oauth

type AuthorizationCode struct {
	AccountId     string
	ClientId      string
	RedirectUri   string
	CodeChallenge string
	Resource      string
	Scope         string
	ExpiresAt     time.Time
}

type AuthorizationRequest struct {
	Id            string
	AccountId     string
	ClientId      string
	ClientName    string
	RedirectUri   string
	State         string
	CodeChallenge string
	Resource      string
	Scope         string
	ExpiresAt     time.Time
}

type Grant struct {
	Id        string
	AccountId string
	ClientId  string
	Resource  string
	Scope     string
	// KeyThumbprint binds the grant's tokens to a key (RFC 9449), for a client that has one.
	KeyThumbprint string
	CreatedAt     time.Time
}

type GrantCheck func(grant *Grant) error

type Resource struct {
	Url string `json:"url"`
	// Name is what the consent page calls it.
	Name string `json:"name"`
	// Scopes are the scopes a token for it may carry; a request naming none is given all of them.
	Scopes []string `json:"scopes"`
}

type Store interface {
	InsertAuthorizationRequest(ctx context.Context, request *AuthorizationRequest) (string, error)
	// PopAuthorizationRequest returns the request and removes it, or ErrNotFound.
	PopAuthorizationRequest(ctx context.Context, id string) (*AuthorizationRequest, error)

	InsertAuthorizationCode(ctx context.Context, codeHash []byte, code *AuthorizationCode) error
	// PopAuthorizationCode returns what the code stands for and removes it, or ErrNotFound: a code
	// is redeemed once.
	PopAuthorizationCode(ctx context.Context, codeHash []byte) (*AuthorizationCode, error)

	// InsertGrant records a grant and its first refresh token, returning the grant's id.
	InsertGrant(ctx context.Context, grant *Grant, refreshTokenHash []byte, refreshTokenExpiresAt time.Time) (string, error)
	// RotateRefreshToken spends a refresh token and records its successor in one step, returning
	// the grant it renews. A token spent before revokes the grant and is ErrRefreshTokenReused; one
	// unknown, expired, or of a revoked grant is ErrNotFound. check is asked of the grant before the
	// token is spent, and an error from it is returned with the token left as it was: a refusal must
	// not cost the client the only token it has.
	RotateRefreshToken(
		ctx context.Context,
		refreshTokenHash []byte,
		newRefreshTokenHash []byte,
		newExpiresAt time.Time,
		now time.Time,
		check GrantCheck,
	) (*Grant, error)
	// RevokeRefreshToken revokes the grant the refresh token renews, spent or not. A token not
	// known is no error: there is nothing left to revoke.
	RevokeRefreshToken(ctx context.Context, refreshTokenHash []byte) error

	// AccountActive says whether the account exists and is not locked.
	AccountActive(ctx context.Context, accountId string) (bool, error)
}