type ContextDialer interface {
	DialContext(ctx context.Context, net string, addr string) (net.Conn, error)
	Dial(net string, addr string) (net.Conn, error)
}

type Credential struct {
	// Username is the username without the domain.
	Username string
	// Password contains the users cleartext password if available.
	Password string
	// Domain holds the user's domain.
	Domain string
	// NTHash holds the user's NT hash or Kerberos RC4 key if available.
	NTHash string
	// AESKey holds the user's Kerberos AES128 or AES256 key if available.
	AESKey string
	// CCache contains the path to the user's CCache file.
	CCache string
	// ClientCert holds a client certificate for Kerberos or LDAP authentication if available.
	ClientCert *x509.Certificate
	// ClientCertKey holds the private key that corresponds to ClientCert.
	ClientCertKey any
	// CACerts holds CA certificates that were loaded alongside the ClientCert.
	CACerts []*x509.Certificate

	// PasswordIsEmptyString is true when an empty Password field should not be
	// interpreted as a missing password but as a password that happens to be
	// empty.
	PasswordIsEmtpyString bool
	// CCacheIsFromEnv indicates whether the CCache was set explicitly or
	// implicitly through an environment variable.
	CCacheIsFromEnv bool

	// Resolver can be used to set an alternative DNS resolver. If empty,
	// net.DefaultResolver is used.
	Resolver Resolver
	// contains filtered or unexported fields
}

type Dialer interface {
	Dial(net string, addr string) (net.Conn, error)
}

type Options struct {
	// Username (with domain) in one of the following formats:
	// `UPN`, `domain\user`, `domain/user` or `user`
	User             string
	Password         string
	NTHash           string
	AESKey           string
	CCache           string
	DomainController string
	ForceKerberos    bool

	// It is possible to specify a cert/key pair directly, as PEM files or as a
	// single PFX file.
	Certificate     *x509.Certificate
	CertificateKey  any
	PFXFileName     string
	PFXPassword     string
	PEMCertFileName string
	PEMKeyFileName  string

	Debug    func(fmt string, a ...any)
	Resolver Resolver
	// contains filtered or unexported fields
}

type Resolver interface {
	LookupAddr(ctx context.Context, addr string) ([]string, error)
	LookupIP(ctx context.Context, network string, host string) ([]net.IP, error)
	LookupSRV(ctx context.Context, service string, proto string, name string) (string, []*net.SRV, error)
}

type Target struct {
	// Port holds the target's port which may be empty.
	Port string

	// UseKerberos indicated that Kerberos authentication should be used to
	// authenticate to this target.
	//
	// Warning: `UseKerberos` is false when the only credential available is a
	// client certificate because in this case mTLS may also be used to
	// authenticate depending on the protocol (e.g. LDAP/HTTPS). If the protocol
	// that is used does not support using client certificates directly, you
	// should decide for Kerberos authentication if `target.UserKerberos &&
	// creds.ClientCert != nil` is `true`. In this case, Kerberos with PKINIT
	// will be used.
	UseKerberos bool
	// Protocol is a string that represents the protocol that is used when
	// communicating with this target. It is used to construct the SPN, however,
	// some protocol name corrections may be applied in this case, such as 'smb'
	// -> 'cifs'.
	Protocol string

	// Resolver can be used to set an alternative DNS resolver. If empty,
	// net.DefaultResolver is used.
	Resolver Resolver
	// contains filtered or unexported fields
}