package models

import (
	"time"

	"go.mongodb.org/mongo-driver/v2/bson"
)

// AuthProvider is one configured identity provider for one instance.
//
// ProviderID is a short random identifier rather than the Mongo _id: it appears
// in the callback URL a customer pastes into their identity provider, and an
// _id there would publish a database key.
type AuthProvider struct {
	ID              bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
	InstanceID      string        `bson:"instance_id" json:"instance_id"`
	ProviderID      string        `bson:"provider_id" json:"provider_id"`
	Name            string        `bson:"name" json:"name"`
	Kind            string        `bson:"kind" json:"kind"`     // "oidc" | "oauth2"
	Preset          string        `bson:"preset" json:"preset"` // "" for custom
	Issuer          string        `bson:"issuer" json:"issuer"`
	ClientID        string        `bson:"client_id" json:"client_id"`
	ClientSecretEnc string        `bson:"client_secret_enc,omitempty" json:"-"`
	Scopes          []string      `bson:"scopes" json:"scopes"`
	Enabled         bool          `bson:"enabled" json:"enabled"`
	// CallbackNotice marks a provider whose redirect URI changed at the upgrade
	// to per-provider callbacks. Set only by migration 0005; cleared when an
	// administrator acknowledges it in settings.
	CallbackNotice bool      `bson:"callback_notice" json:"callback_notice"`
	Order          int       `bson:"order" json:"order"`
	CreatedAt      time.Time `bson:"created_at" json:"created_at"`
	UpdatedAt      time.Time `bson:"updated_at" json:"updated_at"`
}

const (
	KindOIDC   = "oidc"
	KindOAuth2 = "oauth2"
)
