provider

type AppleConfig struct {
	ClientID     string // the identifier Services ID for your app created in Apple developer account.
	TeamID       string // developer Team ID (10 characters), required for create JWT. It available, after signed in at developer account, by link: https://developer.apple.com/account/#/membership
	KeyID        string // private key ID  assigned to private key obtain in Apple developer account
	ResponseMode string // changes method of receiving data in callback. Default value "form_post" (https://developer.apple.com/documentation/sign_in_with_apple/request_an_authorization_to_the_sign_in_with_apple_server?changes=_1_2#4066168)
	// contains filtered or unexported fields
}

type AppleHandler struct {
	Params

	PrivateKeyLoader PrivateKeyLoaderInterface // custom function interface for load private key
	// contains filtered or unexported fields
}

type AvatarSaver interface {
	Put(u token.User, client *http.Client) (avatarURL string, err error)
}

type BearerTokenHook func(provider string, user token.User, token oauth2.Token)

type ContextSender interface {
	SendContext(ctx context.Context, address, text string) error
}

type CredChecker interface {
	Check(user, password string) (ok bool, err error)
}

type CredCheckerFunc func(user, password string) (ok bool, err error)

type CustomHandlerOpt struct {
	Endpoint          oauth2.Endpoint
	InfoURL           string
	MapUserFn         func(UserData, []byte) token.User
	BearerTokenHookFn BearerTokenHook
	Scopes            []string
}

type CustomServer struct {
	logger.L
	URL              string                                       // root url for custom oauth2 server
	WithLoginPage    bool                                         // redirect to login html page if true
	LoginPageHandler func(w http.ResponseWriter, r *http.Request) // handler for user-defined login page
	OauthServer      *goauth2.Server                              // an instance of go-oauth2/oauth2 server
	HandlerOpt       CustomHandlerOpt
	// contains filtered or unexported fields
}

type CustomServerOpt struct {
	logger.L
	URL              string
	WithLoginPage    bool
	LoginPageHandler func(w http.ResponseWriter, r *http.Request)
}

type DevAuthServer struct {
	logger.L
	Provider   Oauth2Handler
	Automatic  bool
	GetEmailFn func(string) string
	// contains filtered or unexported fields
}

type DirectHandler struct {
	logger.L
	CredChecker  CredChecker
	ProviderName string
	TokenService TokenService
	Issuer       string
	AvatarSaver  AvatarSaver
	UserIDFunc   UserIDFunc
}

type LoadFromFileFunc struct {
	Path string
}

type Oauth1Handler struct {
	Params
	// contains filtered or unexported fields
}

type Oauth2Handler struct {
	Params
	// contains filtered or unexported fields
}

type Params struct {
	logger.L
	URL            string
	JwtService     TokenService
	Cid            string
	Csecret        string
	Issuer         string
	AvatarSaver    AvatarSaver
	UserAttributes UserAttributes

	// AllowedRedirectHosts lists hostnames accepted in the "from" query
	// parameter. Setting this field enables host validation: the host of
	// URL is always implicit, and any other host must appear here. Nil
	// disables validation and preserves legacy permissive behavior — any
	// non-empty "from" value is honored. See isAllowedRedirect for the
	// full policy.
	AllowedRedirectHosts token.AllowedHosts

	Port int    // relevant for providers supporting port customization, for example dev oauth2
	Host string // relevant for providers supporting host customization, for example dev oauth2

	MicrosoftTenant string // tenant for microsoft provider, default "common"

	// GithubNumericID makes github provider derive the user id from the immutable numeric account id
	// instead of the login. Logins are released on rename or account removal and can be claimed by
	// someone else, so an id derived from login may be inherited by the next holder of the name.
	// Enabling this changes the id of every existing github user, see README for the migration note.
	// Best-effort: if the response carries no usable numeric id the login-derived id is kept.
	GithubNumericID bool
}

type PrivateKeyLoaderInterface interface {
	LoadPrivateKey() ([]byte, error)
}

type Provider interface {
	Name() string
	LoginHandler(w http.ResponseWriter, r *http.Request)
	AuthHandler(w http.ResponseWriter, r *http.Request)
	LogoutHandler(w http.ResponseWriter, r *http.Request)
}

type Sender interface {
	Send(address, text string) error
}

type SenderFunc func(address, text string) error

type Service struct {
	Provider
}

type TelegramAPI interface {
	GetUpdates(ctx context.Context) (*telegramUpdate, error)
	Avatar(ctx context.Context, userID int) (string, error)
	Send(ctx context.Context, id int, text string) error
	BotInfo(ctx context.Context) (*botInfo, error)
}

type TelegramHandler struct {
	logger.L

	ProviderName         string
	ErrorMsg, SuccessMsg string

	TokenService TokenService
	AvatarSaver  AvatarSaver
	Telegram     TelegramAPI
	// contains filtered or unexported fields
}

type TokenService interface {
	Parse(tokenString string) (claims token.Claims, err error)
	Set(w http.ResponseWriter, claims token.Claims) (token.Claims, error)
	Get(r *http.Request) (claims token.Claims, token string, err error)
	Reset(w http.ResponseWriter)
}

type UserAttributes map[string]string

type UserData map[string]any

type UserIDFunc func(user string, r *http.Request) string

type VerifConfirmationStore interface {
	// MarkUsed records key as consumed and returns alreadyUsed=true if it was
	// already recorded. The implementation MUST retain the marker for at
	// least the supplied ttl, or return a non-nil err if it cannot --
	// dropping a marker before its ttl while the underlying JWT is still
	// valid reopens the replay window the store is meant to close. err
	// signals a backend failure (network, disk, capacity, etc.); callers
	// MUST treat a non-nil err as fail-closed (reject the redemption).
	//
	// Adapter authors: do NOT embed key (or any caller-supplied data) in
	// returned errors. The handler logs err on the fail-closed branch, and
	// although key is the SHA-256 of the raw token rather than the token
	// itself, it still uniquely identifies the live, unredeemed JWT in
	// log destinations. Wrap the underlying backend error with a generic
	// description (e.g. "redis SET failed: %w") instead.
	MarkUsed(key string, ttl time.Duration) (alreadyUsed bool, err error)
}

type VerifConfirmationStoreFunc func(key string, ttl time.Duration) (alreadyUsed bool, err error)

type VerifTokenService interface {
	Token(claims token.Claims) (string, error)
	Parse(tokenString string) (claims token.Claims, err error)
	IsExpired(claims token.Claims) bool
	Set(w http.ResponseWriter, claims token.Claims) (token.Claims, error)
	Reset(w http.ResponseWriter)
}

type VerifyHandler struct {
	logger.L
	ProviderName string
	TokenService VerifTokenService
	Issuer       string
	AvatarSaver  AvatarSaver
	Sender       Sender
	Template     string
	UseGravatar  bool

	// URL is the service's own root URL; its host is always permitted as
	// a "from" redirect target. Optional but recommended.
	URL string
	// AllowedRedirectHosts lists additional hostnames permitted as "from"
	// redirect targets. Setting this field enables host validation: the
	// host of URL is always implicit, and any other host must appear
	// here. Nil disables validation and preserves legacy permissive
	// behavior — any non-empty "from" value is honored.
	AllowedRedirectHosts token.AllowedHosts

	// ConfirmationStore enforces one-shot consumption of confirmation tokens.
	// When non-nil, a token cannot be redeemed twice within its TTL window.
	// Leave nil to keep the legacy behavior (token replayable until expiry).
	ConfirmationStore VerifConfirmationStore
}