pam

type Authenticator interface {
	Authenticate(username, password string) error
	LookupUser(username string) (*user.User, error)
	GetUserGroups(systemUser *user.User) ([]string, error)
	Close() error
}

type AuthorizationCodeData struct {
	Code                string
	ClientID            string
	RedirectURI         string
	Scope               string
	State               string
	Username            string
	ExpiresAt           time.Time
	CreatedAt           time.Time
	CodeChallenge       string                                        // PKCE code challenge
	CodeChallengeMethod pamapi.AuthAuthorizeParamsCodeChallengeMethod // PKCE code challenge method (plain or S256)
}

type AuthorizationCodeStore struct {
	// contains filtered or unexported fields
}

type AuthorizeResponse struct {
	Type      AuthorizeResponseType
	Content   string
	SessionID string // Session ID to set as cookie (for pending sessions)
}

type AuthorizeResponseType string

type EncryptedAuthData struct {
	// Common fields for both pending auth and authenticated sessions
	ClientID            string
	RedirectURI         string
	Scope               string
	State               string
	CodeChallenge       string
	CodeChallengeMethod string
	ExpiresAt           int64 // Unix timestamp

	// Session-specific fields (only set when IsLoggedIn is true)
	Username   string
	IsLoggedIn bool
	LoginTime  int64 // Unix timestamp (only set when IsLoggedIn is true)
}

type Logger = *logrus.Logger

type LoginFormData struct {
}

type LoginResult struct {
	RedirectURL string
	SessionID   string
}

type OIDCIssuer interface {
	// Token Issuance (OAuth2/OIDC flows)
	// Returns TokenResponse on success, or OAuth2Error (implements error interface) on failure
	Token(ctx context.Context, req *pamapi.TokenRequest) (*pamapi.TokenResponse, error)

	// UserInfo (OIDC endpoint)
	// Returns UserInfoResponse on success, or OAuth2Error (implements error interface) on failure
	UserInfo(ctx context.Context, accessToken string) (*pamapi.UserInfoResponse, error)

	// Authorization Code Flow (browser-based, uses redirects/HTML for errors)
	Authorize(ctx context.Context, req *pamapi.AuthAuthorizeParams) (*AuthorizeResponse, error)

	// Login handles the login form submission (browser-based)
	// encryptedCookie contains the encrypted authorization request parameters
	Login(ctx context.Context, username, password, encryptedCookie string) (*LoginResult, error)

	// Discovery and Configuration (system errors only)
	GetOpenIDConfiguration() (*pamapi.OpenIDConfiguration, error)
	GetJWKS() (*pamapi.JWKSResponse, error)
}

type PAMOIDCProvider struct {
	// contains filtered or unexported fields
}

type PamAuthenticator struct {
	// contains filtered or unexported fields
}