oidc

type Claims struct {
	// Identity is the user's identity, extracted from the email claim (or sub if email not present).
	Identity string

	// ExpiresAt is when the token expires.
	ExpiresAt time.Time
}

type Config struct {
	// Issuer is the OIDC provider issuer URL (e.g., "https://accounts.google.com").
	Issuer string

	// ClientID is the expected audience claim. Required: without it, any
	// token issued by the provider for any client would be accepted.
	ClientID string

	// TLSConfig configures TLS for OIDC provider connections.
	TLSConfig tlsconfig.Config
}

type Validator struct {
	// contains filtered or unexported fields
}