-- ═══════════════════════════════════════════════════════════════
-- SSO VietProDev — Seed: Default OIDC Clients
-- Type: Data
-- Version: 2026-06-20
-- Purpose: Register the local demo apps (project-a-demo, project-b-demo)
-- so the OIDC provider recognizes their `client_id` at /oauth/authorize.
--
-- Without these rows, oidc-provider returns `invalid_client` for every
-- authorization request because the `clients` config is empty.
--
-- Secrets are stored as PLAINTEXT in `client_secret_hash` (column name kept
-- for backward compatibility). oidc-provider compares the token-endpoint
-- secret with `constantEquals` and does not support bcrypt — see RUN.md
-- "Troubleshooting: Token exchange returns invalid_client".
--
-- Idempotent: uses ON CONFLICT (client_id) DO UPDATE so re-runs converge.
-- ═══════════════════════════════════════════════════════════════

-- ─────────────────────────────────────────────────────────────
-- Section 1: Project A Demo (port 4001)
-- ─────────────────────────────────────────────────────────────
INSERT INTO clients (
    id,
    app_code,
    client_id,
    client_secret_hash,
    name,
    redirect_uris,
    post_logout_redirect_uris,
    grant_types,
    response_types,
    scopes,
    token_endpoint_auth_method,
    require_pkce,
    backchannel_logout_uri,
    backchannel_logout_session_required,
    status,
    created_at
) VALUES (
    gen_random_uuid(),
    'project-a',
    'project-a-demo',
    'project-a-demo-secret-123456',
    'Project A Demo',
    ARRAY['http://localhost:4001/auth/oidc/callback']::TEXT[],
    ARRAY['http://localhost:4001']::TEXT[],
    ARRAY['authorization_code', 'refresh_token']::TEXT[],
    ARRAY['code']::TEXT[],
    ARRAY['openid', 'profile', 'email']::TEXT[],
    'client_secret_post',
    TRUE,
    'http://localhost:4001/auth/backchannel-logout',
    TRUE,
    'active',
    CURRENT_TIMESTAMP
)
ON CONFLICT (client_id) DO UPDATE SET
    app_code                           = EXCLUDED.app_code,
    client_secret_hash                 = EXCLUDED.client_secret_hash,
    name                              = EXCLUDED.name,
    redirect_uris                     = EXCLUDED.redirect_uris,
    post_logout_redirect_uris          = EXCLUDED.post_logout_redirect_uris,
    grant_types                        = EXCLUDED.grant_types,
    response_types                     = EXCLUDED.response_types,
    scopes                            = EXCLUDED.scopes,
    token_endpoint_auth_method         = EXCLUDED.token_endpoint_auth_method,
    require_pkce                      = EXCLUDED.require_pkce,
    backchannel_logout_uri             = EXCLUDED.backchannel_logout_uri,
    backchannel_logout_session_required = EXCLUDED.backchannel_logout_session_required,
    status                            = EXCLUDED.status;

-- ─────────────────────────────────────────────────────────────
-- Section 2: Project B Demo (port 4002)
-- ─────────────────────────────────────────────────────────────
INSERT INTO clients (
    id,
    app_code,
    client_id,
    client_secret_hash,
    name,
    redirect_uris,
    post_logout_redirect_uris,
    grant_types,
    response_types,
    scopes,
    token_endpoint_auth_method,
    require_pkce,
    status,
    created_at
) VALUES (
    gen_random_uuid(),
    'project-b',
    'project-b-demo',
    'project-b-demo-secret-654321',
    'Project B Demo',
    ARRAY['http://localhost:4002/auth/oidc/callback']::TEXT[],
    ARRAY['http://localhost:4002']::TEXT[],
    ARRAY['authorization_code', 'refresh_token']::TEXT[],
    ARRAY['code']::TEXT[],
    ARRAY['openid', 'profile', 'email']::TEXT[],
    'client_secret_post',
    TRUE,
    'active',
    CURRENT_TIMESTAMP
)
ON CONFLICT (client_id) DO UPDATE SET
    app_code                  = EXCLUDED.app_code,
    client_secret_hash        = EXCLUDED.client_secret_hash,
    name                      = EXCLUDED.name,
    redirect_uris             = EXCLUDED.redirect_uris,
    post_logout_redirect_uris = EXCLUDED.post_logout_redirect_uris,
    grant_types               = EXCLUDED.grant_types,
    response_types            = EXCLUDED.response_types,
    scopes                    = EXCLUDED.scopes,
    token_endpoint_auth_method = EXCLUDED.token_endpoint_auth_method,
    require_pkce              = EXCLUDED.require_pkce,
    status                    = EXCLUDED.status;

-- ═══════════════════════════════════════════════════════════════
-- End of Seed
-- Registered clients:
--   project-a-demo  → http://localhost:4001/auth/callback
--                     secret: project-a-demo-secret-123456
--   project-b-demo  → http://localhost:4002/auth/callback
--                     secret: project-b-demo-secret-654321
-- ═══════════════════════════════════════════════════════════════
