{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://cytario.com/schemas/oss-provider-config.schema.json",
  "title": "Cytario OSS provider configuration",
  "description": "Deploy-time provider connections and provider roles for an OSS self-hosted Cytario deployment (SRS-CY-60005). Consumed by cytario-web's OSS provider loader.",
  "type": "object",
  "additionalProperties": false,
  "required": ["providerConnections", "providerRoles"],
  "properties": {
    "providerConnections": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["id", "providerType", "region"],
        "properties": {
          "id": {
            "type": "string",
            "pattern": "^[a-zA-Z0-9._-]{1,64}$",
            "description": "Stable operator-chosen id referenced by providerRoles[].providerConnectionId."
          },
          "providerType": {
            "type": "string",
            "enum": ["aws"]
          },
          "endpoint": {
            "type": ["string", "null"],
            "description": "null for real AWS S3; a URL for an S3-compatible backend.",
            "format": "uri"
          },
          "region": {
            "type": "string",
            "minLength": 1
          }
        }
      }
    },
    "providerRoles": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["id", "providerConnectionId", "roleArn", "name", "allowedScopes", "allowsSharing"],
        "properties": {
          "id": {
            "type": "string",
            "pattern": "^[a-zA-Z0-9._-]{1,64}$"
          },
          "providerConnectionId": {
            "type": "string",
            "pattern": "^[a-zA-Z0-9._-]{1,64}$",
            "description": "Must match an id in providerConnections."
          },
          "roleArn": {
            "type": "string",
            "pattern": "^arn:aws:iam::[0-9]{12}:role/.+$",
            "description": "Pre-provisioned IAM role ARN. Never shipped to the browser."
          },
          "name": {
            "type": "string",
            "minLength": 1
          },
          "allowedScopes": {
            "type": "array",
            "minItems": 1,
            "uniqueItems": true,
            "items": {
              "type": "string",
              "enum": ["read", "write"]
            }
          },
          "allowsSharing": {
            "type": "boolean",
            "description": "Whether a connection using this role may perform the server-side Share (bucket-policy) write. A read-only role must be false and provisioned with an explicit write-Deny (floor (d))."
          }
        }
      }
    }
  }
}