provider

type AuthCodeConfig struct {
	RedirectURI         string
	Scopes              []string
	CodeChallenge       string
	CodeChallengeMethod string
	Prompt              string
	AccessType          string
	ExtraParams         map[string]string
}

type AuthCodeOption func(*AuthCodeConfig)

type ExchangeConfig struct {
	RedirectURI  string
	CodeVerifier string
	ExtraParams  map[string]string
}

type ExchangeOption func(*ExchangeConfig)

type GenericConfig struct {
	// Name uniquely identifies the provider (e.g. "google", "github").
	Name string

	// ClientID is the public OAuth client identifier issued by the provider.
	ClientID string

	// ClientSecret is the confidential OAuth client secret issued by the provider.
	ClientSecret string

	// AuthURL is the authorization endpoint URL where users are redirected.
	AuthURL string

	// TokenURL is the token endpoint URL where codes are exchanged for tokens.
	TokenURL string

	// UserInfoURL is the endpoint URL where user claims / profile data are fetched.
	UserInfoURL string

	// Scopes are the default scopes requested during authorization.
	Scopes []string

	// AllowedRedirectURIs defines valid redirect URIs for this provider.
	// Empty list means all non-empty redirect URIs are allowed (not recommended for production).
	AllowedRedirectURIs []string

	// HTTPClient is the HTTP client used to perform outbound requests to the provider.
	// Defaults to &http.Client{Timeout: 15 * time.Second} if nil.
	HTTPClient HTTPClient

	// ProfileExtractor customizes the parsing of user profile responses.
	// If nil, StandardProfileExtractor is used.
	ProfileExtractor ProfileExtractorFunc
}

type GenericProvider struct {
	// contains filtered or unexported fields
}

type HTTPClient interface {
	Do(req *http.Request) (*http.Response, error)
}

type ProfileExtractorFunc func(ctx context.Context, rawBody []byte, token *TokenResponse) (*ProviderProfile, error)

type Provider interface {
	// Name returns the unique identifier of the provider (e.g. "google", "github").
	Name() string

	// AuthCodeURL constructs the authorization redirect URL with the given state and options.
	AuthCodeURL(state string, opts ...AuthCodeOption) string

	// Exchange sends the authorization code to the provider's token endpoint to acquire tokens.
	Exchange(ctx context.Context, code string, opts ...ExchangeOption) (*TokenResponse, error)

	// FetchProfile retrieves normalized user identity claims using the provided tokens.
	FetchProfile(ctx context.Context, tokens *TokenResponse) (*ProviderProfile, error)

	// ValidateRedirectURI checks whether the requested redirect URI is permitted.
	ValidateRedirectURI(redirectURI string) bool
}

type ProviderCommonConfig struct {
	ClientID            string
	ClientSecret        string
	AllowedRedirectURIs []string
	HTTPClient          HTTPClient
}

type ProviderProfile struct {
	// Provider is the identifier of the identity provider (e.g., "google", "github").
	Provider string `json:"provider"`

	// ProviderID is the unique, stable identifier of the subject within the provider.
	ProviderID string `json:"provider_id"`

	// Email is the primary email address reported by the provider.
	Email string `json:"email"`

	// EmailVerified indicates whether the external provider asserts that the email has been verified.
	EmailVerified bool `json:"email_verified"`

	// Name is the display name of the user.
	Name string `json:"name,omitempty"`

	// Username is the handle or screen name of the user, if available.
	Username string `json:"username,omitempty"`

	// AvatarURL is a URL pointing to the user's avatar image.
	AvatarURL string `json:"avatar_url,omitempty"`

	// Raw contains the unparsed claims returned by the provider's profile or userinfo endpoint.
	Raw map[string]any `json:"raw,omitempty"`
}

type TokenResponse struct {
	AccessToken  string         `json:"access_token"`
	TokenType    string         `json:"token_type"`
	RefreshToken string         `json:"refresh_token,omitempty"`
	ExpiresIn    int64          `json:"expires_in,omitempty"`
	ExpiresAt    time.Time      `json:"expires_at,omitempty"`
	Scope        string         `json:"scope,omitempty"`
	IDToken      string         `json:"id_token,omitempty"`
	Raw          map[string]any `json:"raw,omitempty"`
}