flake: { config, pkgs, ... }:
let
  inherit (flake.packages.${pkgs.stdenv.hostPlatform.system}) idcoop;
  inherit (pkgs.lib) mkOption mkDefault mkIf types literalExpression mdDoc;
  inherit (pkgs.writers) writeTOML;
  inherit (builtins) mapAttrs;

  defaultUser = "idcoop";

  cfg = config.services.idcoop;
  format = pkgs.formats.toml { };

  oidcClientSubmodule = types.submodule {
    # freeformType = format.type; — one day we may want to enable freeform types, but for now just keep it strongly defined
    options = {
      name = mkOption {
        type = types.str;
        description = ''
          User-friendly name of the OIDC Client.
        '';
      };
      redirect_uris = mkOption {
        type = types.listOf types.str;
        description = ''
          List of redirect URIs that the client can use to redirect login attempts back to itself.
          Consult the documentation for the other service if you aren't sure.
        '';
      };
      allow_user_classes = mkOption {
        type = types.listOf types.str;
        description = ''
          List of user classes which are authorised (allowed) to use this client (access this service).
          As of idCoop v0.0.1, this setting is unimplemented and has no effect.
        '';
      };
    };
  };
in
{
  options.services.idcoop = {
    enable = mkOption {
      type = types.bool;
      default = false;
      description = ''
        Whether to enable idCoop, a simple identity provider.
      '';
    };

    configurePostgres = mkOption {
      type = types.bool;
      default = true;
      description = ''
        Whether to configure a Postgres database for idCoop.
        Enabled by default.
      '';
    };
    
    user = mkOption {
      type = types.str;
      default = defaultUser;
      description = ''
        User to run the service as.
        Will be created automatically if it is left at the default.
      '';
    };

    group = mkOption {
      type = types.str;
      default = defaultUser;
      description = ''
        User to run the service as.
        Will be created automatically if it is left at the default.
      '';
    };

    secretsPath = mkOption {
      type = types.path;
      default = builtins.toFile "blank.toml" "";
      description = ''
        Path to a file containing secrets. This file should be kept out of the Nix store.
        Consult the idCoop documentation for the format of the secrets file.
      '';
    };

    settings = mkOption {
      default = {};
      description = "idCoop configuration.";
      
      type = types.submodule {
        # freeformType = format.type; — one day we may want to enable freeform types, but for now just keep it strongly defined
        options = {
          listen = {
            bind = mkOption {
              type = types.str;
              default = "127.0.0.1:8072";
              description = ''
                Host and port combination upon which to bind the web interface.
              '';
            };
            public_base_uri = mkOption {
              type = types.str;
              default = "http://${cfg.settings.listen.bind}";
              defaultText = "`http://{listen.bind}`";
              description = ''
                Public-facing HTTP(S) base URL.
              '';
            };
          };

          oidc = {
            issuer = mkOption {
              type = types.str;
              default = cfg.settings.listen.public_base_uri;
              defaultText = "`listen.public_base_uri`";
              description = ''
                The identity provider's 'issuer' identifier, as used in OpenID Connect.
                This should be configured in clients (relying parties) and should likely not be changed.
              '';
            };

            rsa_keypair = mkOption {
              type = types.path;
              description = ''
                Path to an RSA keypair used for signing JSON Web Tokens.
              '';
            };


            clients = mkOption {
              type = types.attrsOf oidcClientSubmodule;
              default = {};
              description = ''
                OpenID Connect 'clients' (also known as relying parties).
                These entries are for the different services you want users to be able to log in to using idCoop.
              '';
            };
          };

          postgres = {
            connect = mkOption {
              type = types.str;
              default = "postgres:";
              description = mdDoc ''
                Connection string for the Postgres database. The default of `postgres:` uses the [libpq environment variables] to form a connection;
                usually this by default connects to the local UNIX socket with the current user's name as a username and database name,
                if no environment variables are set.

                [libpq environment variables]: https://www.postgresql.org/docs/current/libpq-envars.html
              '';
            };
          };
        };
      };
    };
  };

  config = let
    configPath = writeTOML "idcoop_config.toml" cfg.settings;
  in {
    users.users.idcoop = mkIf (cfg.enable && cfg.user == defaultUser) {
      isSystemUser = true;
      group = cfg.group;
      home = mkDefault "/var/lib/idcoop";
      createHome = true;

      packages = [
        # Add a wrapper for the idcoop command so the user can use the CLI conveniently
        (pkgs.writeShellScriptBin "idcoop" ''
          IDCOOP_CONFIG=${pkgs.lib.escapeShellArg configPath} IDCOOP_SECRETS=${pkgs.lib.escapeShellArg cfg.secretsPath} exec ${idcoop}/bin/idcoop "$@"
        '')
      ];
    };
    users.groups.idcoop = mkIf (cfg.enable && cfg.group == defaultUser) {};

    systemd.services.idcoop = mkIf cfg.enable {
      description = "idCoop: simple identity provider";
      wantedBy = [ "multi-user.target" ];
      after = [ "networking.target" "network-online.target" "postgresql.service" ];

      serviceConfig =
        {
          ExecStart = "${idcoop}/bin/idcoop --config ${pkgs.lib.escapeShellArg configPath} --secrets ${pkgs.lib.escapeShellArg cfg.secretsPath} serve";
          User = cfg.user;
          Group = cfg.group;
        };
    };

    services.postgresql = mkIf cfg.configurePostgres {
      ensureUsers = [
          {
            name = "idcoop";
            ensureDBOwnership = true;
          }
        ];
      ensureDatabases = ["idcoop"];
    };
  };
}