jwtauth

type Authenticator interface {
	CheckAuthentication(ctx context.Context, tok string) (UserInfo, error)
}

type Config struct {
	Issuer string
	// ExpectedAudiences contains the primary audience (index 0) followed by any
	// additional accepted audiences. The first entry SHOULD be the production
	// audience registered with the authorization server; subsequent entries are
	// primarily intended for local / testing scenarios where the served MCP
	// endpoint base URL differs from the production one. Avoid growing this set
	// in production unless deliberately operating a multi-audience design.
	ExpectedAudiences []string
	RequiredScopes    []string
	ScopeModeAny      bool // if true, any of RequiredScopes is sufficient; else all are required
	AllowedAlgs       []string
	Leeway            time.Duration
	// HintScopes carries an optional set of scopes that transports may echo
	// in WWW-Authenticate "scope" parameters when constructing Bearer
	// challenges. They are advisory only and do not affect token validation.
	HintScopes []string
	// AdvertisedScopesTransform is an optional function that receives the scopes
	// discovered from the authorization server's OIDC metadata and returns the
	// scopes that should be advertised in the protected resource metadata. If nil,
	// the discovered scopes are used as-is.
	AdvertisedScopesTransform func(discovered []string) []string
}

type DiscoveryMetadata interface {
	AuthorizationEndpoint() string
	TokenEndpoint() string
}

type StaticConfig struct {
	Issuer            string
	ExpectedAudiences []string
	AllowedAlgs       []string
	Leeway            time.Duration
}

type UserInfo interface {
	UserID() string
	Claims(ref any) error
}