variable "groups" {
  type = map(object({
    name         = string
    is_superuser = optional(bool, false)
    # PKs of existing parent groups. These must be literal group PKs, not keys
    # into this map: authentik_group cannot reference itself.
    parents    = optional(list(string), null)
    attributes = optional(map(string), {})
  }))
  default = {}
}

variable "providers_saml" {
  type = map(object({
    name               = string
    authorization_flow = string
    invalidation_flow  = string
    acs_url            = string
    sp_binding         = optional(string, "redirect")
    audience           = optional(string, "")
    name_id_mapping    = optional(string, null)
    signing_kp         = optional(string, null)
  }))
  default = {}
}

variable "providers_oauth2" {
  type = map(object({
    name               = string
    authorization_flow = string # flow slug, resolved to id via data.authentik_flow
    invalidation_flow  = string # flow slug, resolved to id via data.authentik_flow
    client_type        = optional(string, "confidential")
    client_id          = string
    # client_secret is never committed. Point at a Vault kv-v2 secret whose
    # `client_secret` key holds the value (seeded out of band); TF reads it.
    client_secret_vault = optional(object({
      mount = string
      path  = string
    }), null)
    # Managed identifiers of scope property mappings (e.g.
    # goauthentik.io/providers/oauth2/scope-openid). Resolved to ids.
    scope_mappings = optional(list(string), [])
    # allowed_redirect_uris is list(map(string)); the API always stores a
    # redirect_uri_type key, so it must be set here or every plan drifts.
    redirect_uris = optional(list(object({
      matching_mode     = optional(string, "strict")
      url               = string
      redirect_uri_type = optional(string, "authorization")
    })), [])
    signing_key           = optional(string, null)
    access_token_validity = optional(string, "minutes=10")
  }))
  default = {}
}

variable "providers_ldap" {
  type = map(object({
    name             = string
    bind_flow        = string
    unbind_flow      = string
    base_dn          = string
    certificate      = optional(string, null)
    tls_server_name  = optional(string, null)
    uid_start_number = optional(number, 2000)
    gid_start_number = optional(number, 4000)
    search_mode      = optional(string, "direct")
    bind_mode        = optional(string, "direct")
    mfa_support      = optional(bool, true)
  }))
  default = {}
}