store

type Config struct {
	// Path is the path to the credentials file.
	// Defaults to a namespaced file in ~/.config/panda/credentials/
	Path string

	// IssuerURL namespaces stored credentials by auth issuer.
	IssuerURL string

	// ClientID namespaces stored credentials by OAuth client.
	ClientID string

	// Resource namespaces stored credentials by requested resource.
	Resource string

	// RefreshBuffer is how long before expiry to refresh the token.
	RefreshBuffer time.Duration

	// RefreshTokenTTL is the expected lifetime of the refresh token.
	// When set, the store will trigger a refresh at 50% of this duration
	// to keep the refresh token alive via provider rotation.
	RefreshTokenTTL time.Duration

	// WriteLockWait bounds how long Save/Clear wait for the credentials file
	// lock before returning ErrCredentialBusy. Defaults to credentialLockWait.
	WriteLockWait time.Duration

	// AuthClient is the OAuth client for refreshing tokens.
	AuthClient client.Client
}

type Store interface {
	// Path returns the resolved credentials file path.
	Path() string

	// Save saves tokens to the store.
	Save(tokens *client.Tokens) error

	// Load loads tokens from the store.
	Load() (*client.Tokens, error)

	// Clear removes stored tokens.
	Clear() error

	// GetAccessToken returns a valid access token, refreshing if needed.
	GetAccessToken() (string, error)

	// Invalidate forces the next GetAccessToken to refresh the access token,
	// even if it has not yet hit the local expiry buffer. Used when the proxy
	// rejects a token that should still be valid locally (e.g. revocation).
	Invalidate()

	// IsAuthenticated returns true if valid tokens are stored.
	IsAuthenticated() bool
}