# Glue: register the review classifier as an OIDC client wherever authelia
# runs.
#
# ONE PAIRING PER FILE — swarm-review-classifier ← authelia, and nothing else.
# Deleting this leaves a classifier whose token requests authelia answers with
# a 401, and no minted secret for swarm-secret-publish to put in the store.
#
# ⚠️ Gated on authelia being HERE, and NOT on this host running the
# classifier, for ./glue-controller-oidc-client.nix's reason: a client is a row
# in THIS host's provider config. Registered whether or not any host enables
# the classifier: nothing in `swarm.*` records that, so a swarm without one
# carries one unused client and one unused minted secret.
{
  lib,
  config,
  ...
}:
let
  hyperhiveCfg = config.services.hyperhive;
  deployCfg = hyperhiveCfg.deploy;
  clientId = hyperhiveCfg.swarm.review-classifier.clientId;
in
{
  config = lib.mkIf deployCfg.authelia.enable {
    services.hyperhive.swarm.authelia.oidc.clients = [
      {
        id = clientId;
        description = "HyperHive review classifier";
        # `client_credentials`: a daemon authenticating as itself.
        kind = "machine";
        audience = [ clientId ];
      }
    ];
  };
}