config

type Config struct {
	Inherit   bool             `yaml:"inherit"` // Whether to inherit system environment variables (default: true)
	Providers []ProviderConfig `yaml:"providers"`
	SSO       *SSOConfig       `yaml:"sso,omitempty"` // SSO configuration
}

type EnvVars map[string]string

type OIDCConfig struct {
	ClientID     string   `yaml:"clientId"`               // OIDC client ID (required)
	ClientSecret string   `yaml:"-"`                      // OIDC client secret (only from env var SSTART_SSO_SECRET, never from YAML)
	Issuer       string   `yaml:"issuer"`                 // OIDC issuer URL (required)
	Scopes       []string `yaml:"scopes"`                 // OIDC scopes (required)
	RedirectURI  string   `yaml:"redirectUri,omitempty"`  // OIDC redirect URI (optional, can be auto-generated)
	PKCE         *bool    `yaml:"pkce,omitempty"`         // Enable PKCE flow (optional, auto-enabled if clientSecret is empty)
	ResponseMode string   `yaml:"responseMode,omitempty"` // OIDC response mode (optional)
}

type ProviderConfig struct {
	Kind   string                 `yaml:"kind"`
	ID     string                 `yaml:"id,omitempty"`   // Optional: defaults to 'kind'. Required if multiple providers share the same kind
	Config map[string]interface{} `yaml:"-"`              // Provider-specific configuration (e.g., path, region, endpoint, etc.)
	Keys   map[string]string      `yaml:"keys,omitempty"` // Optional key mappings (source_key: target_key, or "==" to keep same name)
	Env    EnvVars                `yaml:"env,omitempty"`
	Uses   []string               `yaml:"uses,omitempty"` // Optional list of provider IDs to depend on
}

type SSOConfig struct {
	OIDC *OIDCConfig `yaml:"oidc,omitempty"` // OIDC configuration
}