oidc

type AccessIssuer interface {
	IssueOAuthAccess(ctx context.Context, userID, clientID string, scopes []string, refreshFamilyID string, ttl time.Duration) (plaintext string, err error)
}

type AuthCode struct {
	ClientID            string
	UserID              string
	RedirectURI         string
	Scopes              []string
	CodeChallenge       string
	CodeChallengeMethod string
	ExpiresAt           time.Time
}

type AuthCodeCreate struct {
	CodeHash            string
	ClientID            string
	UserID              string
	RedirectURI         string
	Scopes              []string
	CodeChallenge       string
	CodeChallengeMethod string
	ExpiresAt           time.Time
}

type AuthorizeContext struct {
	Client Client
	Scopes []string // the concrete scopes that will be granted on approval
}

type AuthorizeRequest struct {
	ClientID            string
	RedirectURI         string
	ResponseType        string
	Scopes              []string
	State               string
	CodeChallenge       string
	CodeChallengeMethod string
}

type AuthorizedApp struct {
	ClientID   string
	ClientName string
	FamilyID   string
	Scopes     []string
	GrantedAt  time.Time
}

type Client struct {
	ClientID         string
	Name             string
	ClientSecretHash string
	ClientType       string
	RedirectURIs     []string
	GrantTypes       []string
	Scopes           []string
	OwnerUserID      string
	Disabled         bool
	CreatedAt        time.Time
}

type ClientCreate struct {
	ClientID         string
	Name             string
	ClientSecretHash string
	ClientType       string
	RedirectURIs     []string
	GrantTypes       []string
	Scopes           []string
	OwnerUserID      string
}

type ClientRegistration struct {
	Name         string
	ClientType   string
	RedirectURIs []string
	Scopes       []string
}

type Config struct {
	Store      Store
	Issuer     AccessIssuer
	Now        func() time.Time
	Logger     *slog.Logger
	CodeTTL    time.Duration
	AccessTTL  time.Duration
	RefreshTTL time.Duration
}

type PostgresStore struct {
	// contains filtered or unexported fields
}

type RedirectError struct {
	RedirectURI string
	State       string
	Code        string // oauth error code, e.g. invalid_scope
	Description string
}

type RefreshCreate struct {
	PublicID  string
	TokenHash string
	ClientID  string
	UserID    string
	Scopes    []string
	FamilyID  string
	ExpiresAt time.Time
}

type RefreshRecord struct {
	ID            string
	PublicID      string
	TokenHash     string
	ClientID      string
	UserID        string
	Scopes        []string
	FamilyID      string
	ExpiresAt     time.Time
	Consumed      bool
	FamilyRevoked bool
}

type Service struct {
	// contains filtered or unexported fields
}

type Store interface {
	// Clients.
	CreateClient(ctx context.Context, c ClientCreate) (Client, error)
	GetClient(ctx context.Context, clientID string) (Client, error)
	ListClientsByOwner(ctx context.Context, ownerUserID string) ([]Client, error)
	UpdateClientSecret(ctx context.Context, clientID, ownerUserID, secretHash string) (int64, error)
	DisableClient(ctx context.Context, clientID, ownerUserID string) (int64, error)

	// Authorization codes (single-use).
	CreateCode(ctx context.Context, c AuthCodeCreate) error
	// ConsumeCode atomically marks a code consumed and returns it. found=false
	// means the code was unknown or already consumed (replay).
	ConsumeCode(ctx context.Context, codeHash string) (code AuthCode, found bool, err error)
	// RevokeCodesForUserClient burns any outstanding codes for a user+client, so a
	// grant revoke cannot be undone by exchanging an in-flight code.
	RevokeCodesForUserClient(ctx context.Context, userID, clientID string) error

	// Refresh families (the revocation unit).
	CreateFamily(ctx context.Context, userID, clientID string) (familyID string, err error)
	// RevokeFamily kills one family (reuse detection or a single-grant revoke).
	RevokeFamily(ctx context.Context, familyID string) error
	// RevokeFamiliesForUserClient kills every family a user holds for a client
	// (user-initiated app disconnect).
	RevokeFamiliesForUserClient(ctx context.Context, userID, clientID string) error

	// Refresh tokens (rotating within a family).
	CreateRefresh(ctx context.Context, r RefreshCreate) (RefreshRecord, error)
	// GetRefreshByPublicID returns the token joined with its family's revoked
	// state (RefreshRecord.FamilyRevoked), so callers see family revocation at
	// read time without a second query.
	GetRefreshByPublicID(ctx context.Context, publicID string) (RefreshRecord, error)
	// ConsumeRefresh atomically consumes the presented token and links it to its
	// replacement. found=false means it was already consumed (replay); the caller
	// then revokes the family. Family-level revocation is checked separately via
	// GetRefreshByPublicID.
	ConsumeRefresh(ctx context.Context, publicID, replacedByID string) (rec RefreshRecord, found bool, err error)
	ListAuthorizedApps(ctx context.Context, userID string) ([]AuthorizedApp, error)
}

type TokenRequest struct {
	GrantType    string
	ClientID     string
	ClientSecret string
	Code         string
	RedirectURI  string
	CodeVerifier string
	RefreshToken string
	Scope        []string
}

type TokenResult struct {
	AccessToken  string
	RefreshToken string
	TokenType    string
	ExpiresIn    int
	Scopes       []string
}