state

type DeviceLogin struct {
	DeviceCode string
	UserCode   string
	State      DeviceLoginState

	ClientName       string
	ClientVersion    string
	RequestIP        string
	RequestUserAgent string

	CreateTime time.Time
	ExpireTime time.Time

	// ApprovedByUserID is the approver, set once the request is approved.
	ApprovedByUserID int
	// contains filtered or unexported fields
}

type DeviceLoginState int

type DeviceLoginStore struct {
	// contains filtered or unexported fields
}

type LoginLimiter struct {
	// contains filtered or unexported fields
}

type OAuthAuthorizationRequest struct {
	// RequestID is opaque and assigned by the store; it is the only handle the
	// consent page and the audit log ever see.
	RequestID string
	ClientID  string
	// ClientName is display only and not verified.
	ClientName          string
	RedirectURI         string
	Resource            string
	Scopes              []string
	CodeChallenge       string
	CodeChallengeMethod string
	// ClientState is the client's opaque `state`, echoed back when the flow
	// completes.
	ClientState string
	// UserID is the signed-in user the request belongs to; no method will
	// resolve the request for anybody else.
	UserID           int
	ApprovedByUserID int
	State            OAuthAuthorizationState
	// Code is minted by Complete and consumed by Exchange.
	Code           string
	RequestIP      string
	CreateTime     time.Time
	ExpireTime     time.Time
	CodeExpireTime time.Time
}

type OAuthAuthorizationRequestStore struct {
	// contains filtered or unexported fields
}

type OAuthAuthorizationState string

type RevocationCache struct {
	// contains filtered or unexported fields
}

type State struct {
	// TokenRevocationCache caches lookups in the persistent revoked_token table,
	// which is the authority; see RevocationCache.
	TokenRevocationCache *RevocationCache
	// InstanceOutstandingConnections counts the open connections per instance.
	InstanceOutstandingConnections *resourceLimiter
	// LoginLimiter throttles failed password logins per account and per source.
	LoginLimiter *LoginLimiter
	// LoginRequestLimiter bounds anonymous Login requests per source and
	// globally, before either the account limiter or bcrypt runs.
	LoginRequestLimiter *WindowLimiter
	// CreateUserRequestLimiter bounds anonymous CreateUser requests per source
	// and globally; each one checks email existence and hashes a password.
	CreateUserRequestLimiter *WindowLimiter
	// LogoutRequestLimiter bounds anonymous Logout requests per source and
	// globally; each one writes a ledger row even when the revocation it asks
	// for is a repeated no-op.
	LogoutRequestLimiter *WindowLimiter
	// PrincipalRequestLimiter bounds the ledger-writing calls of a signed-in
	// caller, keyed by principal and procedure; the ledger never shrinks, so its
	// growth is bounded for an authenticated caller too. See
	// PrincipalThrottleInterceptor.
	PrincipalRequestLimiter *WindowLimiter
	// SSOStateCache holds one-time OAuth2 state nonces issued by
	// CreateSSOState, mapped to their issue time.
	SSOStateCache *lru.Cache[string, time.Time]
	// SSOStateRequestLimiter bounds anonymous CreateSSOState requests per source
	// and globally, before the handler adds a nonce to SSOStateCache.
	SSOStateRequestLimiter *WindowLimiter
	// DeviceLoginStore holds the in-flight device authorization requests.
	DeviceLoginStore *DeviceLoginStore
	// DeviceLoginLimiter throttles CreateDeviceLogin per source address.
	DeviceLoginLimiter *WindowLimiter
	// DeviceLoginLookupLimiter throttles GetDeviceLogin and ApproveDeviceLogin
	// per caller, so holding an account does not buy unlimited guesses at
	// someone else's user code.
	DeviceLoginLookupLimiter *WindowLimiter
	// OAuthAuthorizationRequestStore holds the pending OAuth 2.1 authorization
	// requests and the single-use authorization codes minted from them.
	OAuthAuthorizationRequestStore *OAuthAuthorizationRequestStore
	// MCPCallLimiter throttles MCP tool calls per principal. The endpoint is a
	// remote entry point a model drives, and every call reads the registry and
	// writes a ledger row.
	MCPCallLimiter *WindowLimiter
	// MCPSourceCallLimiter bounds requests to the MCP endpoint per source
	// address, counted before the bearer check, so an unauthenticated probe is
	// bounded even though it never becomes a tool call.
	MCPSourceCallLimiter *WindowLimiter
}

type WindowLimiter struct {
	// contains filtered or unexported fields
}