---
apiVersion: codemowers.cloud/v1beta1
kind: OIDCClient
metadata:
  name: inventory-app
spec:
  uri: 'https://inventory.k-space.ee'
  redirectUris:
    - 'https://inventory.k-space.ee/login-callback'
  grantTypes:
    - 'authorization_code'
    - 'refresh_token'
  responseTypes:
    - 'code'
  # Preserve 1.x email claims for clients whose requests only include profile.
  overrideIncomingScopes: true
  availableScopes:
    - email
    - 'openid'
    - 'profile'
    - 'groups'
    - 'offline_access'
  tokenEndpointAuthMethod: 'client_secret_basic'
  pkce: false
---
apiVersion: codemowers.cloud/v1beta1
kind: SecretClaim
metadata:
  name: inventory-cookies
spec:
  size: 32
  mapping:
    - key: COOKIES_SECRET_KEY
      value: "%(plaintext)s"