$AzureKeyVaultProvider = @{
    Name = "AzureKeyVault"
    SupportedTypes = @(
        "credential",
        "securestring",
        "string"
    )
    Resolver = {
        Param(
            [Parameter(Mandatory=$true)]
            [System.Collections.IDictionary]
            $Reference,

            [Parameter(Mandatory=$true)]
            [ValidateSet("credential", "securestring", "string")]
            [string]
            $ExpectedType,

            [Parameter(Mandatory=$false)]
            [hashtable]
            $ProviderSettings = @{}
        )

        $GetSecretCommand = Get-Command -Name Get-AzKeyVaultSecret -ErrorAction SilentlyContinue
        if($null -eq $GetSecretCommand){
            throw "AzureKeyVault provider requires the module [Az.KeyVault] and command [Get-AzKeyVaultSecret]."
        }

        $Vault = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Vault" -DefaultValue "")
        $Name = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Name")
        $UserName = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "UserName" -DefaultValue "")
        $Options = Get-ConfigurationDataMapValue -Map $Reference -Key "Options" -DefaultValue @{}

        if([string]::IsNullOrWhiteSpace($Vault) -and $ProviderSettings.ContainsKey("DefaultVault")){
            $Vault = [string]$ProviderSettings.DefaultVault
        }

        if([string]::IsNullOrWhiteSpace($Vault)){
            throw "AzureKeyVault secret [$Name] requires [Vault] or provider setting [DefaultVault]."
        }

        if($ProviderSettings.ContainsKey("SubscriptionId") -or $ProviderSettings.ContainsKey("TenantId")){
            $SetContextCommand = Get-Command -Name Set-AzContext -ErrorAction SilentlyContinue
            if($null -eq $SetContextCommand){
                throw "AzureKeyVault provider settings define Azure context values, but command [Set-AzContext] was not found. Install [Az.Accounts] or remove SubscriptionId/TenantId from provider settings."
            }

            $ContextParameters = @{}
            if($ProviderSettings.ContainsKey("SubscriptionId") -and -not [string]::IsNullOrWhiteSpace([string]$ProviderSettings.SubscriptionId)){
                $ContextParameters["SubscriptionId"] = [string]$ProviderSettings.SubscriptionId
            }

            if($ProviderSettings.ContainsKey("TenantId") -and -not [string]::IsNullOrWhiteSpace([string]$ProviderSettings.TenantId)){
                $ContextParameters["Tenant"] = [string]$ProviderSettings.TenantId
            }

            if($ContextParameters.Count -gt 0){
                & $SetContextCommand @ContextParameters | Out-Null
            }
        }

        $CommandParameters = @{
            VaultName = $Vault
            Name = $Name
        }

        if($Options -is [System.Collections.IDictionary]){
            foreach($Key in $Options.Keys){
                $CommandParameters[$Key] = $Options[$Key]
            }
        }

        if($ExpectedType -eq "string" -and $GetSecretCommand.Parameters.ContainsKey("AsPlainText") -and -not $CommandParameters.ContainsKey("AsPlainText")){
            $CommandParameters["AsPlainText"] = $true
        }

        $Secret = & $GetSecretCommand @CommandParameters
        if($null -eq $Secret){
            throw "Azure Key Vault secret [$Name] was not found in vault [$Vault]."
        }

        if($ExpectedType -eq "string" -and $Secret -is [string]){
            return $Secret
        }

        if($Secret.PSObject.Properties["SecretValue"]){
            return ConvertFrom-ConfigurationDataSecretValue -Secret $Secret.SecretValue -ExpectedType $ExpectedType -Name $Name -UserName $UserName
        }

        return ConvertFrom-ConfigurationDataSecretValue -Secret $Secret -ExpectedType $ExpectedType -Name $Name -UserName $UserName
    }
}

Register-ConfigurationDataSecretProvider @AzureKeyVaultProvider