# Enhanced Role Mapping Configuration
# Much simpler and more practical than complex nested objects

oidc:
  issuer: "https://sso.company.com"
  client_id: "headplane"
  client_secret: "your-secret"
  scope: "openid email profile groups"
  
  # Simple string arrays for role mapping (optional)
  # If not specified, uses intelligent convention-based defaults
  owner_groups: ["ceo", "cto", "founders", "company-owners"]
  admin_groups: ["admins", "administrators", "it-admin", "platform-team"]
  network_admin_groups: ["network-team", "devops", "sre", "infrastructure"]
  it_admin_groups: ["helpdesk", "support-team", "it-staff"]
  auditor_groups: ["compliance", "audit-team", "security"]

---
# Alternative: Environment Variables (great for containers)
# HEADPLANE_OWNER_GROUPS="ceo,cto,founders"
# HEADPLANE_ADMIN_GROUPS="admins,administrators,it-admin"
# HEADPLANE_NETWORK_ADMIN_GROUPS="network-team,devops,sre"
# HEADPLANE_IT_ADMIN_GROUPS="helpdesk,support-team"
# HEADPLANE_AUDITOR_GROUPS="compliance,audit-team,security"

---
# Convention-based defaults (no config needed!)
# These patterns work automatically with most identity providers:
#
# OWNER: ceo, cto, founder, owner, *-owner, *-owners, owner-*
# ADMIN: admin, administrator, *-admin, *-admins, admin-*, platform*, sysadmin
# NETWORK_ADMIN: network*, devops*, sre*, *infrastructure*, netadmin
# IT_ADMIN: helpdesk*, support*, it, it-*, *-it
# AUDITOR: audit*, compliance*, security*, auditor
# MEMBER: everyone else (default)

---
# Real-world examples that work out of the box:

# Google Workspace
# Groups: "ceo@company.com", "admins@company.com", "devops@company.com"
# Result: Works automatically via convention matching

# Azure AD  
# Groups: "Company Owners", "IT Administrators", "Network Team"
# Result: Works automatically via convention matching

# Keycloak
# Groups: "/company/founders", "/company/platform-admins", "/teams/infrastructure"
# Result: Works automatically via convention matching

# Okta
# Groups: "COMPANY_CEO", "IT_ADMINS", "DEVOPS_TEAM"
# Result: Works automatically via convention matching