# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
version: 1
metadata:
  name: portabase-oidc
  labels:
    blueprints.goauthentik.io/instantiate: "false"
    blueprints.goauthentik.io/description: "Reference Portabase OIDC shape; the deterministic runtime seed is applied by seeds/authentik/bootstrap.sh."
entries:
  - model: authentik_providers_oauth2.oauth2provider
    state: present
    identifiers:
      name: portabase
    attrs:
      name: portabase
      authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
      property_mappings:
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
      client_type: confidential
      client_id: portabase
      client_secret: portabase-e2e-secret
      access_code_validity: minutes=1
      access_token_validity: hours=1
      refresh_token_validity: days=7
      include_claims_in_id_token: true
      signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
      redirect_uris:
        - matching_mode: strict
          url: http://localhost:8887/api/auth/sso/callback/authentik
      sub_mode: user_email
      issuer_mode: global

  - model: authentik_core.application
    state: present
    identifiers:
      slug: portabase
    attrs:
      name: Portabase
      slug: portabase
      policy_engine_mode: any
      provider: !Find [authentik_providers_oauth2.oauth2provider, [name, portabase]]