# Scopes
data "authentik_property_mapping_provider_scope" "openid" {
  scope_name = "openid"
}

data "authentik_property_mapping_provider_scope" "email" {
  scope_name = "email"
}

data "authentik_property_mapping_provider_scope" "profile" {
  scope_name = "profile"
}

# 1. Argo CD
resource "authentik_provider_oauth2" "argocd" {
  name               = "Argo CD"
  client_id          = "argocd-client-id"
  client_secret      = "SnarfNetArgoCDPermanentSecret2026"
  authorization_flow = var.default_authorization_flow_uuid
  invalidation_flow  = var.default_invalidation_flow_uuid
  signing_key        = var.default_signing_key_uuid
  redirect_uris      = ["https://argo.snarfnet.net/auth/callback"]
  property_mappings  = [
    data.authentik_property_mapping_provider_scope.openid.id,
    data.authentik_property_mapping_provider_scope.email.id,
    data.authentik_property_mapping_provider_scope.profile.id,
  ]
}

# 2. Gitea
resource "authentik_provider_oauth2" "gitea" {
  name               = "Gitea"
  client_id          = "gitea-client-id"
  client_secret      = "SnarfNetGiteaPermanentSecret2026"
  authorization_flow = var.default_authorization_flow_uuid
  invalidation_flow  = var.default_invalidation_flow_uuid
  signing_key        = var.default_signing_key_uuid
  redirect_uris      = ["https://git.snarfnet.net/user/oauth2/authentik/callback"]
  property_mappings  = [
    data.authentik_property_mapping_provider_scope.openid.id,
    data.authentik_property_mapping_provider_scope.email.id,
    data.authentik_property_mapping_provider_scope.profile.id,
  ]
}

# 3. AWX
resource "authentik_provider_oauth2" "awx" {
  name               = "AWX Automation"
  client_id          = "awx-client-id"
  client_secret      = "SnarfNetAWXPermanentSecret2026"
  authorization_flow = var.default_authorization_flow_uuid
  invalidation_flow  = var.default_invalidation_flow_uuid
  signing_key        = var.default_signing_key_uuid
  redirect_uris      = ["https://awx.snarfnet.net/sso/complete/authentik/"]
  property_mappings  = [
    data.authentik_property_mapping_provider_scope.openid.id,
    data.authentik_property_mapping_provider_scope.email.id,
    data.authentik_property_mapping_provider_scope.profile.id,
  ]
}

# 4. Grafana
resource "authentik_provider_oauth2" "grafana" {
  name               = "Grafana Monitoring"
  client_id          = "grafana-client-id"
  client_secret      = "SnarfNetGrafanaPermanentSecret2026"
  authorization_flow = var.default_authorization_flow_uuid
  invalidation_flow  = var.default_invalidation_flow_uuid
  signing_key        = var.default_signing_key_uuid
  redirect_uris      = ["https://grafana.snarfnet.net/login/generic_oauth"]
  property_mappings  = [
    data.authentik_provider_mapping_provider_scope.openid.id,
    data.authentik_property_mapping_provider_scope.email.id,
    data.authentik_property_mapping_provider_scope.profile.id,
  ]
}

# 5. Zabbix
resource "authentik_provider_oauth2" "zabbix" {
  name               = "Zabbix Monitoring"
  client_id          = "zabbix-client-id"
  client_secret      = "SnarfNetZabbixPermanentSecret2026"
  authorization_flow = var.default_authorization_flow_uuid
  invalidation_flow  = var.default_invalidation_flow_uuid
  signing_key        = var.default_signing_key_uuid
  redirect_uris      = ["https://zabbix.snarfnet.net/index_sso.php"]
  property_mappings  = [
    data.authentik_property_mapping_provider_scope.openid.id,
    data.authentik_property_mapping_provider_scope.email.id,
    data.authentik_property_mapping_provider_scope.profile.id,
  ]
}

# 6. Coder Workspaces
resource "authentik_provider_oauth2" "coder" {
  name               = "Coder Workspaces"
  client_id          = "coder-client-id"
  client_secret      = "SnarfNetCoderPermanentSecret2026"
  authorization_flow = var.default_authorization_flow_uuid
  invalidation_flow  = var.default_invalidation_flow_uuid
  signing_key        = var.default_signing_key_uuid
  redirect_uris      = ["https://coder.snarfnet.net/api/v2/users/oidc/callback"]
  property_mappings  = [
    data.authentik_property_mapping_provider_scope.openid.id,
    data.authentik_property_mapping_provider_scope.email.id,
    data.authentik_property_mapping_provider_scope.profile.id,
  ]
}

# 7. Semaphore UI
resource "authentik_provider_oauth2" "semaphore" {
  name               = "Semaphore UI"
  client_id          = "semaphore-client-id"
  client_secret      = "SnarfNetSemaphorePermanentSecret2026"
  authorization_flow = var.default_authorization_flow_uuid
  invalidation_flow  = var.default_invalidation_flow_uuid
  signing_key        = var.default_signing_key_uuid
  redirect_uris      = ["https://semaphore.snarfnet.net/api/auth/oidc/authentik/redirect"]
  property_mappings  = [
    data.authentik_property_mapping_provider_scope.openid.id,
    data.authentik_property_mapping_provider_scope.email.id,
    data.authentik_property_mapping_provider_scope.profile.id,
  ]
}

# 8. Synology DSM
resource "authentik_provider_oauth2" "synology" {
  name               = "Synology DSM"
  client_id          = "synology-client-id"
  client_secret      = "SnarfNetSynologyPermanentSecret2026"
  authorization_flow = var.default_authorization_flow_uuid
  invalidation_flow  = var.default_invalidation_flow_uuid
  signing_key        = var.default_signing_key_uuid
  redirect_uris      = ["https://nas.snarfnet.net/entry.cgi", "https://snarfnas.snarfnet.net/entry.cgi"]
  property_mappings  = [
    data.authentik_property_mapping_provider_scope.openid.id,
    data.authentik_property_mapping_provider_scope.email.id,
    data.authentik_property_mapping_provider_scope.profile.id,
  ]
}