# managed by ansible (cloud-vaultwarden); applied with `ak apply_blueprint`
version: 1
metadata:
  name: "{{ vaultwarden_sso_name }} SSO"
entries:
  # vaultwarden only links an SSO login to an existing account for verified addresses
  - model: authentik_providers_oauth2.scopemapping
    id: email-verified
    identifiers:
      name: "{{ vaultwarden_sso_name }} OpenID 'email' (verified)"
    attrs:
      scope_name: email
      description: Email address (verified)
      expression: |
        return {
            "email": request.user.email,
            "email_verified": True,
        }

  - model: authentik_providers_oauth2.oauth2provider
    id: provider
    identifiers:
      name: "{{ vaultwarden_sso_name }}"
    attrs:
      authorization_flow: !Find [authentik_flows.flow, [slug, {{ vaultwarden_sso_authentik_authorization_flow }}]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, {{ vaultwarden_sso_authentik_invalidation_flow }}]]
      client_type: confidential
      # newer authentik versions only allow explicitly listed grant types
      grant_types:
        - authorization_code
        - refresh_token
      client_id: "{{ vaultwarden_sso_client_id }}"
      client_secret: "{{ vaultwarden_sso_client_secret }}"
      redirect_uris:
        - matching_mode: strict
          url: "https://{{ vaultwarden_domain }}/identity/connect/oidc-signin"
      signing_key: !Find [authentik_crypto.certificatekeypair, [name, "{{ vaultwarden_sso_authentik_signing_key }}"]]
      sub_mode: hashed_user_id
      property_mappings:
        - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
        - !KeyOf email-verified
        - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
        - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-offline_access]]

  - model: authentik_core.application
    identifiers:
      slug: "{{ vaultwarden_sso_slug }}"
    attrs:
      name: "{{ vaultwarden_sso_name }}"
      provider: !KeyOf provider
      meta_launch_url: "https://{{ vaultwarden_domain }}/"
      policy_engine_mode: any