"""Authentik service definition.

Authentik is the user-directory source (replacing the Jellyfin-backed Users
page). Its directory API is queried via :class:`AuthentikClient` and surfaced
on the Authentik service page (Users + Messaging tabs). OIDC authentication
is unchanged -- this service type is for the directory, not SSO.
"""

from __future__ import annotations

from media_library_viewer_api.integrations.base import (
    SecretField,
    ServiceBaseUrl,
    ServiceConfigBase,
    ServiceDefinition,
)


class AuthentikConfig(ServiceConfigBase):
    """Non-secret Authentik connection config."""

    base_url: ServiceBaseUrl
    timeout_seconds: int = 10


DEFINITION = ServiceDefinition(
    service_type="authentik",
    name="Authentik",
    description="User directory and identity provider integration.",
    config_model=AuthentikConfig,
    secret_fields=[
        SecretField(key="api_token", label="API token", required=True),
    ],
    widget_kinds=[],
)
