oauth

type AuthorizationServerMetadata struct {
	// Issuer is the authorization server's issuer identifier URL
	Issuer string `json:"issuer"`

	// AuthorizationEndpoint is the URL of the authorization endpoint
	AuthorizationEndpoint string `json:"authorization_endpoint"`

	// TokenEndpoint is the URL of the token endpoint
	TokenEndpoint string `json:"token_endpoint"`

	// RegistrationEndpoint is the URL of the dynamic client registration endpoint (RFC 7591)
	RegistrationEndpoint string `json:"registration_endpoint,omitempty"`

	// ScopesSupported lists the OAuth scopes supported
	ScopesSupported []string `json:"scopes_supported,omitempty"`

	// ResponseTypesSupported lists the OAuth response types supported
	ResponseTypesSupported []string `json:"response_types_supported"`

	// GrantTypesSupported lists the OAuth grant types supported
	GrantTypesSupported []string `json:"grant_types_supported,omitempty"`

	// TokenEndpointAuthMethodsSupported lists the client authentication methods supported at the token endpoint
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`

	// CodeChallengeMethodsSupported lists the PKCE code challenge methods supported
	CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported,omitempty"`

	// RevocationEndpoint is the URL of the OAuth 2.0 token revocation endpoint (RFC 7009)
	RevocationEndpoint string `json:"revocation_endpoint,omitempty"`

	// IntrospectionEndpoint is the URL of the OAuth 2.0 token introspection endpoint (RFC 7662)
	IntrospectionEndpoint string `json:"introspection_endpoint,omitempty"`

	// ClientIDMetadataDocumentSupported indicates support for Client ID Metadata Documents (MCP 2025-11-25)
	ClientIDMetadataDocumentSupported bool `json:"client_id_metadata_document_supported,omitempty"`

	// AuthorizationResponseIssParameterSupported indicates that this authorization
	// server includes the `iss` parameter in authorization responses (RFC 9207),
	// allowing clients talking to multiple authorization servers to detect mix-up
	// attacks.
	AuthorizationResponseIssParameterSupported bool `json:"authorization_response_iss_parameter_supported,omitempty"`
}

type CallbackResult struct {
	// Code is the authorization code from a successful authorization.
	// Empty if the callback contains an error.
	Code string

	// State is the state parameter for CSRF validation.
	// Should match the state sent in the authorization request.
	State string

	// Error is the OAuth error code if authorization failed.
	// Common values: "access_denied", "login_required", "consent_required"
	Error string

	// ErrorDescription provides additional information about the error.
	// Human-readable text describing the error.
	ErrorDescription string

	// ErrorURI points to a web page with error documentation.
	ErrorURI string
}

type ClientRegistrationRequest struct {
	// RedirectURIs is the array of redirection URIs for use in redirect-based flows
	RedirectURIs []string `json:"redirect_uris,omitempty"`

	// TokenEndpointAuthMethod is the requested authentication method for the token endpoint
	TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty"`

	// GrantTypes is the array of OAuth 2.0 grant types the client will use
	GrantTypes []string `json:"grant_types,omitempty"`

	// ResponseTypes is the array of OAuth 2.0 response types the client will use
	ResponseTypes []string `json:"response_types,omitempty"`

	// ClientName is the human-readable name of the client
	ClientName string `json:"client_name,omitempty"`

	// ClientURI is the URL of the client's home page
	ClientURI string `json:"client_uri,omitempty"`

	// Scope is the space-separated list of scope values
	Scope string `json:"scope,omitempty"`

	// ClientType indicates if this is a "public" or "confidential" client
	// Public clients (mobile, SPA) can use "none" auth method
	// Confidential clients (server-side) must use client_secret_basic or client_secret_post
	ClientType string `json:"client_type,omitempty"`
}

type ClientRegistrationResponse struct {
	// ClientID is the unique client identifier
	ClientID string `json:"client_id"`

	// ClientSecret is the client secret (for confidential clients)
	ClientSecret string `json:"client_secret,omitempty"`

	// ClientIDIssuedAt is the time the client_id was issued
	ClientIDIssuedAt int64 `json:"client_id_issued_at,omitempty"`

	// ClientSecretExpiresAt is when the client_secret expires (0 = never)
	ClientSecretExpiresAt int64 `json:"client_secret_expires_at,omitempty"`

	// RedirectURIs is the array of redirection URIs
	RedirectURIs []string `json:"redirect_uris,omitempty"`

	// TokenEndpointAuthMethod is the authentication method for the token endpoint
	TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty"`

	// GrantTypes is the array of OAuth 2.0 grant types
	GrantTypes []string `json:"grant_types,omitempty"`

	// ResponseTypes is the array of OAuth 2.0 response types
	ResponseTypes []string `json:"response_types,omitempty"`

	// ClientName is the human-readable name of the client
	ClientName string `json:"client_name,omitempty"`

	// Scope is the space-separated list of scope values
	Scope string `json:"scope,omitempty"`

	// ClientType indicates if this is a "public" or "confidential" client
	ClientType string `json:"client_type,omitempty"`
}

type Config struct {
	// Resource is the MCP server resource identifier for RFC 8707
	// This should be the base URL of the MCP server
	Resource string

	// SupportedScopes are all available Google API scopes
	SupportedScopes []string

	// Google OAuth credentials and settings
	GoogleAuth GoogleAuthConfig

	// Rate limiting configuration
	RateLimit RateLimitConfig

	// Security settings (secure by default)
	Security SecurityConfig

	// CleanupInterval is how often to cleanup expired tokens
	// Default: 1 minute
	CleanupInterval time.Duration

	// Logger for structured logging (optional, uses default if not provided)
	Logger *slog.Logger

	// HTTPClient is a custom HTTP client for OAuth requests
	// If not provided, uses the default HTTP client
	// Can be used to add timeouts, logging, metrics, etc.
	HTTPClient *http.Client
}

type Error struct {
	Code        string // OAuth error code (e.g., "invalid_request", "invalid_grant")
	Description string // Human-readable error description
	Status      int    // HTTP status code
}

type ErrorResponse struct {
	// Error is the error code
	Error string `json:"error"`

	// ErrorDescription provides additional information
	ErrorDescription string `json:"error_description,omitempty"`

	// ErrorURI points to error documentation
	ErrorURI string `json:"error_uri,omitempty"`
}

type ForwardedIDTokenAcceptance = server.ForwardedIDTokenAcceptance

type GoogleAuthConfig struct {
	// ClientID is the Google OAuth Client ID (required).
	ClientID string

	// ClientSecret is the Google OAuth Client Secret (required).
	ClientSecret string

	// RedirectURL is where Google redirects after authentication.
	RedirectURL string
}

type Handler struct {
	// contains filtered or unexported fields
}

type OAuthRoutesOptions struct {
	// MCPPath is forwarded to RegisterProtectedResourceMetadataRoutes for
	// backward compatibility with single-path consumers. Kept because a few
	// examples still pass it, but prefer configuring
	// [Config.ResourceMetadataByPath] instead — when that map is non-empty,
	// MCPPath is ignored (with a single warn log at registration time so the
	// conflict is visible).
	MCPPath string

	// IncludeMetadata controls whether the two discovery bundles
	// (Protected Resource Metadata per RFC 9728 and Authorization Server
	// Metadata per RFC 8414) are registered alongside the OAuth flow
	// endpoints. Default true — this is what every consumer today does by
	// hand.
	IncludeMetadata bool
}

type ProtectedResourceMetadata struct {
	// Resource is the identifier for the protected resource
	Resource string `json:"resource"`

	// AuthorizationServers lists the authorization servers that can issue tokens for this resource
	AuthorizationServers []string `json:"authorization_servers"`

	// BearerMethodsSupported lists the ways Bearer tokens can be sent (RFC 6750)
	BearerMethodsSupported []string `json:"bearer_methods_supported,omitempty"`

	// ResourceSigningAlgValuesSupported lists supported signing algorithms
	ResourceSigningAlgValuesSupported []string `json:"resource_signing_alg_values_supported,omitempty"`

	// ScopesSupported lists the scopes understood by this resource
	ScopesSupported []string `json:"scopes_supported,omitempty"`
}

type RateLimitConfig struct {
	// Rate is requests per second allowed per IP. Zero disables limiting.
	Rate int

	// Burst is the maximum burst size allowed per IP.
	Burst int

	// CleanupInterval is how often to cleanup inactive rate limiters.
	CleanupInterval time.Duration

	// UserRate is requests per second allowed per authenticated user.
	// Applied in addition to IP-based limiting. Zero disables.
	UserRate int

	// UserBurst is the maximum burst size per authenticated user.
	UserBurst int

	// TrustProxy enables trusting X-Forwarded-For and X-Real-IP headers.
	// Only enable behind a trusted reverse proxy.
	TrustProxy bool
}

type SecurityConfig struct {
	// AllowInsecureAuthWithoutState permits auth requests without state parameter.
	// WARNING: Weakens CSRF protection. Only for legacy clients.
	AllowInsecureAuthWithoutState bool

	// DisableRefreshTokenRotation disables automatic refresh token rotation.
	// WARNING: Violates OAuth 2.1. Stolen tokens remain valid indefinitely.
	DisableRefreshTokenRotation bool

	// AllowPublicClientRegistration permits unauthenticated client registration.
	// WARNING: Can enable DoS via mass registration.
	AllowPublicClientRegistration bool

	// RegistrationAccessToken is required for client registration when
	// AllowPublicClientRegistration is false.
	RegistrationAccessToken string

	// RefreshTokenTTL is how long refresh tokens remain valid.
	// Recommended: 30-90 days. Zero means never expire.
	RefreshTokenTTL time.Duration

	// MaxClientsPerIP limits registrations per IP to prevent DoS.
	// Zero means no limit (not recommended).
	MaxClientsPerIP int

	// AllowCustomRedirectSchemes permits non-http/https URIs (e.g., myapp://).
	// Custom schemes are validated against AllowedCustomSchemes patterns.
	AllowCustomRedirectSchemes bool

	// AllowedCustomSchemes lists allowed custom URI scheme regex patterns.
	// Default: RFC 3986 compliant schemes.
	AllowedCustomSchemes []string

	// EncryptionKey is the AES-256 key (32 bytes) for token encryption at rest.
	// Nil disables encryption. Generate with oauth.GenerateEncryptionKey().
	EncryptionKey []byte

	// EnableAuditLogging enables security audit logging.
	// Logs auth events, token operations, and violations (sensitive data hashed).
	EnableAuditLogging bool
}

type Server = server.Server

type ServerConfig = server.Config

type ServerOption = server.Option

type SilentAuthError struct {
	// Code is the OAuth/OIDC error code.
	// Common values: "login_required", "consent_required", "interaction_required"
	Code string

	// Description is the optional error description from the IdP
	Description string
}

type TokenResponse struct {
	// AccessToken is the access token
	AccessToken string `json:"access_token"`

	// TokenType is the type of token (always "Bearer")
	TokenType string `json:"token_type"`

	// ExpiresIn is the lifetime in seconds of the access token
	ExpiresIn int64 `json:"expires_in,omitempty"`

	// RefreshToken is the refresh token (optional)
	RefreshToken string `json:"refresh_token,omitempty"`

	// Scope is the scope of the access token
	Scope string `json:"scope,omitempty"`

	// IDToken is the OIDC ID token from the upstream provider (optional).
	// Per OpenID Connect Core 1.0 Section 3.1.3.3, this is REQUIRED for OIDC flows.
	// This enables clients to use id_token_hint and login_hint for silent re-authentication.
	IDToken string `json:"id_token,omitempty"`
}