code

type AuthorizationCode struct {
	// Code is the opaque high-entropy value returned to the client.
	Code     string
	ClientID string
	UserID   string
	// SessionID is the session established at /authorize; validated again on redemption.
	SessionID string
	// RedirectURI must exactly match the redirect_uri presented at /token.
	RedirectURI string
	Scope       string
	// Nonce is echoed into the id_token.
	Nonce string
	// ACRValues are the requested acr_values, enforced again at redemption.
	ACRValues []string
	// CodeChallenge is the PKCE S256 challenge; "" when the client did not use PKCE.
	CodeChallenge       string
	CodeChallengeMethod string
	ExpiresAt           time.Time
	// IssuedTokenID and IssuedTokenExpiresAt identify the JWT access token issued at
	// redemption so a replay can revoke it. Populated only on the ErrReplayed record.
	IssuedTokenID        string
	IssuedTokenExpiresAt time.Time
}

type Store interface {
	// Save persists a freshly minted code.
	Save(ctx context.Context, c *AuthorizationCode) error
	// Consume atomically fetches and deletes the code. It returns ErrNotFound for an unknown
	// or expired code, or the redeemed record with ErrReplayed when the code was already
	// consumed.
	Consume(ctx context.Context, code string) (*AuthorizationCode, error)
	// BindIssuedToken records the JWT access token issued for a redeemed code so a later
	// replay can revoke it.
	BindIssuedToken(ctx context.Context, code, tokenID string, expiresAt time.Time) error
}