{
  "realm": "scouthub",
  "enabled": true,
  "organizationsEnabled": true,
  "sslRequired": "external",
  "registrationAllowed": true,
  "registrationEmailAsUsername": true,
  "loginWithEmailAllowed": true,
  "resetPasswordAllowed": true,
  "verifyEmail": false,

  "roles": {
    "realm": [
      { "name": "admin-centrale", "description": "Placeholder temporaneo: crea nuovi gruppi scout (Organization). Vedi TODO in src/routes/gruppi.routes.ts" },
      { "name": "capo-gruppo", "description": "Gestisce il proprio gruppo scout (Organization): membri, inviti, ruoli" },
      { "name": "capo-unita", "description": "Gestisce attivita' e materiali della propria branca" },
      { "name": "censito", "description": "Accesso in sola consultazione" },
      { "name": "manage-organizations", "description": "Placeholder locale: il ruolo reale e' il client role manage-organizations su realm-management" }
    ]
  },

  "clients": [
    {
      "clientId": "scouthub-home-be",
      "name": "Servizio di gestione gruppi scout (org-service)",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": false,
      "directAccessGrantsEnabled": false,
      "serviceAccountsEnabled": true,
      "clientAuthenticatorType": "client-secret",
      "secret": "CAMBIA-QUESTO-SECRET-IN-UN-VAULT",
      "attributes": {
        "note": "Usato solo server-to-server dal backend org-service verso le Admin REST API. Non esporre mai il secret al frontend."
      }
    },
    {
      "clientId": "scouthub-frontend",
      "name": "Frontend Angular Scouthub",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": true,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [
        "http://localhost:4200/*",
        "http://localhost:4201/*"
      ],
      "webOrigins": [
        "http://localhost:4200",
        "http://localhost:4201"
      ],
      "defaultClientScopes": [
        "openid",
        "basic",
        "roles",
        "profile",
        "email",
        "organization"
      ]
    }
  ]
}