oidc

type AccessToken struct {
	Subject  string
	ClientID string
	Scopes   []string
	Expires  time.Time
	ID       string
}

type AuthCode struct {
	ClientID      string    `json:"clientId"`
	RedirectURI   string    `json:"redirectUri"`
	Subject       string    `json:"subject"`
	Scopes        []string  `json:"scopes"`
	Nonce         string    `json:"nonce,omitempty"`
	CodeChallenge string    `json:"codeChallenge,omitempty"`
	AuthTime      time.Time `json:"authTime"`
	Expires       time.Time `json:"expires"`
}

type Client struct {
	ID string
	// Secret authenticates confidential clients (server-side apps). Leave
	// it empty and set Public for apps that can't keep a secret, such as
	// single-page and mobile apps; they must use PKCE.
	Secret string
	Public bool
	// Name is shown on the consent screen.
	Name string
	// RedirectURIs are the exact URLs codes may be sent to.
	RedirectURIs []string
	// Trusted clients, such as your own apps, skip the consent screen.
	Trusted bool
	// GrantTypes the client may use; the default is authorization_code and
	// refresh_token. Add client_credentials for service accounts.
	GrantTypes []string
	// Scopes the client may request; the default is every supported scope.
	Scopes []string
}

type Consent struct {
	// Client is the app asking, such as "Team wiki".
	Client string `json:"client"`
	// Scopes describe what it may do, such as "See your email address".
	Scopes []string `json:"scopes"`
	// Action is where the form posts, with the Params as hidden inputs and
	// a "decision" of "allow" or "deny" from the buttons.
	Action string            `json:"action"`
	Params map[string]string `json:"params"`
}

type MemoryStore struct {
	// contains filtered or unexported fields
}

type Options struct {
	// Issuer is the provider's public URL, such as
	// "https://auth.example.com", without a trailing slash. Tokens carry
	// it, and clients check it.
	Issuer  string
	Clients []Client
	// Authenticate returns the signed-in user's subject (a stable ID), or
	// "" when nobody is signed in.
	Authenticate func(ctx *kit.Ctx) (string, error)
	// LoginURL is where signed-out users go, with ?next=<the authorize
	// URL> to come back to.
	LoginURL string
	// ConsentURL is a page of the app that asks users to approve a client,
	// such as one with Tern UI's ConsentScreen, instead of the plugin's
	// own page. It gets the authorization request as its query; its load
	// calls ConsentRequest for what to show.
	ConsentURL string
	// Claims returns the user's claims for ID tokens and userinfo, such as
	// email, email_verified, name and picture. scopes lets you leave out
	// what wasn't asked for. It may be nil.
	Claims func(ctx context.Context, subject string, scopes []string) (map[string]any, error)
	// Store keeps codes, refresh tokens, consents and the signing key. The
	// default is a MemoryStore, which forgets everything on restart.
	Store Store
	// Scopes the provider supports besides openid, profile, email and
	// offline_access, such as "api:read".
	Scopes []string
	// Path is where the endpoints are; the default is "/oauth".
	Path string
	// Lifetimes; the defaults are an hour for access and ID tokens, 30
	// days for refresh tokens and a minute for codes.
	AccessTokenTTL, IDTokenTTL, RefreshTokenTTL, CodeTTL time.Duration
	// SigningKey is an RSA key in PEM. Without it, a key is created and
	// kept in the Store.
	SigningKey []byte
}

type Plugin struct {
	// contains filtered or unexported fields
}

type RefreshToken struct {
	ClientID string    `json:"clientId"`
	Subject  string    `json:"subject"`
	Scopes   []string  `json:"scopes"`
	Family   string    `json:"family"`
	AuthTime time.Time `json:"authTime"`
	Expires  time.Time `json:"expires"`
	Used     bool      `json:"used"`
}

type SQLStore struct {
	// contains filtered or unexported fields
}

type Store interface {
	SaveCode(ctx context.Context, hash string, c AuthCode) error
	// TakeCode returns and deletes a code, so it can only be used once.
	TakeCode(ctx context.Context, hash string) (AuthCode, error)
	SaveRefresh(ctx context.Context, hash string, t RefreshToken) error
	GetRefresh(ctx context.Context, hash string) (RefreshToken, error)
	// UseRefresh marks a token used and reports whether it was unused.
	UseRefresh(ctx context.Context, hash string) (bool, error)
	RevokeRefresh(ctx context.Context, hash string) error
	RevokeFamily(ctx context.Context, family string) error
	// RevokeAccess records a revoked access token until it expires.
	RevokeAccess(ctx context.Context, jti string, expires time.Time) error
	AccessRevoked(ctx context.Context, jti string) (bool, error)
	SaveConsent(ctx context.Context, subject, clientID string, scopes []string) error
	Consent(ctx context.Context, subject, clientID string) ([]string, error)
	// SigningKey returns the stored signing key (PEM), or ErrNotFound.
	SigningKey(ctx context.Context) ([]byte, error)
	SaveSigningKey(ctx context.Context, pem []byte) error
}