# Generated by Django 5.1.12 on 2025-10-02 10:57

import authentik.lib.models
import django.db.models.deletion
import uuid
from django.conf import settings
from django.db import migrations, models


class Migration(migrations.Migration):

    dependencies = [
        ("authentik_core", "0051_group_authentik_c_is_supe_1e5a97_idx"),
        ("authentik_providers_saml", "0019_samlprovider_default_name_id_policy"),
        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
    ]

    operations = [
        migrations.AddField(
            model_name="samlprovider",
            name="logout_method",
            field=models.TextField(
                choices=[
                    ("frontchannel_iframe", "Frontchannel Iframe"),
                    ("frontchannel_native", "Frontchannel Native"),
                    ("backchannel", "Backchannel"),
                ],
                default="frontchannel_iframe",
                help_text="Method to use for logout. Front-channel iframe loads all logout URLs simultaneously in hidden iframes. Front-channel native uses your active browser tab to send post requests and redirect to providers. Back-channel sends logout requests directly from the server without user interaction (requires POST SLS binding).",
            ),
        ),
        migrations.AddField(
            model_name="samlprovider",
            name="sign_logout_request",
            field=models.BooleanField(default=False),
        ),
        migrations.AddField(
            model_name="samlprovider",
            name="sls_binding",
            field=models.TextField(
                choices=[("redirect", "Redirect"), ("post", "Post")],
                default="redirect",
                help_text="This determines how authentik sends the logout response back to the Service Provider.",
                verbose_name="SLS Binding",
            ),
        ),
        migrations.AddField(
            model_name="samlprovider",
            name="sls_url",
            field=models.TextField(
                blank=True,
                help_text="Single Logout Service URL where the logout response should be sent.",
                validators=[authentik.lib.models.DomainlessURLValidator(schemes=("http", "https"))],
                verbose_name="SLS URL",
            ),
        ),
        migrations.CreateModel(
            name="SAMLSession",
            fields=[
                ("expires", models.DateTimeField(default=None, null=True)),
                ("expiring", models.BooleanField(default=True)),
                (
                    "saml_session_id",
                    models.UUIDField(default=uuid.uuid4, primary_key=True, serialize=False),
                ),
                ("session_index", models.TextField(help_text="SAML SessionIndex for this session")),
                ("name_id", models.TextField(help_text="SAML NameID value for this session")),
                (
                    "name_id_format",
                    models.TextField(blank=True, default="", help_text="SAML NameID format"),
                ),
                ("created", models.DateTimeField(auto_now_add=True)),
                (
                    "provider",
                    models.ForeignKey(
                        on_delete=django.db.models.deletion.CASCADE,
                        to="authentik_providers_saml.samlprovider",
                    ),
                ),
                (
                    "session",
                    models.ForeignKey(
                        help_text="Link to the user's authenticated session",
                        on_delete=django.db.models.deletion.CASCADE,
                        to="authentik_core.authenticatedsession",
                    ),
                ),
                (
                    "user",
                    models.ForeignKey(
                        on_delete=django.db.models.deletion.CASCADE,
                        to=settings.AUTH_USER_MODEL,
                        verbose_name="User",
                    ),
                ),
            ],
            options={
                "verbose_name": "SAML Session",
                "verbose_name_plural": "SAML Sessions",
                "indexes": [
                    models.Index(fields=["session_index"], name="authentik_p_session_662109_idx"),
                    models.Index(
                        fields=["provider", "user"], name="authentik_p_provide_92c2e4_idx"
                    ),
                    models.Index(fields=["session"], name="authentik_p_session_5f125f_idx"),
                ],
                "unique_together": {("session_index", "provider")},
            },
        ),
    ]
