# Glue: register the claude login minter as an OIDC client wherever authelia
# runs.
#
# ONE PAIRING PER FILE — swarm-claude-login ← authelia, and nothing else.
# Deleting this leaves a minter whose token requests authelia answers with a
# 401, and no minted secret for swarm-secret-publish to put in the store.
#
# ⚠️ Gated on authelia being HERE, and NOT on this host running the minter,
# for ./glue-controller-oidc-client.nix's reason: a client is a row in THIS
# host's provider config. Registered whether or not any host enables the
# minter: nothing in `swarm.*` records that, so a swarm without one carries
# one unused client and one unused minted secret.
{
  lib,
  config,
  ...
}:
let
  hyperhiveCfg = config.services.hyperhive;
  deployCfg = hyperhiveCfg.deploy;
  clientId = hyperhiveCfg.swarm.claude-login.clientId;
in
{
  config = lib.mkIf deployCfg.authelia.enable {
    services.hyperhive.swarm.authelia.oidc.clients = [
      {
        id = clientId;
        description = "HyperHive claude login minter";
        # `client_credentials`: a daemon authenticating as itself.
        kind = "machine";
        audience = [ clientId ];
      }
    ];
  };
}