oidc

type CachedDiscovery struct {
	Discovery *OIDCDiscovery
	FetchedAt time.Time
	ExpiresAt time.Time
}

type CachedJWKS struct {
	JWKS      *JWKS
	FetchedAt time.Time
	ExpiresAt time.Time
}

type Config struct {
	// Enabled determines if OIDC authentication is active
	Enabled bool `json:"enabled"`

	// Issuer is the OIDC provider URL (e.g., "https://accounts.google.com")
	Issuer string `json:"issuer"`

	// ClientID is the OAuth2 client ID
	ClientID string `json:"client_id"`

	// ClientSecret is the OAuth2 client secret (required for authorization code flow)
	ClientSecret string `json:"client_secret"`

	// RedirectURI is the callback URL (auto-detected if empty)
	RedirectURI string `json:"redirect_uri"`

	// Scopes to request from the provider (default: openid, profile, email)
	Scopes []string `json:"scopes"`

	// RoleMappings define how to map OIDC claims to GraphDB roles
	RoleMappings []RoleMapping `json:"role_mappings"`

	// DefaultRole is assigned when no role mapping matches (default: viewer)
	DefaultRole string `json:"default_role"`

	// JWKSCacheTTL is how long to cache JWKS (default: 1 hour)
	JWKSCacheTTL time.Duration `json:"jwks_cache_ttl"`

	// AllowedAudiences are additional valid audience values
	AllowedAudiences []string `json:"allowed_audiences"`
}

type DiscoveryClient struct {
	// contains filtered or unexported fields
}

type ErrorResponse struct {
	Error   string `json:"error"`
	Message string `json:"message"`
}

type IDTokenClaims struct {
	// Standard claims
	Issuer    string `json:"iss"`
	Subject   string `json:"sub"`
	Audience  any    `json:"aud"` // Can be string or []string
	ExpiresAt int64  `json:"exp"`
	IssuedAt  int64  `json:"iat"`
	NotBefore int64  `json:"nbf,omitempty"`
	AuthTime  int64  `json:"auth_time,omitempty"`
	Nonce     string `json:"nonce,omitempty"`

	// Profile claims
	Name              string `json:"name,omitempty"`
	GivenName         string `json:"given_name,omitempty"`
	FamilyName        string `json:"family_name,omitempty"`
	PreferredUsername string `json:"preferred_username,omitempty"`
	Picture           string `json:"picture,omitempty"`

	// Email claims
	Email         string `json:"email,omitempty"`
	EmailVerified bool   `json:"email_verified,omitempty"`

	// Additional claims for role mapping
	Groups []string `json:"groups,omitempty"`
	Roles  []string `json:"roles,omitempty"`

	// Raw claims map for custom claim access
	Raw map[string]any `json:"-"`
}

type JWK struct {
	Kty string `json:"kty"` // Key type (RSA, EC)
	Kid string `json:"kid"` // Key ID
	Use string `json:"use"` // Key use (sig)
	Alg string `json:"alg"` // Algorithm (RS256, RS384, RS512)

	// RSA key components
	N string `json:"n,omitempty"` // RSA modulus
	E string `json:"e,omitempty"` // RSA exponent

	// EC key components (for future support)
	Crv string `json:"crv,omitempty"` // Curve name
	X   string `json:"x,omitempty"`   // X coordinate
	Y   string `json:"y,omitempty"`   // Y coordinate
}

type JWKS struct {
	Keys []JWK `json:"keys"`
}

type JWKSClient struct {
	// contains filtered or unexported fields
}

type LoginResponse struct {
	AccessToken  string   `json:"access_token"`
	RefreshToken string   `json:"refresh_token"`
	TokenType    string   `json:"token_type"`
	ExpiresIn    int      `json:"expires_in"`
	User         UserInfo `json:"user"`
}

type OIDCDiscovery struct {
	Issuer                string   `json:"issuer"`
	AuthorizationEndpoint string   `json:"authorization_endpoint"`
	TokenEndpoint         string   `json:"token_endpoint"`
	UserinfoEndpoint      string   `json:"userinfo_endpoint"`
	JWKSUri               string   `json:"jwks_uri"`
	ScopesSupported       []string `json:"scopes_supported"`
	ClaimsSupported       []string `json:"claims_supported"`
}

type OIDCHandler struct {
	// contains filtered or unexported fields
}

type OIDCTokenValidator struct {
	// contains filtered or unexported fields
}

type RoleMapper struct {
	// contains filtered or unexported fields
}

type RoleMapping struct {
	// ClaimName is the OIDC claim to check (e.g., "groups", "roles", "cognito:groups")
	ClaimName string `json:"claim_name"`

	// ClaimValues are the values that trigger this mapping (OR logic)
	ClaimValues []string `json:"claim_value"`

	// GraphDBRole is the target GraphDB role ("admin", "editor", "viewer")
	GraphDBRole string `json:"graphdb_role"`
}

type StateEntry struct {
	CreatedAt time.Time
	Nonce     string
}

type StateStore struct {
	// contains filtered or unexported fields
}

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token"`
	Scope        string `json:"scope,omitempty"`
}

type TokenValidationRequest struct {
	IDToken string `json:"id_token"`
}

type UserInfo struct {
	ID          string `json:"id"`
	Username    string `json:"username"`
	Role        string `json:"role"`
	Email       string `json:"email,omitempty"`
	DisplayName string `json:"display_name,omitempty"`
}