externalauth

type AppInstallation struct {
	ID int
	// Login is the username of the installation.
	Login string
	// URL is a link to configure the app install.
	URL string
}

type Config struct {
	promoauth.InstrumentedOAuth2Config
	// Logs rate-limited validation warnings. Zero value discards output.
	Logger slog.Logger

	// ID is a unique identifier for the authenticator.
	ID string
	// Type is the type of provider.
	Type string

	ClientID     string
	ClientSecret string
	// DeviceAuth is set if the provider uses the device flow.
	DeviceAuth *DeviceAuth
	// DisplayName is the name of the provider to display to the user.
	DisplayName string
	// DisplayIcon is the path to an image that will be displayed to the user.
	DisplayIcon string

	// ExtraTokenKeys is a list of extra properties to
	// store in the database returned from the token endpoint.
	//
	// e.g. Slack returns `authed_user` in the token which is
	// a payload that contains information about the authenticated
	// user.
	ExtraTokenKeys []string

	// NoRefresh stops Coder from using the refresh token
	// to renew the access token.
	//
	// Some organizations have security policies that require
	// re-authentication for every token.
	NoRefresh bool
	// ValidateURL ensures an access token is valid before
	// returning it to the user. If omitted, tokens will
	// not be validated before being returned.
	ValidateURL string

	RevokeURL     string
	RevokeTimeout time.Duration

	// Regex is a Regexp matched against URLs for
	// a Git clone. e.g. "Username for 'https://github.com':"
	// The regex would be `github\.com`..
	Regex *regexp.Regexp
	// APIBaseURL is the base URL for provider REST API calls
	// (e.g., "https://api.github.com" for GitHub). Derived from
	// defaults when not explicitly configured.
	APIBaseURL string
	// If nil, http.DefaultClient is used. The value is read once at
	// the first successful Git() call; later assignments have no
	// effect because the provider is memoized.
	HTTPClient *http.Client
	// AppInstallURL is for GitHub App's (and hopefully others eventually)
	// to provide a link to install the app. There's installation
	// of the application, and user authentication. It's possible
	// for the user to authenticate but the application to not.
	AppInstallURL string
	// AppInstallationsURL is an API endpoint that returns a list of
	// installations for the user. This is used for GitHub Apps.
	AppInstallationsURL string
	// Deprecated: Injected MCP in AI Bridge is deprecated and will be removed in a future release.
	//
	// MCPURL is the endpoint that clients must use to communicate with the associated
	// MCP server.
	MCPURL string
	// Deprecated: Injected MCP in AI Bridge is deprecated and will be removed in a future release.
	//
	// MCPToolAllowRegex is a [regexp.Regexp] to match tools which are explicitly allowed to be
	// injected into Coder AI Bridge upstream requests.
	// In the case of conflicts, [MCPToolDenylistPattern] overrides items evaluated by this list.
	// This field can be nil if unspecified in the config.
	MCPToolAllowRegex *regexp.Regexp
	// Deprecated: Injected MCP in AI Bridge is deprecated and will be removed in a future release.
	//
	// MCPToolDenyRegex is a [regexp.Regexp] to match tools which are explicitly NOT allowed to be
	// injected into Coder AI Bridge upstream requests.
	// In the case of conflicts, items evaluated by this list override [MCPToolAllowRegex].
	// This field can be nil if unspecified in the config.
	MCPToolDenyRegex              *regexp.Regexp
	CodeChallengeMethodsSupported []promoauth.Oauth2PKCEChallengeMethod

	// RefreshRetryInitialBackoff overrides the initial wait between transient
	// refresh retry attempts. A zero value applies
	// defaultRefreshRetryInitialBackoff.
	RefreshRetryInitialBackoff time.Duration
	// RefreshRetryMaxBackoff overrides the maximum wait between transient
	// refresh retry attempts. A zero value applies
	// defaultRefreshRetryMaxBackoff.
	RefreshRetryMaxBackoff time.Duration
	// RefreshRetryTimeout overrides the total budget for retrying a transient
	// refresh failure across all attempts. A zero value applies
	// defaultRefreshRetryTimeout. A negative value disables transient-failure
	// retries entirely, so exactly one refresh attempt is made.
	RefreshRetryTimeout time.Duration

	// RefreshGroup deduplicates concurrent requests.
	RefreshGroup SingleflightGroup

	// RefreshLeaseInitialBackoff is the starting wait between polls to check
	// whether another replica has finished refreshing.
	RefreshLeaseInitialBackoff time.Duration

	// RefreshLeaseMaxBackoff is the maximum wait between polls to check whether
	// another replica has finished refreshing.
	RefreshLeaseMaxBackoff time.Duration
	// contains filtered or unexported fields
}

type DeviceAuth struct {
	// Config is provided for the http client method.
	Config   promoauth.InstrumentedOAuth2Config
	ClientID string
	TokenURL string
	Scopes   []string
	CodeURL  string
}

type ExchangeDeviceCodeResponse struct {
	AccessToken      string `json:"access_token"`
	RefreshToken     string `json:"refresh_token"`
	ExpiresIn        int    `json:"expires_in"`
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description"`
}

type InvalidTokenError string

type SingleflightGroup interface {
	DoChan(key string, fn func() (any, error)) <-chan singleflight.Result
}