auth

type APIKeyAuthenticator interface {
	Authenticator

	// GetKeyManager returns the API key manager for multi-key operations
	GetKeyManager() APIKeyManager

	// RotateKey rotates to the next available API key
	RotateKey() error

	// ReportKeySuccess reports successful API key usage
	ReportKeySuccess(key string) error

	// ReportKeyFailure reports failed API key usage
	ReportKeyFailure(key string, err error) error
}

type APIKeyAuthenticatorImpl struct {
	// contains filtered or unexported fields
}

type APIKeyConfig struct {
	// Load balancing strategy
	Strategy string `json:"strategy"`

	// Health check configuration
	Health HealthConfig `json:"health"`

	// Failover configuration
	Failover FailoverConfig `json:"failover"`

	// Rotation configuration
	Rotation RotationConfig `json:"rotation"`
}

type APIKeyManager interface {
	// GetCurrentKey returns the first available API key without advancing the round-robin counter
	GetCurrentKey() string

	// GetNextKey returns the next available API key using round-robin load balancing
	GetNextKey() (string, error)

	// ReportSuccess reports that an API call succeeded with this key
	ReportSuccess(key string)

	// ReportFailure reports that an API call failed with this key
	ReportFailure(key string, err error)

	// ExecuteWithFailover attempts an operation with automatic failover to next key on failure
	ExecuteWithFailover(ctx context.Context, operation func(context.Context, string) (string, *types.Usage, error)) (string, *types.Usage, error)

	// ExecuteWithFailoverMessage attempts an operation with automatic failover (message variant)
	ExecuteWithFailoverMessage(ctx context.Context, operation func(context.Context, string) (types.ChatMessage, *types.Usage, error)) (types.ChatMessage, *types.Usage, error)

	// GetStatus returns the current health status of all keys
	GetStatus() map[string]interface{}

	// GetKeys returns a copy of the keys slice
	GetKeys() []string

	// AddKey adds a new API key to the manager
	AddKey(key string) error

	// RemoveKey removes an API key from the manager
	RemoveKey(key string) error

	// IsHealthy returns true if at least one key is healthy
	IsHealthy() bool
}

type APIKeyManagerImpl struct {
	// contains filtered or unexported fields
}

type AuthError struct {
	Provider string `json:"provider"`
	Code     string `json:"code"`
	Message  string `json:"message"`
	Details  string `json:"details,omitempty"`
	Retry    bool   `json:"retry,omitempty"`
}

type AuthFeatureFlags struct {
	SupportsOAuth    bool `json:"supports_oauth"`
	SupportsAPIKey   bool `json:"supports_api_key"`
	SupportsMultiKey bool `json:"supports_multi_key"`
	RequiresPKCE     bool `json:"requires_pkce"`
	TokenRefresh     bool `json:"token_refresh"`
}

type AuthManager interface {
	// RegisterAuthenticator registers an authenticator for a provider
	RegisterAuthenticator(provider string, authenticator Authenticator) error

	// GetAuthenticator returns the authenticator for a provider
	GetAuthenticator(provider string) (Authenticator, error)

	// Authenticate authenticates a provider
	Authenticate(ctx context.Context, provider string, config types.AuthConfig) error

	// IsAuthenticated checks if a provider is authenticated
	IsAuthenticated(provider string) bool

	// Logout logs out a provider
	Logout(ctx context.Context, provider string) error

	// RefreshAllTokens refreshes all tokens that need it
	RefreshAllTokens(ctx context.Context) error

	// GetAuthenticatedProviders returns a list of authenticated providers
	GetAuthenticatedProviders() []string

	// GetAuthStatus returns the authentication status for all providers
	GetAuthStatus() map[string]*AuthState

	// CleanupExpired removes expired tokens and cleans up authenticators
	CleanupExpired() error

	// ForEachAuthenticated executes a function for each authenticated provider
	ForEachAuthenticated(ctx context.Context, fn func(provider string, authenticator Authenticator) error) error

	// GetTokenInfo returns token information for a specific provider
	GetTokenInfo(provider string) (*TokenInfo, error)

	// StartOAuthFlow starts OAuth flow for a provider
	StartOAuthFlow(ctx context.Context, provider string, scopes []string) (string, error)

	// HandleOAuthCallback handles OAuth callback for a provider
	HandleOAuthCallback(ctx context.Context, provider string, code, state string) error
}

type AuthManagerBuilder struct {
	// contains filtered or unexported fields
}

type AuthManagerImpl struct {
	// contains filtered or unexported fields
}

type AuthState struct {
	Provider      string           `json:"provider"`
	Authenticated bool             `json:"authenticated"`
	Method        types.AuthMethod `json:"method"`
	LastAuth      time.Time        `json:"last_auth"`
	ExpiresAt     time.Time        `json:"expires_at,omitempty"`
	CanRefresh    bool             `json:"can_refresh"`
}

type Authenticator interface {
	// Authenticate performs authentication with the given config
	Authenticate(ctx context.Context, config types.AuthConfig) error

	// IsAuthenticated checks if currently authenticated
	IsAuthenticated() bool

	// GetToken returns the current authentication token
	GetToken() (string, error)

	// RefreshToken refreshes the authentication token if needed
	RefreshToken(ctx context.Context) error

	// Logout clears authentication state
	Logout(ctx context.Context) error

	// GetAuthMethod returns the authentication method type
	GetAuthMethod() types.AuthMethod
}

type AuthenticatorFactory struct {
	// contains filtered or unexported fields
}

type BackoffConfig struct {
	// Initial backoff duration
	Initial time.Duration `json:"initial"`

	// Maximum backoff duration
	Maximum time.Duration `json:"maximum"`

	// Backoff multiplier
	Multiplier float64 `json:"multiplier"`

	// Jitter
	Jitter bool `json:"jitter"`
}

type BackupConfig struct {
	// Enable backup
	Enabled bool `json:"enabled"`

	// Backup directory
	Directory string `json:"directory"`

	// Backup interval
	Interval time.Duration `json:"interval"`

	// Max backup files to keep
	MaxFiles int `json:"max_files"`
}

type BearerTokenAuthenticatorImpl struct {
	// contains filtered or unexported fields
}

type CircuitBreakerConfig struct {
	// Enable circuit breaker
	Enabled bool `json:"enabled"`

	// Failure threshold
	FailureThreshold int `json:"failure_threshold"`

	// Recovery timeout
	RecoveryTimeout time.Duration `json:"recovery_timeout"`

	// Half-open max requests
	HalfOpenMaxRequests int `json:"half_open_max_requests"`
}

type Config struct {
	// Token storage configuration
	TokenStorage TokenStorageConfig `json:"token_storage"`

	// OAuth configuration
	OAuth OAuthConfig `json:"oauth"`

	// API key management configuration
	APIKey APIKeyConfig `json:"api_key"`

	// Security configuration
	Security SecurityConfig `json:"security"`

	// Retry configuration
	Retry RetryConfig `json:"retry"`

	// Default timeouts
	Timeouts TimeoutConfig `json:"timeouts"`
}

type DefaultLogger struct{}

type EncryptionConfig struct {
	// Enable encryption
	Enabled bool `json:"enabled"`

	// Encryption key
	Key string `json:"key"`

	// Key file path
	KeyFile string `json:"key_file"`

	// Encryption algorithm
	Algorithm string `json:"algorithm"`

	// Key derivation configuration
	KeyDerivation KeyDerivationConfig `json:"key_derivation"`
}

type FailoverConfig struct {
	// Enable failover
	Enabled bool `json:"enabled"`

	// Maximum attempts
	MaxAttempts int `json:"max_attempts"`

	// Failover strategy
	Strategy string `json:"strategy"`

	// Circuit breaker configuration
	CircuitBreaker CircuitBreakerConfig `json:"circuit_breaker"`
}

type FileStorageConfig struct {
	// Directory to store tokens
	Directory string `json:"directory"`

	// File permissions
	FilePermissions string `json:"file_permissions"`

	// Directory permissions
	DirectoryPermissions string `json:"directory_permissions"`

	// Backup configuration
	Backup BackupConfig `json:"backup"`
}

type FileTokenStorage struct {
	// contains filtered or unexported fields
}

type HTTPConfig struct {
	// Timeout
	Timeout time.Duration `json:"timeout"`

	// User agent
	UserAgent string `json:"user_agent"`

	// TLS configuration
	TLS TLSConfig `json:"tls"`

	// Proxy configuration
	Proxy ProxyConfig `json:"proxy"`
}

type HealthConfig struct {
	// Enable health tracking
	Enabled bool `json:"enabled"`

	// Failure threshold
	FailureThreshold int `json:"failure_threshold"`

	// Success threshold
	SuccessThreshold int `json:"success_threshold"`

	// Backoff configuration
	Backoff BackoffConfig `json:"backoff"`

	// Health check interval
	CheckInterval time.Duration `json:"check_interval"`
}

type KeyDerivationConfig struct {
	// Key derivation function
	Function string `json:"function"`

	// Salt
	Salt string `json:"salt"`

	// Number of iterations
	Iterations int `json:"iterations"`

	// Key length
	KeyLength int `json:"key_length"`
}

type Logger interface {
	Debug(msg string, fields ...interface{})
	Info(msg string, fields ...interface{})
	Warn(msg string, fields ...interface{})
	Error(msg string, fields ...interface{})
}

type MemoryStorageConfig struct {
	// Maximum number of tokens to store
	MaxTokens int `json:"max_tokens"`

	// Cleanup interval
	CleanupInterval time.Duration `json:"cleanup_interval"`

	// Enable persistence to file
	EnablePersistence bool `json:"enable_persistence"`

	// Persistence file path
	PersistenceFile string `json:"persistence_file"`
}

type MemoryTokenStorage struct {
	// contains filtered or unexported fields
}

type OAuthAuthenticator interface {
	Authenticator

	// StartOAuthFlow initiates the OAuth flow and returns the auth URL
	StartOAuthFlow(ctx context.Context, scopes []string) (string, error)

	// HandleCallback processes the OAuth callback
	HandleCallback(ctx context.Context, code, state string) error

	// IsOAuthEnabled checks if OAuth is properly configured
	IsOAuthEnabled() bool

	// GetTokenInfo returns detailed token information
	GetTokenInfo() (*TokenInfo, error)
}

type OAuthAuthenticatorImpl struct {
	// contains filtered or unexported fields
}

type OAuthConfig struct {
	// Default scopes
	DefaultScopes []string `json:"default_scopes"`

	// State management
	State StateConfig `json:"state"`

	// PKCE configuration
	PKCE PKCEConfig `json:"pkce"`

	// Token refresh configuration
	Refresh RefreshConfig `json:"refresh"`

	// HTTP client configuration
	HTTP HTTPConfig `json:"http"`
}

type OAuthHelper struct {
	// contains filtered or unexported fields
}

type OAuthTokenResponse struct {
	AccessToken      string `json:"access_token"`
	TokenType        string `json:"token_type"`
	ExpiresIn        int64  `json:"expires_in"`
	RefreshToken     string `json:"refresh_token,omitempty"`
	Scope            string `json:"scope,omitempty"`
	Error            string `json:"error,omitempty"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type PKCEConfig struct {
	// Enable PKCE
	Enabled bool `json:"enabled"`

	// Code challenge method
	Method string `json:"method"`

	// Code verifier length
	VerifierLength int `json:"verifier_length"`
}

type ProviderAuthConfig struct {
	Provider       string           `json:"provider"`
	AuthMethod     types.AuthMethod `json:"auth_method"`
	DisplayName    string           `json:"display_name"`
	Description    string           `json:"description"`
	OAuthURL       string           `json:"oauth_url,omitempty"`
	RequiredScopes []string         `json:"required_scopes,omitempty"`
	OptionalScopes []string         `json:"optional_scopes,omitempty"`
	Features       AuthFeatureFlags `json:"features"`
}

type ProviderAuthRegistry struct {
	// contains filtered or unexported fields
}

type ProxyAuthConfig struct {
	// Username
	Username string `json:"username"`

	// Password
	Password string `json:"password"`
}

type ProxyConfig struct {
	// Enable proxy
	Enabled bool `json:"enabled"`

	// Proxy URL
	URL string `json:"url"`

	// Proxy authentication
	Auth ProxyAuthConfig `json:"auth"`
}

type RateLimitConfig struct {
	// Enable rate limiting
	Enabled bool `json:"enabled"`

	// Requests per minute
	RequestsPerMinute int `json:"requests_per_minute"`

	// Burst size
	Burst int `json:"burst"`
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type RefreshConfig struct {
	// Enable automatic refresh
	Enabled bool `json:"enabled"`

	// Refresh buffer (refresh token before it expires)
	Buffer time.Duration `json:"buffer"`

	// Max retry attempts
	MaxRetries int `json:"max_retries"`

	// Enable refresh on failure
	RefreshOnFailure bool `json:"refresh_on_failure"`
}

type RetryConfig struct {
	// Enable retry
	Enabled bool `json:"enabled"`

	// Maximum attempts
	MaxAttempts int `json:"max_attempts"`

	// Initial delay
	InitialDelay time.Duration `json:"initial_delay"`

	// Maximum delay
	MaxDelay time.Duration `json:"max_delay"`

	// Backoff multiplier
	Multiplier float64 `json:"multiplier"`

	// Jitter
	Jitter bool `json:"jitter"`
}

type RotationConfig struct {
	// Enable rotation
	Enabled bool `json:"enabled"`

	// Rotation interval
	Interval time.Duration `json:"interval"`

	// Rotation strategy
	Strategy string `json:"strategy"`
}

type SecurityAuditor struct {
	// contains filtered or unexported fields
}

type SecurityConfig struct {
	// Enable audit logging
	AuditLogging bool `json:"audit_logging"`

	// Token masking
	TokenMasking TokenMaskingConfig `json:"token_masking"`

	// Rate limiting
	RateLimiting RateLimitConfig `json:"rate_limiting"`
}

type SecurityUtils struct {
	// contains filtered or unexported fields
}

type StateConfig struct {
	// State length
	Length int `json:"length"`

	// State expiration
	Expiration time.Duration `json:"expiration"`

	// Enable state validation
	EnableValidation bool `json:"enable_validation"`
}

type TLSConfig struct {
	// Insecure skip verify
	InsecureSkipVerify bool `json:"insecure_skip_verify"`

	// CA certificate file
	CAFile string `json:"ca_file"`

	// Certificate file
	CertFile string `json:"cert_file"`

	// Key file
	KeyFile string `json:"key_file"`
}

type TimeoutConfig struct {
	// Authentication timeout
	Auth time.Duration `json:"auth"`

	// Token refresh timeout
	TokenRefresh time.Duration `json:"token_refresh"`

	// OAuth flow timeout
	OAuthFlow time.Duration `json:"oauth_flow"`

	// Storage operation timeout
	Storage time.Duration `json:"storage"`
}

type TokenInfo struct {
	AccessToken  string    `json:"access_token"`
	RefreshToken string    `json:"refresh_token,omitempty"`
	TokenType    string    `json:"token_type"`
	ExpiresAt    time.Time `json:"expires_at"`
	Scopes       []string  `json:"scopes"`
	IsExpired    bool      `json:"is_expired"`
	ExpiresIn    int64     `json:"expires_in"`
}

type TokenMaskingConfig struct {
	// Enable masking
	Enabled bool `json:"enabled"`

	// Prefix length to show
	PrefixLength int `json:"prefix_length"`

	// Suffix length to show
	SuffixLength int `json:"suffix_length"`

	// Mask character
	MaskChar string `json:"mask_char"`
}

type TokenMetadata struct {
	Provider     string    `json:"provider"`
	CreatedAt    time.Time `json:"created_at"`
	LastAccessed time.Time `json:"last_accessed"`
	ExpiresAt    time.Time `json:"expires_at"`
	IsEncrypted  bool      `json:"is_encrypted"`
}

type TokenStorage interface {
	types.TokenStorage

	// IsTokenValid checks if a token exists and is not expired
	IsTokenValid(key string) bool

	// CleanupExpired removes all expired tokens
	CleanupExpired() error

	// GetTokenInfo returns metadata about a stored token
	GetTokenInfo(key string) (*TokenMetadata, error)
}

type TokenStorageConfig struct {
	// Storage backend type (file, memory, custom)
	Type string `json:"type"`

	// File storage configuration
	File FileStorageConfig `json:"file"`

	// Memory storage configuration
	Memory MemoryStorageConfig `json:"memory"`

	// Encryption configuration
	Encryption EncryptionConfig `json:"encryption"`
}