auth

type Auth struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Store is the control-plane member store (required).
	Store MemberStore
	// SessionKey signs session cookies (>= 32 bytes required).
	SessionKey []byte
	// Providers holds the per-provider OAuth credentials + base URL.
	Providers ProviderConfig
	// DevOrgName is the seeded dev org used by dev-login (when enabled).
	DevOrgName string
	// Secure sets the Secure cookie flag; main sets it true when the base URL
	// is https.
	Secure bool
	// HTTPClient performs the token exchange and userinfo calls. main supplies
	// one with an explicit timeout.
	HTTPClient *http.Client
	// Logger is the structured logger (defaults to slog.Default()).
	Logger *slog.Logger
	// Interceptor is the composed post-auth hook the callback consults after the
	// identity is verified (nil = plain login).
	Interceptor LoginInterceptor
}

type LoginInterceptor interface {
	Handle(pa PostAuthContext, w http.ResponseWriter, r *http.Request, oidcSubject, email string) (handled bool)
}

type MemberStore interface {
	// UpsertMemberFromOIDC resolves (creating on first login) the member behind
	// an OIDC identity, returning its org id, member id, role, and whether this
	// call created the member (first login) — which triggers the key interstitial.
	UpsertMemberFromOIDC(ctx context.Context, oidcSubject, email string) (orgID, memberID, role string, isNew bool, err error)
	// DevOrgAdmin returns the seeded dev org's admin member, for dev-login.
	DevOrgAdmin(ctx context.Context, devOrgName string) (orgID, memberID string, err error)
	// IssueKey mints an ingest key for an org and returns its plaintext secret
	// once (only the hash is stored). Used to auto-issue the first key at signup.
	IssueKey(ctx context.Context, orgID, label string) (secret string, err error)
}

type PostAuthContext interface {
	// SetSession signs and writes the dashboard session cookie for a resolved
	// member, exactly as the core first-login path does.
	SetSession(w http.ResponseWriter, orgID, memberID, role string)
}

type ProviderConfig struct {
	GitHubClientID     string
	GitHubClientSecret string
	GoogleClientID     string
	GoogleClientSecret string
	BaseURL            string
}

type Session struct {
	OrgID    string
	MemberID string
	Role     string
	Exp      time.Time
}