oidc

type AppleLinkIntent struct {
	UserID      uuid.UUID
	SessionHash []byte
}

type AppleLinkIntents interface {
	Create(ctx context.Context, uid uuid.UUID, stateHash, sessionHash []byte, now time.Time) error
	// Consume takes the request for stateHash once; ok=false when there is none or it has expired.
	Consume(ctx context.Context, stateHash []byte, now time.Time) (AppleLinkIntent, bool, error)
}

type AppleLinks interface {
	// UsernameBySub returns the account key of the account linked to sub, or ok=false.
	UsernameBySub(ctx context.Context, sub string) (username string, ok bool, err error)
	// UserBySub returns the account linked to sub, or ok=false (the link flow compares it with the signed-in user).
	UserBySub(ctx context.Context, sub string) (uid uuid.UUID, ok bool, err error)
	// Link records that uid signs in with sub and keeps refreshToken (may be "") for revocation. A conflict is
	// ErrAppleLinkConflict.
	Link(ctx context.Context, uid uuid.UUID, sub, refreshToken string) error
}

type Config struct {
	IssueSession func(w http.ResponseWriter, r *http.Request, uid uuid.UUID) error
	EnsureUser   func(ctx context.Context, username, email, displayName string, emailVerified bool) (uuid.UUID, error)
	// UserExists reports whether an account is keyed by username. Used
	// to refuse a sign-in that would take over (or orphan) an account
	// keyed by an email the IdP did not verify. nil fails closed.
	UserExists   func(ctx context.Context, username string) (bool, error)
	UserIDFor    func(string) uuid.UUID
	PostLoginURL string
	SecureCookie bool
	Logger       *slog.Logger
	Providers    []ProviderConfig

	// CapGuard, when non-nil, gates new-account creation in the
	// OIDC callback. Wired to a flags.Store + db.UserExists check
	// in main. nil disables the cap (every sign-in proceeds).
	CapGuard func(ctx context.Context, username, email string, emailVerified bool) error

	// CapOverflowURL is the SPA path the callback redirects to
	// when CapGuard returns ErrCapExceeded. Defaults to
	// "/signup/full".
	CapOverflowURL string

	// ErrorURL is the SPA path the callback redirects to on any
	// sign-in failure. Defaults to "/login", which renders the
	// error banner inline above the provider buttons.
	ErrorURL string

	// AppleLinks finds and records Apple identities' accounts. An
	// "apple" provider refuses every sign-in without it.
	AppleLinks AppleLinks

	// AppleLinkIntents and SessionLive turn on "Link Apple to my account"
	// (BeginAppleLink and the callback's link mode). Without them, linking
	// is not available and every Apple callback is a sign-in.
	AppleLinkIntents AppleLinkIntents
	SessionLive      func(ctx context.Context, uid uuid.UUID, sessionHash []byte) (bool, error)
	// LinkObserve, when set, is told each link outcome (the metric's vocabulary).
	LinkObserve func(outcome string)
}

type ProviderConfig struct {
	// Name is the short URL slug — e.g. "google". Lowercased and
	// alphanum-only is recommended; we don't enforce it because
	// the operator owns their own URL space.
	Name string

	// Kind selects the wire protocol. "" or "oidc" is the default:
	// standard OIDC discovery + ID-token verification. "oauth2-github"
	// is GitHub's non-OIDC OAuth2 — no ID token, identity comes from
	// the REST /user + /user/emails endpoints. New kinds go behind a
	// single switch in buildProvider/handleCallback so the shared
	// PKCE, state cookie, and cap-guard plumbing keeps applying.
	Kind string

	// DisplayName is what the SPA puts on the button. "Google",
	// "Authentik", "GitHub". Falls back to Name if empty.
	DisplayName string

	// IssuerURL is the OIDC discovery root (without
	// /.well-known/openid-configuration; go-oidc appends it).
	// Examples: "https://accounts.google.com",
	// "https://auth.example.com". Ignored when Kind="oauth2-github".
	IssuerURL string

	// UsernameKey lets this provider's bare preferred_username (no
	// "@") be an account key when two or more providers are
	// configured (RIVOLT_OIDC_<NAME>_USERNAME_KEY=true). With a single
	// provider it is always allowed, as it has always been.
	UsernameKey bool

	// ClientID / ClientSecret are the OAuth2 application
	// credentials. ClientSecret may be empty for public clients
	// (PKCE-only), though most server-side flows ship one.
	ClientID     string
	ClientSecret string

	// RedirectURL is the absolute URL of /api/auth/oidc/{name}/
	// callback as the IdP will redirect the browser there. We
	// build it once at config time so a misconfigured base URL
	// fails fast.
	RedirectURL string

	// Scopes overrides the default scope set. Most IdPs are happy
	// with the default; some (Authentik) need an extra scope to
	// emit groups.
	Scopes []string

	// AppleTeamID, AppleKeyID and ApplePrivateKey (the .p8 PEM) sign
	// the client secret for Kind="apple" (see apple.go). ClientID is
	// the Services ID; ClientSecret is unused.
	AppleTeamID     string
	AppleKeyID      string
	ApplePrivateKey string
}

type ProviderListing struct {
	Name        string `json:"name"`
	DisplayName string `json:"display_name"`
	StartURL    string `json:"start_url"`
}

type Service struct {
	// contains filtered or unexported fields
}