using MediaBrowser.Model.Plugins;

namespace Jellyfin.Plugin.OidcAuth.Configuration;

/// <summary>
/// Plugin configuration for OIDC authentication.
/// </summary>
public class PluginConfiguration : BasePluginConfiguration
{
    /// <summary>
    /// Gets or sets the OIDC issuer URL (authority). Discovery document is fetched from
    /// {issuer}/.well-known/openid-configuration.
    /// </summary>
    public string OidIssuer { get; set; } = string.Empty;

    /// <summary>
    /// Gets or sets the OIDC client id.
    /// </summary>
    public string OidClientId { get; set; } = string.Empty;

    /// <summary>
    /// Gets or sets the OIDC client secret.
    /// </summary>
    public string OidClientSecret { get; set; } = string.Empty;

    /// <summary>
    /// Gets or sets the requested scopes, space separated.
    /// </summary>
    public string OidScopes { get; set; } = "openid profile email";

    /// <summary>
    /// Gets or sets the claim used as the Jellyfin username.
    /// </summary>
    public string UsernameClaim { get; set; } = "preferred_username";

    /// <summary>
    /// Gets or sets the claim containing the user's roles/groups.
    /// </summary>
    public string RoleClaim { get; set; } = "groups";

    /// <summary>
    /// Gets or sets the claim holding a URL to the user's profile picture.
    /// </summary>
    public string PictureClaim { get; set; } = "picture";

    /// <summary>
    /// Gets or sets a value indicating whether the Jellyfin profile image is updated
    /// from the picture claim on every OIDC login.
    /// </summary>
    public bool SyncProfilePicture { get; set; } = true;

    /// <summary>
    /// Gets or sets a comma separated list of role/group values that grant Jellyfin
    /// administrator rights. When empty, admin status is never modified by the plugin.
    /// </summary>
    public string AdminRoles { get; set; } = string.Empty;

    /// <summary>
    /// Gets or sets a comma separated list of role/group values required to log in.
    /// When empty, every authenticated user may log in.
    /// </summary>
    public string AllowedRoles { get; set; } = string.Empty;

    /// <summary>
    /// Gets or sets a value indicating whether a missing admin role also revokes an
    /// existing administrator flag on OIDC login. Off by default: admin roles only grant.
    /// </summary>
    public bool RevokeAdminWithoutRole { get; set; }

    /// <summary>
    /// Gets or sets a value indicating whether unknown users are created on first login.
    /// </summary>
    public bool CreateUsersIfMissing { get; set; } = true;

    /// <summary>
    /// Gets or sets a value indicating whether auto-created users get a random password.
    /// Without one, Jellyfin accepts a blank password for them from any client.
    /// Users can still set their own password in the web profile for TV/native logins,
    /// or use Quick Connect.
    /// </summary>
    public bool SetRandomPasswordOnCreate { get; set; } = true;

    /// <summary>
    /// Gets or sets a value indicating whether strict discovery endpoint validation is disabled.
    /// Required for providers whose endpoints live on a different host than the issuer (e.g. Google).
    /// </summary>
    public bool DisableEndpointValidation { get; set; }
}