oidc

type OIDCConfig struct {
	Issuer                          string
	Audience                        string
	JWKSURL                         string
	IntrospectionURL                string
	ClientID                        string
	ClientSecret                    string // #nosec G117 -- not a hardcoded credential, populated at runtime from config
	ThvCABundlePath                 string
	JWKSAuthTokenPath               string
	ResourceURL                     string
	JWKSAllowPrivateIP              bool
	ProtectedResourceAllowPrivateIP bool
	InsecureAllowHTTP               bool
	Scopes                          []string
}

type OIDCConfigurable interface {
	GetName() string
	GetNamespace() string
	GetOIDCConfig() *mcpv1alpha1.OIDCConfigRef
	GetProxyPort() int32
}

type Resolver interface {
	// Resolve takes any resource implementing OIDCConfigurable and resolves its OIDC config
	Resolve(ctx context.Context, resource OIDCConfigurable) (*OIDCConfig, error)

	// ResolveFromConfigRef resolves OIDC configuration from an MCPOIDCConfig reference.
	// It fetches the MCPOIDCConfig resource and merges shared provider config with
	// per-server overrides (audience, scopes) from the reference.
	ResolveFromConfigRef(
		ctx context.Context,
		oidcConfigRef *mcpv1alpha1.MCPOIDCConfigReference,
		oidcConfig *mcpv1alpha1.MCPOIDCConfig,
		serverName, namespace string,
		proxyPort int32,
	) (*OIDCConfig, error)
}