# Generated by Django 4.2.20 on 2025-05-08 10:06

from django.db import migrations, models
import django.db.models.deletion
import django_jsonform.models.fields
import mozilla_django_oidc_db.models


class Migration(migrations.Migration):

    dependencies = [
        ("mozilla_django_oidc_db", "0005_alter_openidconnectconfig_claim_mapping"),
    ]

    operations = [
        migrations.CreateModel(
            name="OIDCProvider",
            fields=[
                (
                    "id",
                    models.AutoField(
                        auto_created=True,
                        primary_key=True,
                        serialize=False,
                        verbose_name="ID",
                    ),
                ),
                (
                    "identifier",
                    models.SlugField(
                        help_text="Unique identifier of the OIDC provider.",
                        max_length=255,
                        unique=True,
                        verbose_name="identifier",
                    ),
                ),
                (
                    "oidc_op_discovery_endpoint",
                    models.URLField(
                        blank=True,
                        help_text="URL of your provider discovery endpoint ending with a slash (`.well-known/...` will be added automatically). If this is provided, the remaining endpoints can be omitted, as they will be derived from this endpoint.",
                        max_length=1000,
                        verbose_name="Discovery endpoint",
                    ),
                ),
                (
                    "oidc_op_jwks_endpoint",
                    models.URLField(
                        blank=True,
                        help_text="URL of your provider JSON Web Key Set endpoint. Required if `RS256` is used as signing algorithm.",
                        max_length=1000,
                        verbose_name="JSON Web Key Set endpoint",
                    ),
                ),
                (
                    "oidc_op_authorization_endpoint",
                    models.URLField(
                        help_text="URL of your provider authorization endpoint",
                        max_length=1000,
                        verbose_name="Authorization endpoint",
                    ),
                ),
                (
                    "oidc_op_token_endpoint",
                    models.URLField(
                        help_text="URL of your provider token endpoint",
                        max_length=1000,
                        verbose_name="Token endpoint",
                    ),
                ),
                (
                    "oidc_op_user_endpoint",
                    models.URLField(
                        help_text="URL of your provider userinfo endpoint.",
                        max_length=1000,
                        verbose_name="User endpoint",
                    ),
                ),
                (
                    "oidc_op_logout_endpoint",
                    models.URLField(
                        blank=True,
                        help_text="URL of your provider logout endpoint.",
                        max_length=1000,
                        verbose_name="Logout endpoint",
                    ),
                ),
                (
                    "oidc_token_use_basic_auth",
                    models.BooleanField(
                        blank=True,
                        default=False,
                        help_text="If enabled, the client ID and secret are sent in the HTTP Basic auth header when obtaining the access token. Otherwise, they are sent in the request body.",
                        verbose_name="Use Basic auth for token endpoint",
                    ),
                ),
                (
                    "oidc_use_nonce",
                    models.BooleanField(
                        default=True,
                        blank=True,
                        help_text="Controls whether the client uses nonce verification",
                        verbose_name="Use nonce",
                    ),
                ),
                (
                    "oidc_nonce_size",
                    models.PositiveIntegerField(
                        default=32,
                        blank=True,
                        help_text="Sets the length of the random string used for nonce verification",
                        verbose_name="Nonce size",
                    ),
                ),
                (
                    "oidc_state_size",
                    models.PositiveIntegerField(
                        default=32,
                        blank=True,
                        help_text="Sets the length of the random string used for state verification",
                        verbose_name="State size",
                    ),
                ),
            ],
            options={
                "verbose_name": "OIDC Provider",
                "verbose_name_plural": "OIDC Providers",
            },
        ),
        migrations.CreateModel(
            name="OIDCClient",
            fields=[
                (
                    "id",
                    models.AutoField(
                        auto_created=True,
                        primary_key=True,
                        serialize=False,
                        verbose_name="ID",
                    ),
                ),
                (
                    "identifier",
                    models.SlugField(
                        help_text="Unique identifier for the client.",
                        max_length=255,
                        unique=True,
                        verbose_name="identifier",
                    ),
                ),
                (
                    "enabled",
                    models.BooleanField(
                        default=False,
                        help_text="The client must be enabled before users can authenticate through it.",
                        verbose_name="enabled",
                    ),
                ),
                (
                    "oidc_rp_client_id",
                    models.CharField(
                        help_text="Client ID provided by the OIDC Provider",
                        max_length=1000,
                        verbose_name="Client ID",
                    ),
                ),
                (
                    "oidc_rp_client_secret",
                    models.CharField(
                        help_text="Secret provided by the OIDC Provider",
                        max_length=1000,
                        verbose_name="Secret",
                    ),
                ),
                (
                    "oidc_rp_scopes_list",
                    django_jsonform.models.fields.ArrayField(
                        base_field=models.CharField(
                            max_length=50, verbose_name="Scope"
                        ),
                        blank=True,
                        default=mozilla_django_oidc_db.models.get_default_scopes,
                        help_text="Scopes that are requested during login",
                        size=None,
                        verbose_name="Scopes",
                    ),
                ),
                (
                    "oidc_rp_sign_algo",
                    models.CharField(
                        default="RS256",
                        help_text="Algorithm the Identity Provider uses to sign ID tokens",
                        max_length=50,
                        verbose_name="OpenID sign algorithm",
                    ),
                ),
                (
                    "oidc_rp_idp_sign_key",
                    models.CharField(
                        blank=True,
                        help_text="Key the Identity Provider uses to sign ID tokens in the case of an RSA sign algorithm. Should be the signing key in PEM or DER format.",
                        max_length=1000,
                        verbose_name="Sign key",
                    ),
                ),
                (
                    "oidc_keycloak_idp_hint",
                    models.CharField(
                        blank=True,
                        help_text="Specific for Keycloak: parameter that indicates which identity provider should be used (therefore skipping the Keycloak login screen).",
                        max_length=1000,
                        verbose_name="Keycloak Identity Provider hint",
                    ),
                ),
                (
                    "userinfo_claims_source",
                    models.CharField(
                        choices=[
                            ("userinfo_endpoint", "Userinfo endpoint"),
                            ("id_token", "ID token"),
                        ],
                        default="userinfo_endpoint",
                        help_text="Indicates the source from which the user information claims should be extracted. This can be the ID token or the User Info endpoint.",
                        max_length=100,
                        verbose_name="user information claims extracted from",
                    ),
                ),
                (
                    "check_op_availability",
                    models.BooleanField(
                        default=False,
                        help_text="Whether to check OIDC Provider availability before doing the authentication request.",
                        verbose_name="check OIDC Provider availability",
                    ),
                ),
                (
                    "options",
                    django_jsonform.models.fields.JSONField(
                        default=dict,
                        help_text="Options relevant for a specific Identity Provider.",
                        verbose_name="options",
                    ),
                ),
                (
                    "oidc_provider",
                    models.ForeignKey(
                        help_text="Specifies which OIDC Provider to use.",
                        null=True,
                        on_delete=django.db.models.deletion.PROTECT,
                        to="mozilla_django_oidc_db.oidcprovider",
                        verbose_name="OIDC Provider",
                    ),
                ),
            ],
            options={
                "verbose_name": "OIDC client",
                "verbose_name_plural": "OIDC clients",
            },
        ),
    ]
