/**
 * TASK-0131 — SSO module (SAML 2.0 SP + OIDC RP + JIT provisioning + admin).
 *
 * Providers are module-scoped; `PrismaService`/`RedisService`/`AuditService`
 * come from the `@Global()` CoreModule. `AuthService` (session minting,
 * reused by the shared provisioning path) comes from `AuthModule`.
 *
 * Controllers:
 *  - `SamlController`  (`/saml/*`)  — SP metadata + start + ACS (OUTSIDE the
 *    api/v1 prefix — excluded in main.ts; whitelisted in AuthGuard).
 *  - `OidcController`  (`/sso/*`)   — authorize + callback + start dispatcher
 *    (OUTSIDE the api/v1 prefix).
 *  - `SsoAdminController` (`/orgs/:orgId/sso/*`) — admin CRUD + test + enforce
 *    (UNDER the api/v1 prefix → part of the OpenAPI contract surface).
 */
import { Module } from "@nestjs/common";
import { AuthModule } from "../auth/auth.module.js";
import { SamlController } from "./saml.controller.js";
import { OidcController } from "./oidc.controller.js";
import { SsoAdminController } from "./sso-admin.controller.js";
import { SsoSecretsService } from "./sso-secrets.js";
import { SsoProvisioningService } from "./provisioning.service.js";
import { OidcService } from "./oidc.service.js";
import { SsoAdminService } from "./sso-admin.service.js";

@Module({
  imports: [AuthModule],
  controllers: [SamlController, OidcController, SsoAdminController],
  providers: [SsoSecretsService, SsoProvisioningService, OidcService, SsoAdminService],
  exports: [SsoProvisioningService, SsoSecretsService]
})
export class SsoModule {}