{
    "$schema": "http://json-schema.org/draft-07/schema#",
    "type": "object",
    "properties": {
        "provider": {
            "type": "object",
            "description": "The OAuth2 endpoint configuration. If not set, uses application config.",
            "required": [],
            "properties": {
                "url": {
                    "type": "string",
                    "description": "The URL of the OAuth flow provider's entry point."
                },
                "redirectUrl": {
                    "type": "string",
                    "description": "The URL the OAuth provider should redirect to."
                },
                "accessTokenUrl": {
                    "type": "string",
                    "description": "The location where the application can obtain an access token."
                },
                "clientId": {
                    "type": "string",
                    "description": "The client identifier."
                },
                "clientSecret": {
                    "type": "string",
                    "description": "The client secret."
                },
                "scope": {
                    "type": "string",
                    "description": "The authorization scopes to request from the provider."
                },
                "sessionStorageId": {
                    "type": "string",
                    "description": "A unique identifier for storing temporary information inside the browser's sessionStorage",
                    "format": "topic",
                    "default": "default"
                }
            }
        },
        "auth": {
            "type": "object",
            "description": "Authenticate with the OAuth2 provider.",
            "required": [
                "resource"
            ],
            "properties": {
                "onActions": {
                    "type": "array",
                    "description": "Names of the actions that trigger OAuth2 authentication.",
                    "items": {
                        "type": "string",
                        "format": "topic"
                    },
                    "default": []
                },
                "token": {
                    "type": "string",
                    "description": "Use the given OAuth2 access token (instead of using the OAuth provider)."
                },
                "resource": {
                    "type": "string",
                    "description": "The name under which to publish the OAuth access token.",
                    "format": "topic"
                },
                "flag": {
                    "type": "string",
                    "description": "The name of the flag indicating the current authentication state.",
                    "format": "topic"
                },
                "drop": {
                    "type": "object",
                    "description": "When to drop authorization.",
                    "properties": {
                        "onActions": {
                            "type": "array",
                            "description": "Names of the actions that trigger de-authentication.",
                            "items": {
                                "type": "string",
                                "format": "topic"
                            },
                            "default": []
                        }
                    },
                    "default": {
                        "onActions": []
                    }
                }
            }
        }
    }
}