config

type Config struct {
	OAuth OAuthConfig
	// AppOrigin is the public URL of the frontend (e.g. http://localhost:5173). When set, invite URLs and OAuth redirects use it; non-API requests to this server return 401 Unauthorized.
	AppOrigin string
}

type OAuthClientMTLSConfig struct {
	Enabled     bool
	TLSCertFile string
	TLSKeyFile  string
	TLSVersion  uint16
}

type OAuthConfig struct {
	Providers map[string]OAuthProviderConfig
}

type OAuthProviderConfig struct {
	ClientID            string
	ClientSecret        string // #nosec G117 -- OAuth client secret from config, not logged
	Scopes              []string
	AuthURL             string
	TokenURL            string
	UserInfoURL         string
	UserIDClaim         string // JSON claim for provider user id; default "sub"
	EmailClaim          string // JSON claim for email; default "email"
	EmailsURL           string // Optional second URL returning a JSON array when email is not on userinfo (e.g. GitHub /user/emails)
	EmailsPrimaryClaim  string // Claim on array entries marking the preferred email; default "primary"
	EmailVerifiedClaim  string // Userinfo claim that must be true when email comes from userinfo (e.g. email_verified)
	EmailsVerifiedClaim string // Emails-list entry claim that must be true (e.g. verified on GitHub /user/emails)
	AllowEmailMatch     bool   // Allow signing in to an existing account by email alone; default false
	DisplayName         string // Login/signup button label; default derived from provider id
	ClientMTLS          OAuthClientMTLSConfig
}