oauth

type AuthProxy interface {
	Authorize(ctx context.Context, baseURL string, req AuthorizeRequest) (string, error)
	Callback(ctx context.Context, baseURL, state, code, idpErr, idpErrDesc string) (string, error)
	Exchange(ctx context.Context, baseURL string, req TokenRequest) (map[string]any, error)
}

type AuthorizeRequest struct {
	ResponseType        string
	ClientID            string
	RedirectURI         string
	State               string
	Scope               string
	CodeChallenge       string
	CodeChallengeMethod string
	Resource            string
}

type ClientStore interface {
	SaveClient(ctx context.Context, key string, c RegisteredClient) error
	GetClient(ctx context.Context, key string) (*RegisteredClient, error)
}

type CodeGrant struct {
	ClientID      string         `json:"client_id"`
	RedirectURI   string         `json:"redirect_uri"`
	CodeChallenge string         `json:"code_challenge"`
	Token         map[string]any `json:"token"`
	Subject       string         `json:"subject,omitempty"`
	AuthID        string         `json:"auth_id,omitempty"`
	GatewayID     string         `json:"gateway_id,omitempty"`
	Audiences     []string       `json:"audiences,omitempty"`
	Scopes        []string       `json:"scopes,omitempty"`
	SessionMode   bool           `json:"session_mode,omitempty"`
}

type ConnectPage struct {
	ConsumerPath string
	Providers    []ProviderStatus
	ResumeURL    string
}

type ConnectService interface {
	CreateTicket(ctx context.Context, gatewayID ids.GatewayID, principalSub, consumerPath string) (string, error)
	Page(ctx context.Context, ticketID string) (*ConnectPage, error)
	Start(ctx context.Context, baseURL, ticketID, provider string) (string, error)
	Callback(ctx context.Context, baseURL, provider, state, code, errCode, errDesc string) (string, error)
	Disconnect(ctx context.Context, ticketID, provider string) error
	RefreshAuth(ctx context.Context, gatewayID ids.GatewayID, reg *registrydomain.Registry) (*registrydomain.MCPAuth, error)
	ChainURL(ctx context.Context, baseURL string, gatewayID ids.GatewayID, resource, principalSub, resumeURL string) (string, error)
}

type ConnectState struct {
	Ticket   ConnectTicket `json:"ticket"`
	TicketID string        `json:"ticket_id"`
	Provider string        `json:"provider"`
	Verifier string        `json:"verifier,omitempty"`
}

type ConnectStore interface {
	SaveTicket(ctx context.Context, id string, t ConnectTicket) error
	GetTicket(ctx context.Context, id string) (*ConnectTicket, error)
	SaveConnect(ctx context.Context, state string, s ConnectState) error
	TakeConnect(ctx context.Context, state string) (*ConnectState, error)
}

type ConnectTicket struct {
	GatewayID    string `json:"gateway_id"`
	PrincipalSub string `json:"principal_sub"`
	ConsumerPath string `json:"consumer_path"`
	ResumeURL    string `json:"resume_url,omitempty"`
}

type ConsentChainer interface {
	ChainURL(ctx context.Context, baseURL string, gatewayID ids.GatewayID, resource, principalSub, resumeURL string) (string, error)
}

type FlowStore interface {
	SavePending(ctx context.Context, state string, p PendingAuthorization) error
	TakePending(ctx context.Context, state string) (*PendingAuthorization, error)
	SaveCode(ctx context.Context, code string, g CodeGrant) error
	TakeCode(ctx context.Context, code string) (*CodeGrant, error)
	SaveGatewayClient(ctx context.Context, c RegisteredGatewayClient) error
	GetGatewayClient(ctx context.Context, clientID string) (*RegisteredGatewayClient, error)
	SaveSession(ctx context.Context, refreshToken string, rec SessionRecord) error
	TakeSession(ctx context.Context, refreshToken string) (*SessionRecord, error)
}

type MetadataService interface {
	ProtectedResource(ctx context.Context, baseURL, resource string) (*ProtectedResourceMetadata, error)
	AuthorizationServer(ctx context.Context, baseURL string) (map[string]any, error)
	RegisterClient(ctx context.Context, req RegisterRequest) (*RegisterResponse, error)
}

type OAuthError struct {
	Code        string `json:"error"`
	Description string `json:"error_description,omitempty"`
}

type PendingAuthorization struct {
	ClientID            string `json:"client_id"`
	RedirectURI         string `json:"redirect_uri"`
	State               string `json:"state"`
	CodeChallenge       string `json:"code_challenge"`
	CodeChallengeMethod string `json:"code_challenge_method"`
	Scope               string `json:"scope"`
	CodeVerifier        string `json:"code_verifier"`
	Resource            string `json:"resource,omitempty"`
	AuthID              string `json:"auth_id,omitempty"`
}

type ProtectedResourceMetadata struct {
	Resource               string   `json:"resource"`
	AuthorizationServers   []string `json:"authorization_servers,omitempty"`
	BearerMethodsSupported []string `json:"bearer_methods_supported"`
	ScopesSupported        []string `json:"scopes_supported,omitempty"`
}

type ProviderClient interface {
	AuthorizeURL(cfg *registrydomain.MCPAuth, redirectURI, state, challenge string) string
	ExchangeCode(ctx context.Context, cfg *registrydomain.MCPAuth, code, redirectURI, verifier string) (*ProviderToken, error)
	Refresh(ctx context.Context, cfg *registrydomain.MCPAuth, refreshToken string) (*ProviderToken, error)
}

type ProviderStatus struct {
	Provider   string
	Registry   string
	Linked     bool
	AccountRef string
	ExpiresAt  time.Time
}

type ProviderToken struct {
	AccessToken  string
	RefreshToken string
	Scopes       []string
	ExpiresAt    time.Time
}

type RegisterRequest struct {
	RedirectURIs []string `json:"redirect_uris"`
	ClientName   string   `json:"client_name,omitempty"`
}

type RegisterResponse struct {
	ClientID                string   `json:"client_id"`
	RedirectURIs            []string `json:"redirect_uris,omitempty"`
	ClientName              string   `json:"client_name,omitempty"`
	GrantTypes              []string `json:"grant_types"`
	ResponseTypes           []string `json:"response_types"`
	TokenEndpointAuthMethod string   `json:"token_endpoint_auth_method"`
}

type RegisteredClient struct {
	ClientID     string `json:"client_id"`
	ClientSecret string `json:"client_secret,omitempty"`
	RedirectURI  string `json:"redirect_uri"`
}

type RegisteredGatewayClient struct {
	ClientID     string   `json:"client_id"`
	RedirectURIs []string `json:"redirect_uris"`
	ClientName   string   `json:"client_name,omitempty"`
}

type SessionRecord struct {
	Subject   string   `json:"subject"`
	Scopes    []string `json:"scopes,omitempty"`
	GatewayID string   `json:"gateway_id"`
	AuthID    string   `json:"auth_id"`
	Audiences []string `json:"audiences,omitempty"`
}

type TokenRequest struct {
	GrantType    string
	Code         string
	RedirectURI  string
	ClientID     string
	CodeVerifier string
	RefreshToken string
	Resource     string
}

type UpstreamAuthServer struct {
	Issuer                string   `json:"issuer"`
	AuthorizationEndpoint string   `json:"authorization_endpoint"`
	TokenEndpoint         string   `json:"token_endpoint"`
	RegistrationEndpoint  string   `json:"registration_endpoint"`
	ScopesSupported       []string `json:"scopes_supported"`
	Resource              string   `json:"resource"`
}

type UpstreamRegistrar interface {
	Discover(ctx context.Context, upstreamURL string) (*UpstreamAuthServer, error)
	EnsureClient(ctx context.Context, key string, meta *UpstreamAuthServer, redirectURI string) (*RegisteredClient, error)
	CachedClient(ctx context.Context, key string) (*RegisteredClient, error)
}

type UserInfoClient interface {
	Fetch(ctx context.Context, userInfoURL, accessToken string) (map[string]any, error)
}