/**
 * Configuration for a single OIDC provider
 *
 * Supports both OIDC discovery and manual endpoint configuration.
 */
export interface OidcProviderConfig {
    /**
     * OIDC issuer URL
     * e.g., "https://idp.acme.com" or "https://login.microsoftonline.com/{tenant}/v2.0"
     * Used to validate the 'iss' claim in ID tokens
     */
    issuer: string;

    /**
     * OAuth 2.0 client ID
     * Provided by the IdP when you register your application
     */
    clientId: string;

    /**
     * OAuth 2.0 client secret
     * Provided by the IdP - keep this secure!
     */
    clientSecret: string;

    /**
     * Callback URL for OAuth redirect
     * Must match the redirect URI registered with the IdP
     * e.g., "https://myapp.com/oidc/acme/callback"
     */
    callbackUrl: string;

    /**
     * OAuth 2.0 scopes to request
     * Default: ["openid", "email", "profile"]
     * "openid" is required for OIDC
     */
    scope?: string[];

    /**
     * OIDC discovery URL for automatic configuration
     * e.g., "https://idp.acme.com/.well-known/openid-configuration"
     * If provided, endpoints will be auto-discovered
     * If not provided, must specify manual endpoints below
     */
    discoveryUrl?: string;

    /**
     * Manual endpoint configuration (if not using discovery)
     */

    /**
     * Authorization endpoint URL
     * e.g., "https://idp.acme.com/authorize"
     * Required if discoveryUrl not provided
     */
    authorizationEndpoint?: string;

    /**
     * Token endpoint URL
     * e.g., "https://idp.acme.com/token"
     * Required if discoveryUrl not provided
     */
    tokenEndpoint?: string;

    /**
     * UserInfo endpoint URL
     * e.g., "https://idp.acme.com/userinfo"
     * Optional - if not provided, only ID token claims will be used
     */
    userinfoEndpoint?: string;

    /**
     * JWKS (JSON Web Key Set) endpoint URL
     * e.g., "https://idp.acme.com/.well-known/jwks.json"
     * Required for ID token signature validation
     * Required if discoveryUrl not provided
     */
    jwksUri?: string;

    /**
     * Additional custom claims to extract from ID token
     * Map of app field names to OIDC claim paths
     * e.g., { "department": "custom:department", "role": "custom:role" }
     */
    claimMapping?: Record<string, string>;
}