oauthprovider

type ClaimMapping struct {
	// Scope grants the claim. An empty value grants it with the profile scope.
	Scope string
	// Claim is the claim name at the userinfo route.
	Claim string
	// Field is the name of the host-declared user field.
	Field string
}

type ClaimsFunc func(user *store.User, scopes []string) map[string]any

type Option func(*Plugin)

type Plugin struct {
	// contains filtered or unexported fields
}

type Resource struct {
	// Identifier is the absolute URI of the resource. It carries no fragment.
	Identifier string
	// Scopes bounds the scopes an access token for this resource may carry. An
	// empty value allows the configured scopes of the server.
	Scopes []string
	// AccessTokenTTL overrides the server lifetime for this resource.
	AccessTokenTTL time.Duration
}

type StaticClient struct {
	// ClientID identifies the client.
	ClientID string
	// Secret authenticates a confidential client. An empty value declares a
	// public client, which must use PKCE and holds no secret.
	Secret string
	// AuthMethod names how the client authenticates at the token endpoint. The
	// default of a confidential client is client_secret_basic. The server
	// enforces the named method, so a leaked secret cannot arrive another way.
	AuthMethod string
	// Name appears on the consent page of another client of the same user.
	Name string
	// RedirectURIs holds the exact registered values.
	RedirectURIs []string
	// Scopes bounds what the client may request. An empty value allows the
	// configured scopes of the server.
	Scopes []string
	// GrantTypes bounds the grants. The default is authorization_code and
	// refresh_token.
	GrantTypes []string
	// DPoPRequired refuses a bearer presentation of a token of this client.
	DPoPRequired bool
}