generated Keycloak credential; set OIDC.CLIENT.SECRET in the inventory to override
    REALM: "{{ _oidc_client_realm }}" # The realm to which the client belongs in the OIDC provider
    ISSUER_URL: "{{ _oidc_client_issuer_url }}" # Issuer URL (must match discovery issuer)
    DISCOVERY_DOCUMENT: "{{ _oidc_client_issuer_url ~ '/.well-known/openid-configuration' }}" # URL for fetching the provider's configuration details
    AUTHORIZE_URL: "{{ _oidc_protocol_oidc ~ '/auth' }}" # Endpoint to start the authorization process
    TOKEN_URL: "{{ _oidc_protocol_oidc ~ '/token' }}" # Endpoint to exchange authorization codes for tokens (note: 'token_url' may be a typo for 'token_url')
    USER_INFO_URL: "{{ _oidc_protocol_oidc ~ '/userinfo' }}" # Endpoint to retrieve user information
    LOGOUT_URL: "{{ _oidc_protocol_oidc ~ '/logout' }}" # Endpoint to log out the user
    CERTS: "{{ _oidc_protocol_oidc ~ '/certs' }}" # JSON Web Key Set endpoint (matches discovery jwks_uri)
    ACCOUNT:
      URL: "{{ _oidc_account_url }}" # Entry point for the user settings console
      PROFILE_URL: "{{ _oidc_account_url ~ '/#/personal-info' }}" # Section for managing personal information
      SECURITY_URL: "{{ _oidc_account_url ~ '/#/security/signingin' }}" # Section for managing login and security settings
    CHANGE_CREDENTIALS: "{{ _oidc_account_url ~ '/account-security/signing-in' }}" # URL for managing or changing user credentials
    RESET_CREDENTIALS: "{{ _oidc_client_issuer_url ~ '/login-actions/reset-credentials?client_id=' ~ _oidc_client_id }}" # Password reset url
  BUTTON_TEXT: "SSO Login ({{ DOMAIN_PRIMARY | upper }})" # Default button text
  ATTRIBUTES:
    USERNAME: "preferred_username"
    GIVEN_NAME: "givenName"
    FAMILY_NAME: "surname"
    EMAIL: "email"

  # Keycloak's own built-in admin realm/client (password-grant Admin REST API automation), distinct from the app's own CLIENT.REALM/CLIENT.ID above.
  ADMIN:
    REALM: "master"
    CLI_CLIENT_ID: "admin-cli"

OIDC: "{{ defaults_oidc | combine(OIDC_OVERRIDE | default({}, true), recursive=True) }}"