as

type AS struct {
	// contains filtered or unexported fields
}

type ASMetadata struct {
	// Issuer is the public base URL.
	Issuer string `json:"issuer"`
	// AuthorizationEndpoint is the absolute URL of /authorize.
	AuthorizationEndpoint string `json:"authorization_endpoint"`
	// TokenEndpoint is the absolute URL of /token.
	TokenEndpoint string `json:"token_endpoint"`
	// RegistrationEndpoint is the absolute URL of /register.
	RegistrationEndpoint string `json:"registration_endpoint"`
	// RevocationEndpoint is the absolute URL of /revoke.
	RevocationEndpoint string `json:"revocation_endpoint"`
	// UserinfoEndpoint is the absolute URL of /userinfo.
	UserinfoEndpoint string `json:"userinfo_endpoint,omitempty"`
	// JWKSURI is the absolute URL of /.well-known/jwks.json.
	JWKSURI string `json:"jwks_uri"`
	// ScopesSupported lists scopes the server understands.
	ScopesSupported []string `json:"scopes_supported"`
	// ResponseTypesSupported lists response_type values accepted at /authorize.
	ResponseTypesSupported []string `json:"response_types_supported"`
	// GrantTypesSupported lists grant_type values accepted at /token.
	GrantTypesSupported []string `json:"grant_types_supported"`
	// CodeChallengeMethodsSupported lists PKCE methods accepted at /authorize.
	CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported"`
	// TokenEndpointAuthMethodsSupported lists client auth methods at /token.
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported"`
	// IDTokenSigningAlgValuesSupported lists ID token signing algorithms.
	IDTokenSigningAlgValuesSupported []string `json:"id_token_signing_alg_values_supported,omitempty"`
	// SubjectTypesSupported lists OIDC subject types.
	SubjectTypesSupported []string `json:"subject_types_supported,omitempty"`
	// AuthorizationResponseIssParameterSupported advertises that the
	// authorization response carries the RFC 9207 `iss` parameter, so
	// clients can detect AS mix-up / code injection.
	AuthorizationResponseIssParameterSupported bool `json:"authorization_response_iss_parameter_supported"`
}

type Config struct {
	// Issuer is the public base URL, e.g. https://hilo.eliminyro.me.
	// All emitted JWTs use this as `iss`. Must not have a trailing slash.
	Issuer string

	// PathPrefix is the mount path under Issuer where the AS lives,
	// e.g. "/oauth". Must start with "/" and have no trailing slash.
	PathPrefix string

	// Upstream is the upstream OIDC provider used to authenticate users.
	Upstream *idp.OIDCProvider

	// UserResolver maps upstream OIDC claims to an internal user ID.
	UserResolver idp.UserResolver

	// Storage provides the four sub-stores.
	Storage storage.Storage

	// KeyManager owns the active signing key.
	KeyManager *jwt.Manager

	// AccessTokenTTL defaults to 1h.
	AccessTokenTTL time.Duration

	// RefreshTokenTTL defaults to 30d.
	RefreshTokenTTL time.Duration

	// AuthCodeTTL defaults to 10m.
	AuthCodeTTL time.Duration

	// ClientTTL defaults to 90d sliding (DeleteExpired honors LastUsedAt).
	ClientTTL time.Duration

	// StateCookieTTL defaults to 10m.
	StateCookieTTL time.Duration

	// AdditionalClaims is called when minting an access token. It returns
	// app-specific claims to merge into the JWT (e.g. tenant_id for Memory).
	// May be nil.
	//
	// Prefer AdditionalClaimsCtx for new code so request-scoped timeouts
	// and tracing propagate into the hook's I/O. When both are set, the
	// ctx-aware variant wins.
	AdditionalClaims func(userID, clientID, resource string) map[string]any

	// AdditionalClaimsCtx is the request-context-aware variant of
	// AdditionalClaims. When set, it takes precedence over AdditionalClaims
	// and receives the /token request's context, so any DB or RPC call
	// inside the hook is bound by request-scoped deadlines and cancellation.
	AdditionalClaimsCtx func(ctx context.Context, userID, clientID, resource string) map[string]any

	// IDTokenClaims is called when the AS needs to mint an ID token (i.e.
	// when the original auth request scope contained "openid"). It returns
	// the standard OIDC ID token claims for the given user. If nil, the ID
	// token is minted with only sub + iss + aud + iat + exp.
	//
	// Prefer IDTokenClaimsCtx for new code so request-scoped timeouts and
	// tracing propagate into the hook's I/O. When both are set, the
	// ctx-aware variant wins.
	IDTokenClaims func(userID string) (email string, emailVerified bool, name, picture string)

	// IDTokenClaimsCtx is the request-context-aware variant of IDTokenClaims.
	// When set, it takes precedence over IDTokenClaims and receives the
	// /token request's context.
	IDTokenClaimsCtx func(ctx context.Context, userID string) (email string, emailVerified bool, name, picture string)

	// Logger receives diagnostic logs for every 500-class error path
	// (signer-unavailable, sign-failed, storage failures, etc.) and
	// security events (refresh-token reuse, claim-hook panics). When nil,
	// defaults() sets it to slog.Default().
	Logger *slog.Logger
}