oidc

type Client struct {
	ID          string
	Secret      string
	RedirectURI []string
	ACL         *[]string
}

type Config struct {
	// DiscoveryURL is the discovery URL of the OIDC provider. If set, it
	// is used to discover the values of AuthEndpoint and TokenEndpoint.
	DiscoveryURL string
	// AuthEndpoint is the authorization endpoint. It must be set only if
	// DiscoveryURL is not set.
	AuthEndpoint string
	// Scopes is the list of scopes to request. The default list is:
	// openid, email.
	Scopes []string
	// TokenEndpoint is the token endpoint. It must be set only if
	// DiscoveryURL is not set.
	TokenEndpoint string
	// UserinfoEndpoint is the userinfo endpoint. It must be set only if
	// DiscoveryURL is not set and the token endpoint doesn't return an
	// ID token.
	UserinfoEndpoint string
	// RedirectURL is the OAUTH2 redirect URL. It must be managed by the
	// proxy.
	RedirectURL string
	// ClientID is the Client ID.
	ClientID string
	// ClientSecret is the Client Secret.
	ClientSecret string
	// HostedDomain specifies that the HD param should be used.
	// https://developers.google.com/identity/openid-connect/openid-connect#hd-param
	HostedDomain string
}

type CookieManager interface {
	SetAuthTokenCookie(w http.ResponseWriter, req *http.Request, userID, email, sessionID, host string, extraClaims map[string]any) error
	SetNonce(w http.ResponseWriter, nonce string)
	Nonce(w http.ResponseWriter, req *http.Request) string
	ClearCookies(w http.ResponseWriter) error
}

type EventRecorder interface {
	Record(string)
}

type ProviderClient struct {
	// contains filtered or unexported fields
}

type ProviderServer struct {
	// contains filtered or unexported fields
}

type RewriteRule struct {
	InputClaim  string
	OutputClaim string
	Regex       string
	Value       string
}

type ServerOptions struct {
	CookieManager  *cookiemanager.CookieManager
	PathPrefix     string
	TokenLifetime  time.Duration
	ACLMatcher     func(acl []string, email string) bool
	GroupsForEmail func(string) []string
	Clients        []Client
	Scopes         []string
	RewriteRules   []RewriteRule

	EventRecorder EventRecorder
	Logger        interface {
		Errorf(string, ...any)
	}
}