auth

type AccessTokenClaims struct {
	// Sub is the principal id, e.g. "prn_0HZXEQ5Y8JY5Z".
	Sub string `json:"sub"`
	// Iss is the issuer URL.
	Iss string `json:"iss"`
	// Aud is the audience. Accepts string or []string on the wire.
	Aud Audience `json:"aud"`
	// Exp is the expiration time (Unix seconds).
	Exp int64 `json:"exp"`
	// Iat is the issued-at time (Unix seconds).
	Iat int64 `json:"iat"`
	// Nbf is the not-before time (Unix seconds).
	Nbf int64 `json:"nbf"`
	// Jti is the JWT id.
	Jti string `json:"jti"`
	// PrincipalType is "USER" or "SERVICE". The wire field name is
	// "type".
	PrincipalType string `json:"type"`
	// Scope is "ANCHOR", "PARTNER", or "CLIENT".
	Scope string `json:"scope"`
	// Email is present for USER principals, absent for SERVICE.
	Email string `json:"email,omitempty"`
	// Name is the display name.
	Name string `json:"name"`
	// Clients are the client ids this principal can access. ["*"] for
	// anchor users.
	Clients []string `json:"clients"`
	// Roles are the role codes assigned to this principal.
	Roles []string `json:"roles,omitempty"`
	// Applications are the application codes derived from roles, e.g.
	// "operant" from "operant:admin". Always present on tokens issued
	// by FC but absent on older tokens.
	Applications []string `json:"applications,omitempty"`
	// TokenUse is the token class: "api" for a credential an application
	// backend may accept, absent on older tokens. [TokenValidator.Validate]
	// refuses every other value ("identity", "field", ...).
	TokenUse string `json:"token_use,omitempty"`
}

type Audience string

type AuthContext struct {
	Claims AccessTokenClaims
	Token  string
}

type AuthorizeParams struct {
	PKCE  PkceChallenge
	State string
	Nonce string
}

type ClientCredentialsConfig struct {
	// IssuerURL is the FlowCatalyst OIDC server.
	IssuerURL string
	// ClientID is the service-account / confidential client id.
	ClientID string
	// ClientSecret is the matching secret.
	ClientSecret string
	// Scopes requested. May be empty.
	Scopes []string
	// Audience requested. May be empty.
	Audience string
	// SafetyWindow is how long before expiry to refresh proactively.
	// Defaults to 60s.
	SafetyWindow time.Duration
	// HTTPClient overrides the default transport. Optional.
	HTTPClient *http.Client
}

type ClientCredentialsProvider struct {
	// contains filtered or unexported fields
}

type Error struct {
	Kind    ErrorKind
	Message string
}

type ErrorKind int

type FieldError struct {
	Reason string
	Detail string
}

type FieldPrincipal struct {
	WorkerID         string
	ClientID         string
	ClientIdentifier string
	WorkerCode       string
	Name             string
	AppCode          string
	DeviceID         string
	DeviceMode       string
	// SessionID is the login family (sid).
	SessionID string
	AMR       []string
	AuthTime  time.Time
	ExpiresAt time.Time
	// JKT is the thumbprint of the device key the request was proven with.
	JKT     string
	TokenID string
}

type FieldTokenVerifier struct {
	// contains filtered or unexported fields
}

type FieldTokenVerifierConfig struct {
	// Issuer is the FlowCatalyst base URL and the tokens' iss claim.
	Issuer string
	// AppCode is this application's code; tokens must be addressed to it (aud).
	AppCode string
	// JWKSURL skips OIDC discovery and fetches keys from this URL.
	JWKSURL string
	// HTTPClient is the transport for discovery and JWKS (default 15 s timeout).
	HTTPClient *http.Client
	// JWKSRefreshInterval defaults to 1 hour.
	JWKSRefreshInterval time.Duration
	// ClockSkew bounds exp/nbf checks (default 60 s).
	ClockSkew time.Duration
	// ProofMaxAge is how far a proof's iat may be from now, either way
	// (default 5 minutes). Widen it for devices with bad clocks.
	ProofMaxAge time.Duration
	// BaseURL is this service's public base URL, used by [FieldMiddleware] to
	// rebuild the request URL behind a proxy (BaseURL + request path).
	BaseURL string
	// Now overrides the clock (tests, fixtures).
	Now func() time.Time
}

type HmacTokenValidator struct {
	// contains filtered or unexported fields
}

type IntrospectionResponse struct {
	Active    bool   `json:"active"`
	Scope     string `json:"scope,omitempty"`
	ClientID  string `json:"client_id,omitempty"`
	Username  string `json:"username,omitempty"`
	TokenType string `json:"token_type,omitempty"`
	Exp       int64  `json:"exp,omitempty"`
	Iat       int64  `json:"iat,omitempty"`
	Sub       string `json:"sub,omitempty"`
}

type JwksCache struct {
	// contains filtered or unexported fields
}

type OAuthClient struct {
	// contains filtered or unexported fields
}

type OAuthConfig struct {
	// IssuerURL is the FlowCatalyst OIDC server base URL.
	IssuerURL string
	// ClientID is the registered OAuth client id.
	ClientID string
	// ClientSecret is the OAuth client secret (omit for public clients).
	ClientSecret string
	// RedirectURI is the application's callback URL.
	RedirectURI string
	// Scopes requested. Defaults to ["openid", "profile", "email"].
	Scopes []string
	// HTTPClient overrides the default transport. Optional.
	HTTPClient *http.Client
}

type PkceChallenge struct {
	// CodeVerifier is the secret. Store in session; send on token exchange.
	CodeVerifier string
	// CodeChallenge is sent in the authorize URL.
	CodeChallenge string
	// CodeChallengeMethod is always "S256".
	CodeChallengeMethod string
}

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int64  `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
	Scope        string `json:"scope,omitempty"`
}

type TokenValidator struct {
	// contains filtered or unexported fields
}

type TokenValidatorConfig struct {
	// IssuerURL is the FlowCatalyst OIDC server (e.g. https://auth.flowcatalyst.io).
	IssuerURL string
	// Audience is your application's expected aud claim. Defaults to "flowcatalyst".
	Audience string
	// JWKSRefreshInterval is how often jwx checks for key rotation.
	// Defaults to 1 hour.
	JWKSRefreshInterval time.Duration
	// ClockSkew is the acceptable difference for exp/nbf checks.
	// Defaults to 60s.
	ClockSkew time.Duration
	// HTTPClient is the transport used for discovery + JWKS fetch.
	// Defaults to a 15-second-timeout client.
	HTTPClient *http.Client
}

type UserInfoResponse struct {
	Sub           string         `json:"sub"`
	Name          string         `json:"name,omitempty"`
	Email         string         `json:"email,omitempty"`
	EmailVerified *bool          `json:"email_verified,omitempty"`
	Extra         map[string]any `json:"-"`
}