//#region src/types/auth.generated.d.ts
export type OIDC = {
  /** Identity provider name */
  name: string;
  kind: "OIDC";
  /** OAuth2 client ID */
  clientID: string;
  /** OAuth2 client secret */
  clientSecret: {
    /** Vault name containing the secret */
    vaultName: string;
    /** Key of the secret in the vault */
    secretKey: string;
  };
  /** OIDC provider URL */
  providerURL: string;
  /** OIDC issuer URL (defaults to providerURL) */
  issuerURL?: string | undefined;
  /** JWT claim to use as username */
  usernameClaim?: string | undefined;
};
export type SAML = {
  /** Identity provider name */
  name: string;
  kind: "SAML";
  /** Enable signing of SAML requests */
  enableSignRequest: boolean;
  /** URL to fetch SAML metadata (mutually exclusive with rawMetadata) */
  metadataURL?: string | undefined;
  /** Raw SAML metadata XML (mutually exclusive with metadataURL) */
  rawMetadata?: string | undefined;
  /** URL to redirect to when SAML ACS receives a response with an empty RelayState. */
  defaultRedirectURL?: string | undefined;
};
export type IDToken = {
  /** Identity provider name */
  name: string;
  kind: "IDToken";
  /** ID token provider URL */
  providerURL: string;
  /** Client ID for ID token validation */
  clientID: string;
  /** ID token issuer URL */
  issuerURL?: string | undefined;
  /** JWT claim to use as username */
  usernameClaim?: string | undefined;
};
export type BuiltinIdP = {
  /** Identity provider name */
  name: string;
  kind: "BuiltInIdP";
  /** IdP namespace */
  namespace: string;
  /** OAuth2 client name in the IdP */
  clientName: string;
};
export type IdProvider = OIDC | SAML | IDToken | BuiltinIdP;
export type OAuth2ClientInput = {
  /** Allowed redirect URIs */
  redirectURIs: (`https://${string}` | `http://${string}` | `${string}:url` | `${string}:url/${string}`)[];
  /** Client description */
  description?: string | undefined;
  /** Allowed OAuth2 grant types */
  grantTypes?: ("authorization_code" | "refresh_token")[] | undefined;
  /** OAuth2 client type */
  clientType?: "confidential" | "public" | "browser" | undefined;
  /** Access token lifetime in seconds (60-86400) */
  accessTokenLifetimeSeconds?: number | undefined;
  /** Refresh token lifetime in seconds (60-604800) */
  refreshTokenLifetimeSeconds?: number | undefined;
  /** Require DPoP (Demonstrating Proof-of-Possession) for token requests */
  requireDpop?: boolean | undefined;
};
export type OAuth2Client = {
  /** Allowed OAuth2 grant types */
  grantTypes: ("authorization_code" | "refresh_token")[];
  /** Allowed redirect URIs */
  redirectURIs: (`https://${string}` | `http://${string}` | `${string}:url` | `${string}:url/${string}`)[];
  /** Access token lifetime in seconds (60-86400) */
  accessTokenLifetimeSeconds: {
    seconds: bigint;
    nanos: number;
  } | undefined;
  /** Refresh token lifetime in seconds (60-604800) */
  refreshTokenLifetimeSeconds: {
    seconds: bigint;
    nanos: number;
  } | undefined;
  /** Client description */
  description?: string | undefined;
  /** OAuth2 client type */
  clientType?: "confidential" | "public" | "browser" | undefined;
  /** Require DPoP (Demonstrating Proof-of-Possession) for token requests */
  requireDpop?: boolean | undefined;
};
export type SCIMAuthorization = {
  /** SCIM authorization type */
  type: "oauth2" | "bearer";
  /** Bearer token secret (required for bearer type) */
  bearerSecret?: {
    /** Vault name containing the secret */
    vaultName: string;
    /** Key of the secret in the vault */
    secretKey: string;
  } | undefined;
};
/**
 * SCIM attribute data type
 */
export type SCIMAttributeType = "string" | "number" | "boolean" | "datetime" | "complex";
export type SCIMAttribute = {
  /** Attribute data type */
  type: SCIMAttributeType;
  /** Attribute name */
  name: string;
  /** Attribute description */
  description?: string | undefined;
  /** Attribute mutability */
  mutability?: "readOnly" | "readWrite" | "writeOnly" | undefined;
  /** Whether the attribute is required */
  required?: boolean | undefined;
  /** Whether the attribute can have multiple values */
  multiValued?: boolean | undefined;
  /** Uniqueness constraint */
  uniqueness?: "none" | "server" | "global" | undefined;
  /** List of canonical values */
  canonicalValues?: string[] | null | undefined;
  subAttributes?: SCIMAttribute[] | null | undefined;
};
export type SCIMAttributeMapping = {
  /** TailorDB field name to map to */
  tailorDBField: string;
  /** SCIM attribute path */
  scimPath: string;
};
export type SCIMResource = {
  /** SCIM resource name */
  name: string;
  /** TailorDB namespace for the resource */
  tailorDBNamespace: string;
  /** TailorDB table name for the resource */
  tailorDBType: string;
  /** Core SCIM schema definition */
  coreSchema: {
    /** SCIM schema name */
    name: string;
    /** Schema attributes */
    attributes: SCIMAttribute[];
  };
  /** Attribute mapping configuration */
  attributeMapping: SCIMAttributeMapping[];
};
export type SCIMConfig = {
  /** Machine user name for SCIM operations */
  machineUserName: string;
  /** SCIM authorization configuration */
  authorization: SCIMAuthorization;
  /** SCIM resource definitions */
  resources: SCIMResource[];
};
export type TenantProvider = {
  /** TailorDB namespace for the tenant table */
  namespace: string;
  /** TailorDB table name for tenants */
  type: string;
  /** Field used as the tenant signature */
  signatureField: string;
};
//#endregion