/// <summary>
/// Adds a Keycloak Realm to the application model from a <see cref="IResourceBuilder{KeycloakRealmResource}"/>.
/// </summary>
/// <param name="builder">The Keycloak server resource builder.</param>
/// <param name="name">The name of the realm.</param>
/// <param name="realmName">The name of the realm. If not provided, the resource name will be used.</param>
/// <returns>A reference to the <see cref="IResourceBuilder{KeycloakRealmResource}"/>.</returns>
public static IResourceBuilder<KeycloakRealmResource> AddRealm(
    this IResourceBuilder<KeycloakResource> builder,
    string name,
    string? realmName = null)
{
    ArgumentNullException.ThrowIfNull(builder);

    // Use the resource name as the realm name if it's not provided
    realmName ??= name;

    var keycloakRealm = new KeycloakRealmResource(name, realmName, builder.Resource);

    return builder.ApplicationBuilder.AddResource(keycloakRealm);
}

/// <summary>
/// Represents a Keycloak Realm resource.
/// </summary>
/// <param name="name">The name of the realm resource.</param>
/// <param name="realmName">The name of the realm.</param>
/// <param name="parent">The Keycloak server resource associated with this database.</param>
public sealed class KeycloakRealmResource(string name, string realmName, KeycloakResource parent) : Resource(name), IResourceWithParent<KeycloakResource>, IResourceWithConnectionString
{
    private EndpointReference? _parentEndpoint;
    private EndpointReference ParentEndpoint => _parentEndpoint ??= new(Parent, "http");

    /// <inheritdoc/>
    public ReferenceExpression ConnectionStringExpression => ReferenceExpression.Create(
        $"{ParentEndpoint.Property(EndpointProperty.Url)}/realms/{RealmName}");

    /// <inheritdoc/>
    public KeycloakResource Parent { get; } = parent;

    /// <summary>
    /// Gets the name of the realm.
    /// </summary>
    public string RealmName { get; } = realmName;
}

resourcebuild.WithEnvironment("JwtBearerOptions__Authority", realm);

resourcebuild
    .WithEnvironment(ctx =>
    {
        var baseAddress = idp.Resource.ConnectionStringExpression;
        ctx.EnvironmentVariables["JwtBearerOptions__Authority"] = baseAddress;
        ctx.EnvironmentVariables["JwtBearerOptions__MetadataAddress"] = ReferenceExpression.Create($"{baseAddress}/.well-known/openid-configuration");
        ctx.EnvironmentVariables["JwtBearerOptions__Configuration__Issuer"] = baseAddress;
        ctx.EnvironmentVariables["JwtBearerOptions__Configuration__AuthorizationEndpoint"] = ReferenceExpression.Create($"{baseAddress}/protocol/openid-connect/auth");
        ctx.EnvironmentVariables["JwtBearerOptions__Configuration__TokenEndpoint"] = ReferenceExpression.Create($"{baseAddress}/protocol/openid-connect/token");
        ctx.EnvironmentVariables["JwtBearerOptions__Configuration__UserInfoEndpoint"] = ReferenceExpression.Create($"{baseAddress}/protocol/openid-connect/userinfo");
        ctx.EnvironmentVariables["JwtBearerOptions__RequireHttpsMetadata"] = "false";
        ctx.EnvironmentVariables["JwtBearerOptions__TokenValidationParameters__RequireSignedTokens"] = "false";
        ctx.EnvironmentVariables["JwtBearerOptions__TokenValidationParameters__ValidateAudience"] = "false";
        ctx.EnvironmentVariables["JwtBearerOptions__TokenValidationParameters__ValidateActor"] = "false";
        ctx.EnvironmentVariables["JwtBearerOptions__TokenValidationParameters__ValidateIssuer"] = "false";
        ctx.EnvironmentVariables["JwtBearerOptions__TokenValidationParameters__ValidateIssuerSigningKey"] = "false";
        ctx.EnvironmentVariables["JwtBearerOptions__TokenValidationParameters__ValidateLifetime"] = "false";
    })
    ;