authflow

type DeviceLoginClient interface {
	CreateDeviceLogin(context.Context, *connect.Request[v1pb.CreateDeviceLoginRequest]) (*connect.Response[v1pb.CreateDeviceLoginResponse], error)
	ExchangeDeviceLogin(context.Context, *connect.Request[v1pb.ExchangeDeviceLoginRequest]) (*connect.Response[v1pb.ExchangeDeviceLoginResponse], error)
}

type Options struct {
	// ClientName and ClientVersion are shown on the confirmation page. They are
	// display only and the server never trusts them.
	ClientName    string
	ClientVersion string
	// Timeout bounds the whole flow, waiting for the person included.
	Timeout time.Duration
	// BareURL prints the page address without the code, so it has to be typed
	// there. The default carries the code: the terminal that starts the request
	// is the one that prints the link, so retyping the code it just showed only
	// adds a way to mistype it. The page still shows the code next to the client
	// name, version, source address and time, and still asks for an explicit
	// decision, which is what lets a person notice a request they did not start.
	BareURL bool
	// NoBrowser skips the attempt to open a browser.
	NoBrowser bool
	// ServerURL is the address the client is talking to. It is the fallback
	// confirmation address when the workspace has no external URL configured,
	// which is the normal state of a fresh or local deployment: the server
	// cannot name a page it does not know about, but the client at least knows
	// where it is sending requests.
	ServerURL string
	// OpenBrowser opens a URL. It is injected so tests do not launch anything.
	OpenBrowser func(url string) error
	// Sleep waits between polls. It is injected so tests do not wait.
	Sleep func(time.Duration)
	// Now reports the current time.
	Now func() time.Time
}

type Progress func(format string, args ...any)

type Result struct {
	Token     string
	ExpiresIn int64
	User      *v1pb.User
}