types

type AuthorizeRequest struct {
	ProviderID string `path:"provider"`
	RedirectTo string `query:"redirect_to" json:"redirect_to,omitempty" nullable:"true"`
	// ActorID is set when an already signed-in user starts a linking flow.
	ActorID string `json:"-"`
}

type AuthorizeResponse struct {
	AuthURL string `json:"auth_url" required:"true" nullable:"false"`
}

type CallbackRequest struct {
	ProviderID string `path:"provider"`
	Code       string `query:"code" json:"code,omitempty" nullable:"true"`
	State      string `query:"state" json:"state,omitempty" nullable:"true"`
	Error      string `query:"error" json:"error,omitempty" nullable:"true"`

	// ActorID and SessionID are populated from the request context when a signed-in
	// user starts a linking flow.
	ActorID   string `json:"-"`
	SessionID string `json:"-"`

	// Signed flow cookies are validated by the use case.
	StateCookie    string `json:"-"`
	RedirectCookie string `json:"-"`
	VerifierCookie string `json:"-"`
}

type CallbackResponse struct {
	User    *models.User     `json:"user" required:"true" nullable:"false"`
	Session *CallbackSession `json:"session" required:"true" nullable:"false"`
}

type CallbackResult struct {
	User          *models.User
	Session       *models.Session
	SessionToken  string
	RedirectTo    string
	ReusedSession bool
}

type CallbackSession struct {
	ID        string    `json:"id" required:"true" nullable:"false"`
	UserID    string    `json:"user_id" required:"true" nullable:"false"`
	ExpiresAt time.Time `json:"expires_at" required:"true" nullable:"false"`
}

type ErrorResponse struct {
	Message string `json:"message" required:"true" nullable:"false"`
}

type OAuth2PluginConfig struct {
	Enabled     bool                      `json:"enabled" toml:"enabled"`
	HTTPTimeout time.Duration             `json:"http_timeout" toml:"http_timeout"`
	Providers   map[string]ProviderConfig `json:"providers" toml:"providers"`
}

type OAuth2Provider interface {
	Name() string
	GetConfig() *oauth2.Config
	GetAuthURL(state string, opts ...oauth2.AuthCodeOption) string
	Exchange(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error)
	GetUserInfo(ctx context.Context, token *oauth2.Token) (*UserInfo, error)
	RequiresPKCE() bool
}

type ProviderConfig struct {
	// Enabled defaults to true when absent. Set it explicitly to false to disable a provider.
	Enabled      *bool    `json:"enabled,omitempty" toml:"enabled,omitempty"`
	ClientID     string   `json:"client_id" toml:"client_id"`
	ClientSecret string   `json:"client_secret" toml:"client_secret"`
	RedirectURL  string   `json:"redirect_url" toml:"redirect_url"`
	Scopes       []string `json:"scopes" toml:"scopes"`
	AuthURL      string   `json:"auth_url" toml:"auth_url"`
	TokenURL     string   `json:"token_url" toml:"token_url"`
	UserInfoURL  string   `json:"user_info_url" toml:"user_info_url"`
	UserIDField  string   `json:"user_id_field" toml:"user_id_field"`
	EmailField   string   `json:"email_field" toml:"email_field"`
	NameField    string   `json:"name_field" toml:"name_field"`
	PictureField string   `json:"picture_field" toml:"picture_field"`
	// EmailVerifiedField is the field that carries the provider's email verification flag.
	EmailVerifiedField string `json:"email_verified_field" toml:"email_verified_field"`
	// PKCE controls whether this provider must use PKCE with S256. It defaults to true.
	// Setting it to false is an explicit opt-out and is not OAuth 2.1 compliant.
	PKCE *bool `json:"pkce,omitempty" toml:"pkce,omitempty"`
}

type RedirectResponse struct{}

type UserInfo struct {
	ProviderAccountID string         `json:"provider_account_id"`
	Email             string         `json:"email"`
	EmailVerified     bool           `json:"email_verified"`
	Name              string         `json:"name"`
	Picture           string         `json:"picture"`
	Raw               map[string]any `json:"raw"`
}