handler

type AnonymousIdentityProvider interface {
	List(ctx context.Context, userID string) ([]*identity.Anonymous, error)
}

type AnonymousUserHandler struct {
	AppID       config.AppID
	OAuthConfig *config.OAuthConfig

	Graphs              GraphService
	Authorizations      AuthorizationService
	Clock               clock.Clock
	TokenService        AnonymousUserHandlerTokenService
	UserProvider        UserProvider
	AnonymousIdentities AnonymousIdentityProvider
	PromotionCodes      PromotionCodeStore
	OAuthClientResolver OAuthClientResolver
}

type AnonymousUserHandlerTokenService interface {
	ParseRefreshToken(ctx context.Context, token string) (authz *oauth.Authorization, offlineGrant *oauth.OfflineGrant, tokenHash string, err error)
	IssueOfflineGrant(
		ctx context.Context,
		client *config.OAuthClientConfig,
		opts IssueOfflineGrantOptions,
		resp protocol.TokenResponse,
	) (offlineGrant *oauth.OfflineGrant, tokenHash string, err error)
	PrepareUserAccessGrantByRefreshToken(
		ctx context.Context,
		options PrepareUserAccessGrantByRefreshTokenOptions,
	) (*PrepareUserAccessGrantByRefreshTokenResult, error)
}

type App2AppService interface {
	ParseTokenUnverified(requestJWT string) (t *app2app.Request, err error)
	ParseToken(requestJWT string, key jwk.Key) (*app2app.Request, error)
}

type AppSessionTokenService interface {
	Handle(ctx context.Context, input oauth.AppSessionTokenInput) (httputil.Result, error)
}

type AuthenticationInfoResolver interface {
	GetAuthenticationInfoID(req *http.Request) (string, bool)
}

type AuthenticationInfoService interface {
	Get(ctx context.Context, entryID string) (*authenticationinfo.Entry, error)
	Delete(ctx context.Context, entryID string) error
}

type AuthorizationHandler struct {
	AppID                 config.AppID
	Config                *config.OAuthConfig
	AccountDeletionConfig *config.AccountDeletionConfig
	HTTPConfig            *config.HTTPConfig
	HTTPProto             httputil.HTTPProto
	HTTPOrigin            httputil.HTTPOrigin
	AppDomains            config.AppDomains

	Database AuthorizationHandlerDatabase

	UIURLBuilder                            UIURLBuilder
	UIInfoResolver                          UIInfoResolver
	AuthenticationInfoResolver              AuthenticationInfoResolver
	Authorizations                          AuthorizationService
	AppSessionTokenService                  AppSessionTokenService
	AuthenticationInfoService               AuthenticationInfoService
	Clock                                   clock.Clock
	Cookies                                 CookieManager
	OAuthSessionService                     OAuthSessionService
	CodeGrantService                        CodeGrantService
	SettingsActionGrantService              SettingsActionGrantService
	ClientResolver                          OAuthClientResolver
	PreAuthenticatedURLTokenService         AuthorizationHandlerPreAuthenticatedURLTokenService
	IDTokenIssuer                           IDTokenIssuer
	AuthorizationHandlerAccessTokenEncoding AuthorizationHandlerAccessTokenEncoding
}

type AuthorizationHandlerAccessTokenEncoding interface {
	MakeUserAccessTokenFromPreparationResult(
		ctx context.Context,
		options oauth.MakeUserAccessTokenFromPreparationOptions,
	) (*oauth.IssueAccessGrantResult, error)
}

type AuthorizationHandlerDatabase interface {
	WithTx(ctx context.Context, do func(ctx context.Context) error) (err error)
}

type AuthorizationHandlerPreAuthenticatedURLTokenService interface {
	ExchangeForAccessToken(
		ctx context.Context,
		client *config.OAuthClientConfig,
		sessionID string,
		token string,
	) (oauth.PrepareUserAccessTokenResult, error)
}

type AuthorizationParams struct {
	Client      *config.OAuthClientConfig
	RedirectURI *url.URL
}

type AuthorizationResultError struct {
	RedirectURI *url.URL

	ResponseMode string
	UseHTTP200   bool

	InternalError bool
	Response      protocol.ErrorResponse
	Cookies       []*http.Cookie
}

type AuthorizationService interface {
	GetByID(ctx context.Context, id string) (*oauth.Authorization, error)
	CheckAndGrant(
		ctx context.Context,
		clientID string,
		userID string,
		scopes []string,
	) (*oauth.Authorization, error)
	Check(
		ctx context.Context,
		clientID string,
		userID string,
		scopes []string,
	) (*oauth.Authorization, error)
}

type ChallengeProvider interface {
	Consume(ctx context.Context, token string) (*challenge.Purpose, error)
}

type ClientCredentialsAccessTokenOptions struct {
	ResourceURI        string
	Scopes             []string
	ClientConfig       *config.OAuthClientConfig
	MaskedClientSecret string
	Resource           *resourcescope.Resource
}

type CodeGrantService struct {
	AppID         config.AppID
	CodeGenerator TokenGenerator
	Clock         clock.Clock

	CodeGrants oauth.CodeGrantStore
}

type ConsentRequired struct {
	UserID string
	Scopes []string
	Client *config.OAuthClientConfig
}

type CookieManager interface {
	GetCookie(r *http.Request, def *httputil.CookieDef) (*http.Cookie, error)
	ValueCookie(def *httputil.CookieDef, value string) *http.Cookie
	ClearCookie(def *httputil.CookieDef) *http.Cookie
}

type CookiesGetter interface {
	GetCookies() []*http.Cookie
}

type CreateCodeGrantOptions struct {
	Authorization        *oauth.Authorization
	SessionType          session.Type
	SessionID            string
	AuthenticationInfo   authenticationinfo.T
	IDTokenHintSID       string
	RedirectURI          string
	AuthorizationRequest protocol.AuthorizationRequest
	DPoPJKT              string
}

type CreateSettingsActionGrantOptions struct {
	RedirectURI          string
	AuthorizationRequest protocol.AuthorizationRequest
	UserID               string
}

type EventService interface {
	DispatchEventOnCommit(ctx context.Context, payload event.Payload) error
}

type FinishAuthorizationOptions struct {
	Client               *config.OAuthClientConfig
	RedirectURI          *url.URL
	AuthorizationRequest protocol.AuthorizationRequest
	SessionType          session.Type
	SessionID            string
	AuthenticationInfo   authenticationinfo.T
	IDTokenHintSID       string
	Cookies              []*http.Cookie
	GrantAuthz           bool
}

type GraphService interface {
	NewGraph(ctx context.Context, interactionCtx *interaction.Context, intent interaction.Intent) (*interaction.Graph, error)
	DryRun(ctx context.Context, contextValue interaction.ContextValues, fn func(ctx context.Context, interactionCtx *interaction.Context) (*interaction.Graph, error)) error
	Run(ctx context.Context, contextValue interaction.ContextValues, graph *interaction.Graph) error
	Accept(ctx context.Context, interactionCtx *interaction.Context, graph *interaction.Graph, input interface{}) (*interaction.Graph, []interaction.Edge, error)
}

type HandleResult struct {
	PrepareIDTokenResult                       *oidc.PrepareIDTokenResult
	PrepareUserAccessGrantByRefreshTokenResult *PrepareUserAccessGrantByRefreshTokenResult
	Response                                   protocol.TokenResponse
}

type IDTokenIssuer interface {
	Iss() string
	PrepareIDToken(ctx context.Context, opts oidc.PrepareIDTokenOptions) (result *oidc.PrepareIDTokenResult, err error)
	MakeIDTokenFromPreparationResult(ctx context.Context, opts oidc.MakeIDTokenFromPreparationResultOptions) (idToken string, err error)
	VerifyIDToken(idToken string) (token jwt.Token, err error)
}

type IssueOfflineGrantOptions struct {
	AuthenticationInfo authenticationinfo.T
	Scopes             []string
	AuthorizationID    string
	IDPSessionID       string
	DeviceInfo         map[string]interface{}
	IdentityID         string
	SSOEnabled         bool
	App2AppDeviceKey   jwk.Key
	IssueDeviceSecret  bool
	DPoPJKT            string
}

type IssueOfflineGrantRefreshTokenOptions struct {
	Scopes          []string
	AuthorizationID string
	DPoPJKT         string
}

type IssuePreAuthenticatedURLTokenOptions struct {
	AppID           string
	ClientID        string
	OfflineGrantID  string
	AuthorizationID string
	Scopes          []string
}

type IssuePreAuthenticatedURLTokenResult struct {
	Token     string
	TokenHash string
	TokenType string
	ExpiresIn int
}

type OAuthClientResolver interface {
	ResolveClient(clientID string) *config.OAuthClientConfig
}

type OAuthSessionService interface {
	Save(ctx context.Context, entry *oauthsession.Entry) (err error)
	Get(ctx context.Context, entryID string) (*oauthsession.Entry, error)
	Delete(ctx context.Context, entryID string) error
}

type PreAuthenticatedURLTokenService interface {
	IssuePreAuthenticatedURLToken(
		ctx context.Context,
		options *IssuePreAuthenticatedURLTokenOptions,
	) (*IssuePreAuthenticatedURLTokenResult, error)
}

type PreAuthenticatedURLTokenServiceImpl struct {
	Clock clock.Clock

	PreAuthenticatedURLTokens oauth.PreAuthenticatedURLTokenStore
	AccessGrantService        oauth.PreAuthenticatedURLTokenAccessGrantService
	OfflineGrantService       oauth.PreAuthenticatedURLTokenOfflineGrantService
}

type PrepareUserAccessGrantByRefreshTokenOptions struct {
	oauth.PrepareUserAccessGrantOptions
	ShouldRotateRefreshToken bool
}

type PrepareUserAccessGrantByRefreshTokenResult struct {
	RotateRefreshTokenResult *oauth.RotateRefreshTokenResult
	PreparationResult        oauth.PrepareUserAccessTokenResult
}

type PromotionCodeStore interface {
	CreatePromotionCode(ctx context.Context, code *anonymous.PromotionCode) error
}

type ProxyRedirectHandler struct {
	OAuthConfig *config.OAuthConfig
	HTTPOrigin  httputil.HTTPOrigin
	HTTPProto   httputil.HTTPProto
	AppDomains  config.AppDomains
}

type RevokeHandler struct {
	SessionManager      SessionManager
	OfflineGrantService RevokeHandlerOfflineGrantService
	AccessGrants        RevokeHandlerAccessGrantStore
}

type RevokeHandlerAccessGrantStore interface {
	GetAccessGrant(ctx context.Context, tokenHash string) (*oauth.AccessGrant, error)
	DeleteAccessGrant(ctx context.Context, g *oauth.AccessGrant) error
}

type RevokeHandlerOfflineGrantService interface {
	GetOfflineGrant(ctx context.Context, id string) (*oauth.OfflineGrant, error)
}

type SessionManager interface {
	RevokeWithEvent(ctx context.Context, session session.SessionBase, isTermination bool, isAdminAPI bool) error
	RevokeWithoutEvent(ctx context.Context, session session.SessionBase) error
}

type SettingsActionGrantService struct {
	AppID         config.AppID
	CodeGenerator TokenGenerator
	Clock         clock.Clock

	SettingsActionGrants oauth.SettingsActionGrantStore
}

type SignupAnonymousUserResult struct {
	PrepareUserAccessGrantByRefreshTokenResult *PrepareUserAccessGrantByRefreshTokenResult
	Response                                   protocol.TokenResponse

	Cookies []*http.Cookie
}

type SimpleSessionLike struct {
	ID               string
	GrantSessionKind oauth.GrantSessionKind
}

type TokenGenerator func() string

type TokenHandler struct {
	Database TokenHandlerAppDatabase

	AppID                  config.AppID
	AppDomains             config.AppDomains
	HTTPProto              httputil.HTTPProto
	HTTPOrigin             httputil.HTTPOrigin
	OAuthFeatureConfig     *config.OAuthFeatureConfig
	IdentityFeatureConfig  *config.IdentityFeatureConfig
	OAuthClientCredentials *config.OAuthClientCredentials

	Authorizations                  AuthorizationService
	CodeGrants                      TokenHandlerCodeGrantStore
	SettingsActionGrantStore        TokenHandlerSettingsActionGrantStore
	IDPSessions                     TokenHandlerIDPSessionProvider
	OfflineGrants                   TokenHandlerOfflineGrantStore
	AppSessionTokens                TokenHandlerAppSessionTokenStore
	OfflineGrantService             TokenHandlerOfflineGrantService
	PreAuthenticatedURLTokenService PreAuthenticatedURLTokenService
	ClientResourceScopeService      TokenHandlerClientResourceScopeService
	Graphs                          GraphService
	IDTokenIssuer                   IDTokenIssuer
	Clock                           clock.Clock
	TokenService                    TokenHandlerTokenService
	AccessTokenEncoding             TokenHandlerAccessTokenEncoding
	Events                          EventService
	SessionManager                  SessionManager
	App2App                         App2AppService
	Challenges                      ChallengeProvider
	CodeGrantService                TokenHandlerCodeGrantService
	ClientResolver                  OAuthClientResolver
	UIInfoResolver                  UIInfoResolver
	RateLimiter                     TokenHandlerRateLimiter

	RemoteIP        httputil.RemoteIP
	UserAgentString httputil.UserAgentString
}

type TokenHandlerAccessTokenEncoding interface {
	MakeUserAccessTokenFromPreparationResult(
		ctx context.Context,
		options oauth.MakeUserAccessTokenFromPreparationOptions,
	) (*oauth.IssueAccessGrantResult, error)
}

type TokenHandlerAppDatabase interface {
	WithTx(ctx_original context.Context, do func(ctx context.Context) error) (err error)
}

type TokenHandlerAppSessionTokenStore interface {
	CreateAppSessionToken(ctx context.Context, t *oauth.AppSessionToken) error
}

type TokenHandlerClientResourceScopeService interface {
	GetClientResourceByURI(ctx context.Context, clientID string, uri string) (*resourcescope.Resource, error)
	GetClientResourceScopes(ctx context.Context, clientID string, resourceID string) ([]*resourcescope.Scope, error)
}

type TokenHandlerCodeGrantService interface {
	CreateCodeGrant(ctx context.Context, opts *CreateCodeGrantOptions) (code string, grant *oauth.CodeGrant, err error)
}

type TokenHandlerCodeGrantStore interface {
	GetCodeGrant(ctx context.Context, codeHash string) (*oauth.CodeGrant, error)
	DeleteCodeGrant(ctx context.Context, g *oauth.CodeGrant) error
}

type TokenHandlerIDPSessionProvider interface {
	Get(ctx context.Context, id string) (*idpsession.IDPSession, error)
}

type TokenHandlerOfflineGrantService interface {
	AccessOfflineGrant(ctx context.Context, id string, refreshTokenHash string, accessEvent *access.Event, expireAt time.Time) (*oauth.OfflineGrant, error)
	GetOfflineGrant(ctx context.Context, id string) (*oauth.OfflineGrant, error)
}

type TokenHandlerOfflineGrantStore interface {
	DeleteOfflineGrant(ctx context.Context, g *oauth.OfflineGrant) error

	UpdateOfflineGrantDeviceInfo(ctx context.Context, id string, deviceInfo map[string]interface{}, expireAt time.Time) (*oauth.OfflineGrant, error)
	UpdateOfflineGrantAuthenticatedAt(ctx context.Context, id string, authenticatedAt time.Time, expireAt time.Time) (*oauth.OfflineGrant, error)
	UpdateOfflineGrantApp2AppDeviceKey(ctx context.Context, id string, newKey string, expireAt time.Time) (*oauth.OfflineGrant, error)
	UpdateOfflineGrantDeviceSecretHash(
		ctx context.Context,
		grantID string,
		newDeviceSecretHash string,
		dpopJKT string,
		expireAt time.Time) (*oauth.OfflineGrant, error)

	ListOfflineGrants(ctx context.Context, userID string) ([]*oauth.OfflineGrant, error)
	ListClientOfflineGrants(ctx context.Context, clientID string, userID string) ([]*oauth.OfflineGrant, error)
}

type TokenHandlerRateLimiter interface {
	Allow(ctx context.Context, spec ratelimit.BucketSpec) (*ratelimit.FailedReservation, error)
}

type TokenHandlerSettingsActionGrantStore interface {
	GetSettingsActionGrant(ctx context.Context, codeHash string) (*oauth.SettingsActionGrant, error)
	DeleteSettingsActionGrant(ctx context.Context, g *oauth.SettingsActionGrant) error
}

type TokenHandlerTokenService interface {
	ParseRefreshToken(ctx context.Context, token string) (authz *oauth.Authorization, offlineGrant *oauth.OfflineGrant, tokenHash string, err error)
	PrepareUserAccessGrantByRefreshToken(
		ctx context.Context,
		options PrepareUserAccessGrantByRefreshTokenOptions,
	) (*PrepareUserAccessGrantByRefreshTokenResult, error)
	IssueOfflineGrant(
		ctx context.Context,
		client *config.OAuthClientConfig,
		opts IssueOfflineGrantOptions,
		resp protocol.TokenResponse,
	) (offlineGrant *oauth.OfflineGrant, tokenHash string, err error)
	IssueRefreshTokenForOfflineGrant(
		ctx context.Context,
		offlineGrantID string,
		client *config.OAuthClientConfig,
		opts IssueOfflineGrantRefreshTokenOptions,
		resp protocol.TokenResponse,
	) (offlineGrant *oauth.OfflineGrant, tokenHash string, err error)
	IssueDeviceSecret(ctx context.Context, resp protocol.TokenResponse) (deviceSecretHash string)
	IssueClientCredentialsAccessToken(
		ctx context.Context,
		options ClientCredentialsAccessTokenOptions,
		resp protocol.TokenResponse,
	) error
}

type TokenHandlerUserFacade interface {
	GetRaw(ctx context.Context, id string) (*user.User, error)
}

type TokenService struct {
	RemoteIP        httputil.RemoteIP
	UserAgentString httputil.UserAgentString
	AppID           config.AppID
	Config          *config.OAuthConfig
	ClientResolver  OAuthClientResolver

	Authorizations      TokenServiceAuthorizationStore
	OfflineGrants       TokenServiceOfflineGrantStore
	AccessGrants        TokenServiceAccessGrantStore
	OfflineGrantService TokenServiceOfflineGrantService
	AccessEvents        *access.EventProvider
	AccessTokenIssuer   TokenServiceAccessTokenIssuer
	GenerateToken       TokenGenerator
	Clock               clock.Clock
	Users               TokenHandlerUserFacade
	Events              EventService

	AccessGrantService TokenServiceAccessGrantService
}

type TokenServiceAccessGrantService interface {
	PrepareUserAccessGrant(
		ctx context.Context,
		options oauth.PrepareUserAccessGrantOptions,
	) (oauth.PrepareUserAccessTokenResult, error)
}

type TokenServiceAccessGrantStore interface {
	oauth.AccessGrantStore
}

type TokenServiceAccessTokenIssuer interface {
	EncodeClientAccessToken(ctx context.Context, options oauth.EncodeClientAccessTokenOptions) (string, error)
}

type TokenServiceAuthorizationStore interface {
	oauth.AuthorizationStore
}

type TokenServiceOfflineGrantService interface {
	ComputeOfflineGrantExpiry(session *oauth.OfflineGrant) (expiry time.Time, err error)
	GetOfflineGrant(ctx context.Context, id string) (*oauth.OfflineGrant, error)
	CreateNewRefreshToken(
		ctx context.Context,
		options oauth.CreateNewRefreshTokenOptions,
	) (*oauth.CreateNewRefreshTokenResult, *oauth.OfflineGrant, error)
	RotateRefreshToken(
		ctx context.Context,
		options oauth.RotateRefreshTokenOptions,
	) (*oauth.RotateRefreshTokenResult, *oauth.OfflineGrant, error)
}

type TokenServiceOfflineGrantStore interface {
	oauth.OfflineGrantStore
}

type UIInfoResolver interface {
	ResolveForAuthorizationEndpoint(ctx context.Context, client *config.OAuthClientConfig, req protocol.AuthorizationRequest) (*oidc.UIInfo, *oidc.UIInfoByProduct, error)
}

type UIURLBuilder interface {
	BuildAuthenticationURL(client *config.OAuthClientConfig, r protocol.AuthorizationRequest, e *oauthsession.Entry) (*url.URL, error)
	BuildSettingsActionURL(client *config.OAuthClientConfig, r protocol.AuthorizationRequest, e *oauthsession.Entry) (*url.URL, error)
}

type UserProvider interface {
	Get(ctx context.Context, id string, role accesscontrol.Role) (*model.User, error)
}

type WebSessionType string