namespace EntKube.Web.Data;

/// <summary>
/// Keycloak-specific configuration attached to an installed Keycloak ClusterComponent.
/// Stores which CNPG database backs this Keycloak instance and the admin credentials
/// needed for the Admin REST API.
///
/// DB credentials (KC_DB_URL, KC_DB_USERNAME, KC_DB_PASSWORD) are stored as
/// component vault secrets and synced to a Kubernetes Secret so the Helm chart
/// can consume them without any out-of-band secret management.
///
/// The admin password is stored as a component vault secret named
/// "KEYCLOAK_ADMIN_PASSWORD" and synced to the same Kubernetes Secret.
/// </summary>
public class KeycloakComponentConfig
{
    public Guid Id { get; set; }

    public Guid TenantId { get; set; }

    /// <summary>
    /// The installed Keycloak ClusterComponent this config belongs to.
    /// One config per Keycloak component instance.
    /// </summary>
    public Guid ClusterComponentId { get; set; }

    /// <summary>
    /// The managed CNPG database backing this Keycloak instance.
    /// Null until the operator selects a database.
    /// </summary>
    public Guid? CnpgDatabaseId { get; set; }

    /// <summary>
    /// Keycloak admin username (default "admin").
    /// </summary>
    public string AdminUsername { get; set; } = "admin";

    /// <summary>
    /// URL used by the platform to call the Keycloak Admin REST API.
    /// Typically the external hostname (e.g. "https://auth.example.com").
    /// Can be auto-suggested from the component's ExternalRoutes.
    /// </summary>
    public string? AdminUrl { get; set; }

    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;

    // Navigation
    public Tenant Tenant { get; set; } = null!;
    public ClusterComponent ClusterComponent { get; set; } = null!;
    public CnpgDatabase? CnpgDatabase { get; set; }
    public ICollection<KeycloakRealm> Realms { get; set; } = [];
}
