oauth

type AppleConfig struct {
	ClientID   string
	TeamID     string
	KeyID      string
	PrivateKey string

	TokenURL string
	JWKSURL  string
	Issuer   string

	HTTPClient   *http.Client
	JWKSCacheTTL time.Duration
	Now          func() time.Time
}

type Authorizer interface {
	AuthorizationURL(ctx context.Context, redirectURI, state, codeChallenge string) (string, error)
}

type ExchangeParams struct {
	Code             string
	RedirectURI      string
	CodeVerifier     string // Optional PKCE code_verifier
	AppleUserPayload string // Optional form-post payload for Apple first-time login
}

type Exchanger interface {
	Exchange(ctx context.Context, params ExchangeParams) (*Identity, error)
}

type GenericOIDCConfig struct {
	// ProviderKey is the registry key (e.g. "okta") this exchanger is
	// registered under and reported in Identity.Provider.
	ProviderKey string

	IssuerURL    string
	ClientID     string
	ClientSecret string

	// Scopes overrides the requested OAuth scopes. Optional; defaults
	// to "openid email profile". "openid" is always ensured.
	Scopes []string

	// DiscoveryURL overrides the well-known discovery endpoint. Optional;
	// derived from IssuerURL when empty.
	DiscoveryURL string

	HTTPClient *http.Client
	// DiscoveryCacheTTL bounds how long a fetched discovery document is
	// reused before re-fetching. Optional; defaults to one hour.
	DiscoveryCacheTTL time.Duration
	JWKSCacheTTL      time.Duration
	Now               func() time.Time
}

type GitHubConfig struct {
	ClientID     string
	ClientSecret string

	HTTPClient *http.Client

	AuthorizationURL string
	TokenURL         string
	UserURL          string
	UserMailURL      string
}

type GoogleConfig struct {
	ClientID     string
	ClientSecret string

	// HTTPClient overrides the http.Client used for token + JWKS
	// requests. Optional; defaults to a 10s-timeout client.
	HTTPClient *http.Client

	// TokenURL overrides the token endpoint. Optional; defaults to
	// googleTokenURL.
	TokenURL string

	// AuthorizationURL overrides the provider authorization endpoint.
	// Optional; defaults to googleAuthorizationURL or the discovery
	// document's authorization_endpoint when DiscoveryURL is set.
	AuthorizationURL string

	// JWKSURL overrides the JWKS endpoint. Optional; defaults to
	// googleJWKSURL.
	JWKSURL string

	// DiscoveryURL overrides the OIDC discovery endpoint. When set,
	// Exchange resolves token / JWKS / userinfo endpoints from it.
	DiscoveryURL string

	// UserinfoURL overrides the OIDC userinfo endpoint. Optional.
	UserinfoURL string

	// Issuer overrides the expected `iss` claim. Optional; defaults
	// to googleIssuer.
	Issuer string

	// JWKSCacheTTL overrides the JWKS cache TTL. Optional; defaults
	// to 1h.
	JWKSCacheTTL time.Duration

	// Now overrides the clock used for ID token expiry validation.
	// Optional; defaults to time.Now.
	Now func() time.Time
}

type HostedStateClaims struct {
	Provider     string
	RedirectURI  string
	ReturnTo     string
	State        string
	CodeVerifier string
	CSRFToken    string
	IssuedAt     int64
	ExpiresAt    int64
}

type Identity struct {
	// ProviderUserID is the stable per-provider user identifier.
	// For OIDC providers this is the "sub" claim. For GitHub this is
	// the numeric user id (rendered as a string).
	ProviderUserID string

	// Email is the user's primary email address. Always lowercased.
	Email string

	// EmailVerified is true if the provider asserts the email is
	// verified. Implementations MUST refuse to return an Identity if
	// the provider says the email is not verified.
	EmailVerified bool

	// Name is the user's display name. May be empty.
	Name string

	// AvatarURL is a URL to the user's profile picture. May be empty.
	AvatarURL string

	// Provider is the provider key — "google", "microsoft", "github", "apple".
	Provider string
}

type MicrosoftConfig struct {
	ClientID     string
	ClientSecret string

	HTTPClient *http.Client

	// AuthorizationURL overrides the authorization endpoint. Optional.
	AuthorizationURL string

	// TokenURL overrides the token endpoint. Optional.
	TokenURL string

	// JWKSURL overrides the JWKS endpoint. Optional.
	JWKSURL string

	// TenantID controls the default tenant segment in the authorization
	// endpoint when AuthorizationURL is not set. Optional; defaults to
	// "common".
	TenantID string

	// IssuerFormat is a fmt.Sprintf format string into which the
	// token's `tid` (tenant id) claim is interpolated to derive the
	// expected issuer. Optional; defaults to the Microsoft format.
	// In tests, set this to e.g. "%s" plus a fixed test issuer.
	IssuerFormat string

	JWKSCacheTTL time.Duration
	Now          func() time.Time
}

type NativeVerification struct {
	Identity    *Identity
	ReplayKey   string
	ExpiresAtMs int64
}

type NativeVerifier struct {
	// contains filtered or unexported fields
}

type NativeVerifierConfig struct {
	// GoogleAudiences is the GLOBAL fallback set of accepted `aud` values for
	// Google ID tokens — the web client id PLUS every per-platform
	// (iOS/Android) OAuth client id the native SDKs present. It is consulted
	// only for a product with no entry in GoogleAudiencesByProduct. Empty
	// disables Google native login for those products.
	GoogleAudiences []string
	// AppleAudiences is the GLOBAL fallback set of accepted `aud` values for
	// Apple ID tokens — the Services ID PLUS every native bundle id. It is
	// consulted only for a product with no entry in AppleAudiencesByProduct.
	// Empty disables Apple native login for those products.
	AppleAudiences []string

	// GoogleAudiencesByProduct scopes the accepted Google `aud` values PER
	// PRODUCT, keyed by the lower-cased product selector. When a product has an
	// entry here, ONLY that entry's audiences are accepted for it — a token
	// whose `aud` is valid for another product (or only globally) is rejected.
	// A product with no entry falls back to GoogleAudiences.
	GoogleAudiencesByProduct map[string][]string
	// AppleAudiencesByProduct scopes the accepted Apple `aud` values PER
	// PRODUCT, keyed by the lower-cased product selector. Same semantics as
	// GoogleAudiencesByProduct: an entry is exclusive for its product, an
	// absent product falls back to AppleAudiences.
	AppleAudiencesByProduct map[string][]string

	// GoogleJWKSURL / AppleJWKSURL override the default provider JWKS
	// endpoints (used by tests to point at a stub). Empty uses the live URL.
	GoogleJWKSURL string
	AppleJWKSURL  string

	// GoogleIssuer / AppleIssuer override the accepted issuer(s) (tests only).
	// Empty uses the live issuer(s).
	GoogleIssuer string
	AppleIssuer  string

	HTTPClient   *http.Client
	JWKSCacheTTL time.Duration
	Now          func() time.Time
}

type Registry struct {
	// contains filtered or unexported fields
}

type StateClaims struct {
	Provider     string
	RedirectURI  string
	State        string
	CodeVerifier string
	IssuedAt     int64
	ExpiresAt    int64
}