sts

type Client struct {
	// Transport supplies the http.RoundTripper used for all calls.
	// nil → http.DefaultTransport. The library builds its own
	// *http.Client around this transport so callers can't trivially
	// pass a *http.Client with TLS verification disabled. See the
	// deviceflow.Client.Transport doc for the security rationale.
	Transport http.RoundTripper

	BaseURL   string
	Path      string
	UserAgent string

	// RequestTimeout is the per-Exchange deadline applied via
	// context.WithTimeout on top of the caller's context. Zero falls
	// back to DefaultRequestTimeout. Negative disables the cap (useful
	// for tests that want to drive timing via the caller's ctx alone).
	RequestTimeout time.Duration

	// AllowInsecureHTTP permits http:// BaseURLs. Default (false) is
	// reject — token exchanges carry the subject token (a bearer) on
	// the wire and must be TLS-protected end to end. Production callers
	// MUST leave this false; only tests and local development that pin
	// the issuer to loopback should flip it.
	AllowInsecureHTTP bool
	// contains filtered or unexported fields
}

type ExchangeRequest struct {
	SubjectToken       string
	SubjectTokenType   string
	RequestedTokenType string

	Audience string
	Resource string
	Scope    string

	// ClientID, when non-empty, is sent as the username component of an
	// HTTP Basic Authorization header (RFC 6749 §2.3.1). ClientSecret
	// is the password component; leave empty for public clients
	// (Exchange will emit Basic base64("id:"), which §2.3.1 permits).
	//
	// Why both surfaces. Some authorization servers accept client
	// credentials for the token-exchange grant only via Basic Auth and
	// ignore form-body client_id — zitadel-based servers as of
	// 2026-05 are a known example (pkg/op/token_exchange.go reads only
	// from r.BasicAuth()). Callers are also free to set
	// Extra["client_id"] for servers that read from the form body;
	// both surfaces can be populated simultaneously and validate()
	// rejects a divergence between them.
	//
	// Wire encoding. Both values are url.QueryEscape'd before being
	// placed in the header — RFC 6749 §2.3.1 mandates that client
	// credentials are form-urlencoded before going into Basic Auth, so
	// spec-compliant servers decode via QueryUnescape on the way in.
	// Without the escape, credentials containing reserved characters
	// (':', '@', '%', non-ASCII) would not round-trip correctly even
	// against compliant servers. validate() further rejects ClientID
	// values that ':' or non-VSCHAR bytes can't reach via this path
	// (RFC 7617 §2 + RFC 6749 §2.3.1).
	ClientID     string
	ClientSecret string

	Extra url.Values
}

type TestingTB interface {
	Helper()
	Cleanup(func())
}