oidc

type OIDCConfig struct {
	Issuer                          string
	Audience                        string
	JWKSURL                         string
	IntrospectionURL                string
	ClientID                        string
	ClientSecret                    string // #nosec G117 -- not a hardcoded credential, populated at runtime from config
	ThvCABundlePath                 string
	JWKSAuthTokenPath               string
	ResourceURL                     string
	JWKSAllowPrivateIP              bool
	ProtectedResourceAllowPrivateIP bool
	InsecureAllowHTTP               bool
	Scopes                          []string
}

type Resolver interface {
	// ResolveFromConfigRef resolves OIDC configuration from an MCPOIDCConfig reference.
	// It fetches the MCPOIDCConfig resource and merges shared provider config with
	// per-server overrides (audience, scopes) from the reference.
	ResolveFromConfigRef(
		ctx context.Context,
		oidcConfigRef *mcpv1alpha1.MCPOIDCConfigReference,
		oidcConfig *mcpv1alpha1.MCPOIDCConfig,
		serverName, namespace string,
		proxyPort int32,
	) (*OIDCConfig, error)
}