oidc

type AuthenticatedTransport struct {
	TokenRefresher
	http.RoundTripper
	// contains filtered or unexported fields
}

type Client struct {
	// contains filtered or unexported fields
}

type ClientConfig struct {
	HTTPClient     phttp.Client
	Credentials    ClientCredentials
	Scope          []string
	RedirectURL    string
	ProviderConfig ProviderConfig
	KeySet         key.PublicKeySet
}

type ClientCredentials oauth2.ClientCredentials

type ClientCredsTokenRefresher struct {
	Issuer     string
	OIDCClient *Client
}

type ClientIdentity struct {
	Credentials ClientCredentials
	Metadata    ClientMetadata
}

type ClientMetadata struct {
	RedirectURIs []url.URL // Required

	// A list of OAuth 2.0 "response_type" values that the client wishes to restrict
	// itself to. Either "code", "token", or another registered extension.
	//
	// If omitted, only "code" will be used.
	ResponseTypes []string
	// A list of OAuth 2.0 grant types the client wishes to restrict itself to.
	// The grant type values used by OIDC are "authorization_code", "implicit",
	// and "refresh_token".
	//
	// If ommitted, only "authorization_code" will be used.
	GrantTypes []string
	// "native" or "web". If omitted, "web".
	ApplicationType string

	// List of email addresses.
	Contacts []mail.Address
	// Name of client to be presented to the end-user.
	ClientName string
	// URL that references a logo for the Client application.
	LogoURI *url.URL
	// URL of the home page of the Client.
	ClientURI *url.URL
	// Profile data policies and terms of use to be provided to the end user.
	PolicyURI         *url.URL
	TermsOfServiceURI *url.URL

	// URL to or the value of the client's JSON Web Key Set document.
	JWKSURI *url.URL
	JWKS    *jose.JWKSet

	// URL referencing a flie with a single JSON array of redirect URIs.
	SectorIdentifierURI *url.URL

	SubjectType string

	// Options to restrict the JWS alg and enc values used for server responses and requests.
	IDTokenResponseOptions  JWAOptions
	UserInfoResponseOptions JWAOptions
	RequestObjectOptions    JWAOptions

	// Client requested authorization method and signing options for the token endpoint.
	//
	// Defaults to "client_secret_basic"
	TokenEndpointAuthMethod     string
	TokenEndpointAuthSigningAlg string

	// DefaultMaxAge specifies the maximum amount of time in seconds before an authorized
	// user must reauthroize.
	//
	// If 0, no limitation is placed on the maximum.
	DefaultMaxAge int64
	// RequireAuthTime specifies if the auth_time claim in the ID token is required.
	RequireAuthTime bool

	// Default Authentication Context Class Reference values for authentication requests.
	DefaultACRValues []string

	// URI that a third party can use to initiate a login by the relaying party.
	//
	// See: http://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin
	InitiateLoginURI *url.URL
	// Pre-registered request_uri values that may be cached by the server.
	RequestURIs []url.URL
}

type ClientRegistrationResponse struct {
	ClientID                string // Required
	ClientSecret            string
	RegistrationAccessToken string
	RegistrationClientURI   string
	// If IsZero is true, unspecified.
	ClientIDIssuedAt time.Time
	// Time at which the client_secret will expire.
	// If IsZero is true, it will not expire.
	ClientSecretExpiresAt time.Time

	ClientMetadata
}

type Identity struct {
	ID        string
	Name      string
	Email     string
	ExpiresAt time.Time
}

type JWAOptions struct {
	// SigningAlg specifies an JWA alg for signing JWTs.
	//
	// Specifying this field implies different actions depending on the context. It may
	// require objects be serialized and signed as a JWT instead of plain JSON, or
	// require an existing JWT object use the specified alg.
	//
	// See: http://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata
	SigningAlg string
	// EncryptionAlg, if provided, specifies that the returned or sent object be stored
	// (or nested) within a JWT object and encrypted with the provided JWA alg.
	EncryptionAlg string
	// EncryptionEnc specifies the JWA enc algorithm to use with EncryptionAlg. If
	// EncryptionAlg is provided and EncryptionEnc is omitted, this field defaults
	// to A128CBC-HS256.
	//
	// If EncryptionEnc is provided EncryptionAlg must also be specified.
	EncryptionEnc string
}

type JWTVerifier struct {
	// contains filtered or unexported fields
}

type LoginFunc func(ident Identity, sessionKey string) (redirectURL string, err error)

type ProviderConfig struct {
	Issuer               *url.URL // Required
	AuthEndpoint         *url.URL // Required
	TokenEndpoint        *url.URL // Required if grant types other than "implicit" are supported
	UserInfoEndpoint     *url.URL
	KeysEndpoint         *url.URL // Required
	RegistrationEndpoint *url.URL
	EndSessionEndpoint   *url.URL
	CheckSessionIFrame   *url.URL

	// Servers MAY choose not to advertise some supported scope values even when this
	// parameter is used, although those defined in OpenID Core SHOULD be listed, if supported.
	ScopesSupported []string
	// OAuth2.0 response types supported.
	ResponseTypesSupported []string // Required
	// OAuth2.0 response modes supported.
	//
	// If omitted, defaults to DefaultResponseModesSupported.
	ResponseModesSupported []string
	// OAuth2.0 grant types supported.
	//
	// If omitted, defaults to DefaultGrantTypesSupported.
	GrantTypesSupported []string
	ACRValuesSupported  []string
	// SubjectTypesSupported specifies strategies for providing values for the sub claim.
	SubjectTypesSupported []string // Required

	// JWA signing and encryption algorith values supported for ID tokens.
	IDTokenSigningAlgValues    []string // Required
	IDTokenEncryptionAlgValues []string
	IDTokenEncryptionEncValues []string

	// JWA signing and encryption algorith values supported for user info responses.
	UserInfoSigningAlgValues    []string
	UserInfoEncryptionAlgValues []string
	UserInfoEncryptionEncValues []string

	// JWA signing and encryption algorith values supported for request objects.
	ReqObjSigningAlgValues    []string
	ReqObjEncryptionAlgValues []string
	ReqObjEncryptionEncValues []string

	TokenEndpointAuthMethodsSupported          []string
	TokenEndpointAuthSigningAlgValuesSupported []string
	DisplayValuesSupported                     []string
	ClaimTypesSupported                        []string
	ClaimsSupported                            []string
	ServiceDocs                                *url.URL
	ClaimsLocalsSupported                      []string
	UILocalsSupported                          []string
	ClaimsParameterSupported                   bool
	RequestParameterSupported                  bool
	RequestURIParamaterSupported               bool
	RequireRequestURIRegistration              bool

	Policy         *url.URL
	TermsOfService *url.URL

	// Not part of the OpenID Provider Metadata
	ExpiresAt time.Time
}

type ProviderConfigGetter interface {
	Get() (ProviderConfig, error)
}

type ProviderConfigSetter interface {
	Set(ProviderConfig) error
}

type ProviderConfigSyncer struct {
	// contains filtered or unexported fields
}

type RequestTokenExtractor func(r *http.Request) (string, error)

type TokenRefresher interface {
	// Verify checks if the provided token is currently valid or not.
	Verify(jose.JWT) error

	// Refresh attempts to authenticate and retrieve a new token.
	Refresh() (jose.JWT, error)
}