oidc

type Claims struct {
	// Issuer is the configured issuer against which the token was verified.
	Issuer string
	// Subject is the stable, case-sensitive identifier within this issuer.
	Subject string
	// UserID is the verified claim value used to look up the directory user.
	UserID string

	// ExpiresAt is when the token expires.
	ExpiresAt time.Time
}

type IdentityMode string

type LoginConfig struct {
	IssuerURL    string
	ClientID     string
	ClientSecret string // Optional for PKCE.
	TLSConfig    tlsconfig.Config
	LoginMethod  LoginMethod
}

type LoginMethod uint8

type Validator struct {
	// contains filtered or unexported fields
}

type ValidatorConfig struct {
	// Issuer is the OIDC provider issuer URL (e.g., "https://accounts.google.com").
	Issuer string

	// ClientID is the expected audience claim. Required: without it, any
	// token issued by the provider for any client would be accepted.
	ClientID string

	// IdentityMode selects how verified claims resolve to a directory ID.
	IdentityMode IdentityMode

	// UserIDClaim selects a top-level string claim to map to directory ID.
	// Empty selects the provider default (oid for Entra, sub otherwise).
	UserIDClaim string

	// TLSConfig configures TLS for OIDC provider connections.
	TLSConfig tlsconfig.Config
}

type Verifier struct {
	// contains filtered or unexported fields
}

type VerifierConfig struct {
	IssuerURL string
	ClientID  string
	TLSConfig tlsconfig.Config
}