package model

// Reference: M13 §4.3 — OIDC (OpenID Connect) per-account configuration
// Enables multi-tenant OIDC identity isolation: each account (tenant) can configure
// its own OIDC provider (Google Workspace, Auth0, Keycloak, Azure AD, etc.),
// allowing enterprise customers to bring their own OIDC IdP while maintaining
// complete identity isolation between tenants.
// This is a GoChat enterprise feature that Chatwoot does not offer (Chatwoot only has SAML).

import (
	"encoding/json"
	"time"

	"gorm.io/gorm"
)

// AccountOIDCSettings stores per-account OIDC/OAuth2 provider configuration.
// Each account can have exactly one active OIDC configuration.
type AccountOIDCSettings struct {
	ID                uint           `gorm:"primaryKey" json:"id"`
	AccountID         uint           `gorm:"not null;uniqueIndex" json:"account_id"` // one active config per account
	ClientID          string         `gorm:"size:256;not null" json:"client_id"`     // OIDC client ID
	ClientSecret      string         `gorm:"size:256" json:"-"`                      // OIDC client secret (not exposed via API)
	RedirectURL       string         `gorm:"size:1024;not null" json:"redirect_url"` // callback redirect URL
	IssuerURL         string         `gorm:"size:512;not null" json:"issuer_url"`    // IdP issuer URL (e.g. https://accounts.google.com)
	AuthorizationURL  string         `gorm:"size:1024" json:"authorization_url,omitempty"` // authorization endpoint (discovered from issuer if empty)
	TokenURL          string         `gorm:"size:1024" json:"token_url,omitempty"`   // token endpoint (discovered from issuer if empty)
	UserInfoURL       string         `gorm:"size:1024" json:"user_info_url,omitempty"` // userinfo endpoint (discovered from issuer if empty)
	JWKSURL           string         `gorm:"size:1024" json:"jwks_url,omitempty"`    // JWKS endpoint for id_token verification
	Scopes            json.RawMessage `gorm:"type:jsonb" json:"scopes"`              // JSON array of scopes (e.g. ["openid","profile","email"])
	AttributeMapping  string         `gorm:"type:text" json:"attribute_mapping,omitempty"` // JSON: {"email":"email","name":"name","firstName":"given_name","lastName":"family_name"}
	RoleMappings      json.RawMessage `gorm:"type:jsonb" json:"role_mappings"`       // OIDC group/role claim -> GoChat role mapping
	AutoProvision     bool           `gorm:"default:true" json:"auto_provision"`    // auto-create GoChat user on first OIDC login
	Active            bool           `gorm:"default:true" json:"active"`            // whether this config is active
	CreatedAt         time.Time      `gorm:"autoCreateTime" json:"created_at"`
	UpdatedAt         time.Time      `gorm:"autoUpdateTime" json:"updated_at"`
	DeletedAt         gorm.DeletedAt `gorm:"index" json:"deleted_at,omitempty"`

	Account Account `gorm:"foreignKey:AccountID" json:"account,omitempty"`
}

func (AccountOIDCSettings) TableName() string { return "account_oidc_settings" }