action britbox_single_sign_on {
  label: "singleSignOn"
  description: "Exchange a third party single-sign-on token for our own authorization tokens."
  provider: britbox
  method: POST
  path: "/authorization/sso"
  encoding: json
  input: {
    type: "object"
    required: ["provider", "token"]
    properties: {
      cookieType: {
        type: "string"
        description: "If you specify a cookie type then a content filter cookie will be returned\nalong with the token(s). This is only intended for web based clients which\nneed to pass the cookies to a server to render a page based on the user's\ncontent filters e.g subscription code.\n\nIf type `Session` the cookie will be session based.\nIf type `Persistent` the cookie will have a medium term lifespan.\nIf undefined no cookies will be set.\n"
        enum: ["Session", "Persistent"]
      }
      linkAccounts: {
        type: "boolean"
        description: "When a user attempts to sign in using single-sign-on, we may find an account created\npreviously through the manual sign up flow with the same email. If this is the\ncase then an option to link the two accounts can be made available.\n\nIf this flag is set to true then accounts will be linked automatically.\n\nIf this flag is not set or set to false and an existing account is found \nthen an http 401 with subcode `6001` will be returned. Client apps can then present the\noption to link the accounts. If the user decides to accept, then the same call\ncan be repeated with this flag set to true.\n"
      }
      provider: {
        type: "string"
        description: "The third party single-sign-on provider."
        enum: ["Facebook"]
      }
      scopes: {
        type: "array"
        description: "The scope(s) of the tokens required.\nFor each scope listed an Account and Profile token of that scope will be returned.\n"
        items: {
          type: "string"
          enum: ["Catalog", "Commerce", "Settings", "Playback"]
        }
      }
      token: {
        type: "string"
        description: "A token from the third party single-sign-on provider e.g. an identity token from Facebook."
      }
    }
    additionalProperties: false
  }
  output: {
    type: "array"
    items: {
      type: "object"
      required: ["value", "refreshable", "expirationDate", "type"]
      properties: {
        accountCreated: {
          type: "boolean"
          description: "When a `UserAccount` token is issued during a single-sign-on flow\na user may have been automatically registered if they didn't\nhave an account already. If this occurs then `accountCreated`\nwill be `true`.\n"
        }
        expirationDate: {
          type: "string"
          format: "date-time"
          description: "The timestamp this token expires."
        }
        refreshable: {
          type: "boolean"
          description: "True if this token can be refreshed, false if not."
        }
        type: {
          type: "string"
          description: "The type of the token."
          enum: ["UserAccount", "UserProfile"]
        }
        value: {
          type: "string"
          description: "The token value used for authenticated requests."
        }
      }
      additionalProperties: false
    }
    additionalProperties: false
  }
}