client

type Client interface {
	// BeginDeviceLogin starts the RFC 8628 device authorization flow and
	// returns the details a user needs to approve it. The opaque device code in
	// the result is exchanged for tokens by PollDeviceLogin; only the
	// verification URL and user code are meant to be shown to the user.
	BeginDeviceLogin(ctx context.Context) (*DeviceAuth, error)

	// PollDeviceLogin polls the token endpoint until the device authorization
	// is approved (returning tokens), denied, or expired (returning an error).
	PollDeviceLogin(ctx context.Context, device *DeviceAuth) (*Tokens, error)

	// Refresh refreshes an access token using a refresh token.
	Refresh(ctx context.Context, refreshToken string) (*Tokens, error)

	// ClientCredentials mints an access token using the OAuth2
	// client_credentials grant with Authentik's service-account form
	// (client_id + username + password). No refresh token is issued;
	// callers re-mint before expiry.
	ClientCredentials(ctx context.Context) (*Tokens, error)
}

type Config struct {
	// IssuerURL is the OIDC issuer URL (e.g., https://dex.example.com).
	IssuerURL string

	// ClientID is the OAuth client ID.
	ClientID string

	// Resource is the optional OAuth protected resource to request tokens for.
	// Leave empty for standard OIDC providers that do not use RFC 8707 resource parameters.
	Resource string

	// BrandingURL is the URL to fetch branding config from (optional).
	// When set, the client fetches SuccessPageConfig from this endpoint
	// before login so it can resolve branding rules client-side in OIDC mode.
	BrandingURL string

	// RedirectPort is the local port for the callback server.
	// When zero, a free loopback port is selected automatically.
	RedirectPort int

	// Scopes are the OAuth scopes to request.
	Scopes []string

	// Username is the service-account username for the client_credentials
	// grant (Authentik service-account form). Unused by interactive flows.
	Username string

	// Password is the service-account app password for the
	// client_credentials grant. Unused by interactive flows.
	Password string

	// Headless uses the device authorization flow (RFC 8628) instead of
	// the local callback server. Use for SSH or headless environments.
	Headless bool
}

type DeviceAuth struct {
	DeviceCode              string
	UserCode                string
	VerificationURI         string
	VerificationURIComplete string
	ExpiresIn               int
	Interval                int
}

type OIDCConfig struct {
	Issuer                      string   `json:"issuer"`
	AuthorizationEndpoint       string   `json:"authorization_endpoint"`
	TokenEndpoint               string   `json:"token_endpoint"`
	DeviceAuthorizationEndpoint string   `json:"device_authorization_endpoint"`
	JwksURI                     string   `json:"jwks_uri"`
	ScopesSupported             []string `json:"scopes_supported"`
}

type Tokens struct {
	AccessToken          string    `json:"access_token"`
	RefreshToken         string    `json:"refresh_token,omitempty"`
	TokenType            string    `json:"token_type"`
	ExpiresIn            int       `json:"expires_in"`
	ExpiresAt            time.Time `json:"expires_at"`
	RefreshTokenIssuedAt time.Time `json:"refresh_token_issued_at,omitempty"`
}