keycloak

type ClientScopeSpec struct {
	Name        string
	Protocol    string // typically "openid-connect"
	Description string

	// ConsentScreenText is the display label Keycloak shows on the
	// "Grant Access to <client>" consent page in lieu of the raw
	// scope Name. When unset Keycloak falls back to Name verbatim,
	// which is fine for things like "email" but produces lowercase
	// fragments like "api" / "groups" next to neatly cased built-in
	// scopes ("Email address", "User profile") — set this to
	// "API" / "Groups" / etc. to keep the consent screen tidy.
	//
	// Stored under the `consent.screen.text` attribute on the
	// ClientScope representation, not a top-level field.
	ConsentScreenText string

	// IncludeInTokenScope controls whether the scope's name appears
	// in the issued token's `scope` claim. NetBird's docs require
	// this on for the `groups` scope so the operator's Keycloak
	// groups land in the JWT — Keycloak stores it as the
	// `include.in.token.scope` attribute on the ClientScope
	// representation, not a top-level field.
	IncludeInTokenScope bool
}

type ClientSpec struct {
	// ClientID is the OIDC client_id (also Keycloak's display name
	// in the admin UI's Clients list). Required.
	ClientID string

	// PublicClient = true means PKCE / no client secret (browser
	// SSO, kubelogin). false means confidential — Keycloak issues
	// (or accepts a pre-set) client secret.
	PublicClient bool

	// ServiceAccountsEnabled = true makes Keycloak auto-create a
	// service-account user for this confidential client. Only
	// valid when PublicClient is false.
	ServiceAccountsEnabled bool

	// StandardFlowEnabled controls authorization-code (browser)
	// flow. DirectAccessGrantsEnabled controls Resource Owner
	// Password Credentials. Default both off; callers opt in.
	StandardFlowEnabled       bool
	DirectAccessGrantsEnabled bool

	// RedirectURIs / WebOrigins are required for browser flows
	// (PKCE). Ignored for purely backend confidential clients.
	RedirectURIs []string
	WebOrigins   []string

	// Secret pre-sets the confidential client's secret on creation.
	// When empty, Keycloak generates a random one. Ignored for
	// PublicClient = true.
	Secret string

	// DeviceAuthorizationGrantEnabled controls whether the client can
	// initiate the OAuth 2.0 Device Authorization Grant flow
	// (RFC 8628). Required for headless CLI tools — NetBird's
	// `netbird up`, for instance — that can't host an
	// authorization-code redirect URI. Keycloak stores this as the
	// `oauth2.device.authorization.grant.enabled` client attribute,
	// not a top-level Client field, so buildClient translates the
	// bool onto the Attributes map.
	DeviceAuthorizationGrantEnabled bool
}

type KubernetesSpec struct {
	// Realm is the Keycloak realm name (typically derived from the
	// public DNS — see cluster.keycloak.realm).
	Realm string

	// ClusterName is the Kubernetes cluster's name (cluster.name).
	// The OIDC client created in Keycloak is named
	// `kubernetes-<ClusterName>`.
	ClusterName string

	// RedirectURIs are the redirect URIs for kubelogin's localhost
	// callback. Defaults to defaultKubeloginRedirectURIs when empty.
	RedirectURIs []string

	// DefaultScopes are extra ClientScope names to assign as defaults
	// on the kubernetes client (e.g., the NetBird api scope so the
	// audience mapper covers kubelogin tokens too). May be empty.
	DefaultScopes []string
}

type NetBirdSpec struct {
	// Realm is the Keycloak realm name (typically derived from the
	// public DNS — see cluster.keycloak.realm).
	Realm string

	// NetBirdMgmtURL is the public URL of the NetBird Management
	// UI (e.g., https://netbird.<vpn-dns>). Used as netbird-client's
	// redirect URI base (browser SSO + dashboard) and Web Origin.
	// NOT the JWT audience — that's the netbird-client client_id,
	// keyed on a separate netBirdClientID const so the value can
	// also surface in the api scope's audience ProtocolMapper.
	NetBirdMgmtURL string

	// NetBirdBackendSecret is the pre-generated client secret to
	// assign to `netbird-backend` on create. Pre-setting avoids a
	// second git push: kubeaid-cli renders the SealedSecret with
	// this value before ever calling the Keycloak admin API, then
	// hands the same value to ReconcileClient via spec.Secret.
	NetBirdBackendSecret string
}

type ProtocolMapperSpec struct {
	Name           string
	Protocol       string // "openid-connect"
	ProtocolMapper string // e.g. "oidc-audience-mapper"
	Config         map[string]string
}

type Reconciler struct {
	// contains filtered or unexported fields
}

type UserSpec struct {
	Username  string
	Email     string
	FirstName string
	LastName  string

	// Enabled defaults to true. Set explicitly for clarity in
	// callers, so a zero-value spec doesn't silently create a
	// disabled user.
	Enabled bool
}