package main

// keycloak handed to the provisioner (novox/hq ADR 0373, ADR 0349 clause 12, issue 805): where its consumers file
// is set, keycloak runs on the SDK's provider helper instead of the harness reading the controller's grant files.
//
// The helper learns who binds keycloak from the plans, composes each consumer's entry and reads its credential
// through ConsumersFile, the file this machine's provisioner client fills. It leaves the rest to the two hooks
// here: Make brings the consumer's OIDC client into being exactly as the harness's adapter does, and Gone leaves
// retirement to the harness's guards (the SDK's harness retirement): the client is disabled and marked to delete, never removed.

import (
	"git.novox.be/novox/mesh-sdk/go/provider"
	"git.novox.be/novox/mesh-sdk/go/provider/harness"
)

// ProvisionName is what keycloak provides, as its manifest says.
const ProvisionName = "oidc-client"

// servedValues is what its manifest serves (`serves.oidc-client`): the paths as they are, and the issuer as its own
// config says, which is the one the code reads (Issuer), not a value the helper reads from the manifest.
func servedValues(issuer string) map[string]any {
	return map[string]any{
		"issuer":             issuer,
		"authorization-path": "/protocol/openid-connect/auth",
		"token-path":         "/protocol/openid-connect/token",
		"userinfo-path":      "/protocol/openid-connect/userinfo",
	}
}

// valuesOf is what the consumer's grant file gave the harness as its values: what it contributes (label, endpoint,
// callback), with the names the controller composed for it (name, internal-name) over them (issue 792).
func valuesOf(e provider.Entry) map[string]any {
	values := map[string]any{}
	for k, v := range e.Contributes {
		values[k] = v
	}
	for k, name := range e.Names {
		values[k] = name
	}
	return values
}

// moved is keycloak handed to the provisioner: the SDK's moved path (harness.Moved) answering its consumers, and the
// harness (never run) whose retirement and tools it shares. What differs from postgres is only this declaration
// (issue 849).
func moved(consumersFile string, h *harness.Harness, issuer string) (*harness.Moved, *provider.Provider, provider.Bus, error) {
	return harness.NewMoved(consumersFile, h, harness.MovedSpec{Module: "keycloak", Provision: ProvisionName,
		Offer:  provider.Offer{Credential: provider.PerConsumer, Serves: servedValues(issuer)},
		Login:  func(e provider.Entry) string { return e.As },
		Values: valuesOf,
		Noun:   "client id", Made: "client", Backend: "Keycloak", WithGrants: false})
}