oidc

type Config struct {
	// Issuer is the issuer URL; tokens' iss must match exactly.
	Issuer string
	// JWKSURL overrides key discovery. Empty = try OIDC discovery
	// ({issuer}/.well-known/openid-configuration), falling back to
	// {issuer}/jwks.json (the qllauthpoc convention).
	JWKSURL string
	// Audience, when set, must appear in the token's aud.
	Audience string
	// RoleClaim is the claim carrying the caller's role(s); string or list.
	// Default "role".
	RoleClaim string
	// RoleMap translates issuer role names to auth roles (e.g.
	// {"subject_moderator": auth.RoleModerator}). Issuer values that already
	// equal an auth.Role name map implicitly; anything else is ignored.
	RoleMap map[string]auth.Role
	// ClaimEquals lists extra exact-match claim requirements (e.g.
	// {"token_use": "access"} to reject id tokens).
	ClaimEquals map[string]string
	// EmailClaim is the claim carrying the caller's email. Default "email".
	EmailClaim string
	// HTTPClient overrides the client used for discovery and JWKS (tests).
	HTTPClient *http.Client
}

type Discovery struct {
	AuthorizationEndpoint string `json:"authorization_endpoint"`
	TokenEndpoint         string `json:"token_endpoint"`
	JWKSURI               string `json:"jwks_uri"`
}

type ExchangeConfig struct {
	// TokenEndpoint is the issuer's token URL. Empty = resolve via OIDC
	// discovery at first use.
	TokenEndpoint string
	// Issuer is used for discovery when TokenEndpoint is empty.
	Issuer string
	// ClientID and ClientSecret are the confidential client credentials
	// added to every proxied request. An empty secret disables the proxy
	// (503) until deployment configuration provides one.
	ClientID     string
	ClientSecret string
	// HTTPClient overrides the upstream client (tests).
	HTTPClient *http.Client
}

type Verifier struct {
	// contains filtered or unexported fields
}