$SecretStoreProvider = @{
    Name = "SecretStore"
    SupportedTypes = @(
        "credential",
        "securestring",
        "string"
    )
    Resolver = {
        Param(
            [Parameter(Mandatory=$true)]
            [System.Collections.IDictionary]
            $Reference,

            [Parameter(Mandatory=$true)]
            [ValidateSet("credential", "securestring", "string")]
            [string]
            $ExpectedType,

            [Parameter(Mandatory=$false)]
            [hashtable]
            $ProviderSettings = @{}
        )

        $GetSecretCommand = Get-Command -Name Get-Secret -ErrorAction SilentlyContinue
        if($null -eq $GetSecretCommand){
            throw "SecretStore provider requires the module [Microsoft.PowerShell.SecretManagement] and command [Get-Secret]."
        }

        $Vault = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Vault" -DefaultValue "")
        $Name = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Name")
        $UserName = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "UserName" -DefaultValue "")
        $Options = Get-ConfigurationDataMapValue -Map $Reference -Key "Options" -DefaultValue @{}

        if([string]::IsNullOrWhiteSpace($Vault) -and $ProviderSettings.ContainsKey("DefaultVault")){
            $Vault = [string]$ProviderSettings.DefaultVault
        }

        $CommandParameters = @{
            Name = $Name
        }

        if(-not [string]::IsNullOrWhiteSpace($Vault)){
            $CommandParameters["Vault"] = $Vault
        }

        if($Options -is [System.Collections.IDictionary]){
            foreach($Key in $Options.Keys){
                $CommandParameters[$Key] = $Options[$Key]
            }
        }

        $Secret = & $GetSecretCommand @CommandParameters
        return ConvertFrom-ConfigurationDataSecretValue -Secret $Secret -ExpectedType $ExpectedType -Name $Name -UserName $UserName
    }
}

Register-ConfigurationDataSecretProvider @SecretStoreProvider