oidc

type Claims struct {
	// Identity is the user's identity, extracted from email claim (or sub if email not present)
	Identity string

	// Email is the user's email address (if present in token)
	Email string

	// Subject is the subject claim (unique user identifier)
	Subject string

	// Issuer is the issuer claim (should match configured issuer)
	Issuer string

	// Audience is the audience claim (who the token is intended for)
	Audience []string

	// ExpiresAt is when the token expires
	ExpiresAt time.Time

	// IssuedAt is when the token was issued
	IssuedAt time.Time
}

type Config struct {
	// Issuer is the OIDC provider issuer URL (e.g., "https://accounts.google.com")
	Issuer string

	// ClientID is the expected audience claim (optional, not always required)
	ClientID string

	// SkipExpiryCheck disables token expiration validation (not recommended for production)
	SkipExpiryCheck bool

	// TLSConfig configures TLS for OIDC provider connections
	TLSConfig tlsconfig.Config
}

type Validator struct {
	// contains filtered or unexported fields
}