coreauth

type AuthCodeData struct {
	// Signature is the hashed authorization code.
	Signature string

	// ClientID is the client that requested the code.
	ClientID string

	// Subject is the user ID.
	Subject string

	// RedirectURI is the callback URI.
	RedirectURI string

	// Scopes are the requested scopes.
	Scopes []string

	// GrantedScopes are the granted scopes.
	GrantedScopes []string

	// State is the CSRF state parameter.
	State string

	// CodeChallenge is the PKCE code challenge.
	CodeChallenge string

	// CodeChallengeMethod is the PKCE method (S256 or plain).
	CodeChallengeMethod string

	// Nonce is the OpenID Connect nonce.
	Nonce string

	// Session holds the session data.
	Session *StoredSession

	// ExpiresAt is when the code expires.
	ExpiresAt int64

	// Used indicates the code has been exchanged.
	Used bool
}

type AuthMethod string

type AuthSession struct {
	// ID is the session ID.
	ID string `json:"id"`

	// Token is the session token (cookie value).
	Token string `json:"token"`

	// IdentityID is the authenticated identity.
	IdentityID uuid.UUID `json:"identity_id"`

	// Identity contains identity details (optional, may be nil).
	Identity *Identity `json:"identity,omitempty"`

	// AuthenticatedAt is when authentication occurred.
	AuthenticatedAt time.Time `json:"authenticated_at"`

	// ExpiresAt is when the session expires.
	ExpiresAt time.Time `json:"expires_at"`

	// AuthenticationMethods used in this session.
	AuthenticationMethods []AuthMethod `json:"authentication_methods,omitempty"`

	// Active indicates if the session is still valid.
	Active bool `json:"active"`

	// DeviceInfo about the session.
	DeviceInfo *DeviceInfo `json:"device_info,omitempty"`
}

type AuthenticateRequest struct {
	// Method is the authentication method.
	Method AuthMethod `json:"method"`

	// Identifier is the user identifier (email, username, etc.).
	Identifier string `json:"identifier"`

	// Password is used for password authentication.
	Password string `json:"password,omitempty"`

	// OIDCToken is used for OIDC authentication.
	OIDCToken string `json:"oidc_token,omitempty"`

	// OIDCProvider is the OIDC provider name.
	OIDCProvider string `json:"oidc_provider,omitempty"`

	// DeviceInfo contains device/client information.
	DeviceInfo *DeviceInfo `json:"device_info,omitempty"`
}

type AuthenticationProvider interface {
	// Authenticate validates credentials and creates a session.
	Authenticate(ctx context.Context, req *AuthenticateRequest) (*AuthSession, error)

	// ValidateSession validates a session token and returns session info.
	ValidateSession(ctx context.Context, sessionToken string) (*AuthSession, error)

	// RefreshSession extends a session's lifetime.
	RefreshSession(ctx context.Context, sessionToken string) (*AuthSession, error)

	// RevokeSession invalidates a session.
	RevokeSession(ctx context.Context, sessionToken string) error

	// RevokeSessions invalidates all sessions for an identity.
	RevokeSessions(ctx context.Context, identityID uuid.UUID) error

	// ListSessions lists active sessions for an identity.
	ListSessions(ctx context.Context, identityID uuid.UUID) ([]*AuthSession, error)
}

type AuthorizationSession struct {
	// RequestID uniquely identifies this authorization request.
	RequestID string `json:"request_id"`

	// ClientID is the OAuth client requesting authorization.
	ClientID string `json:"client_id"`

	// RedirectURI is the client's callback URL.
	RedirectURI string `json:"redirect_uri"`

	// Scopes requested by the client.
	Scopes []string `json:"scopes"`

	// State is the client's CSRF token.
	State string `json:"state"`

	// Nonce is the OpenID Connect nonce for replay protection.
	Nonce string `json:"nonce,omitempty"`

	// CodeChallenge is the PKCE code challenge.
	CodeChallenge string `json:"code_challenge,omitempty"`

	// CodeChallengeMethod is the PKCE challenge method.
	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`

	// UserID is set after authentication.
	UserID string `json:"user_id,omitempty"`

	// ConsentGranted is set after user consents to scopes.
	ConsentGranted bool `json:"consent_granted"`

	// GrantedScopes are the scopes the user consented to.
	GrantedScopes []string `json:"granted_scopes,omitempty"`

	// CreatedAt is when this session was created.
	CreatedAt time.Time `json:"created_at"`

	// ExpiresAt is when this session expires.
	ExpiresAt time.Time `json:"expires_at"`
}

type AuthorizeInput struct {
	ResponseType        string `query:"response_type" required:"true" enum:"code,token" doc:"OAuth 2.0 response type"`
	ClientID            string `query:"client_id" required:"true" doc:"Client identifier"`
	RedirectURI         string `query:"redirect_uri" doc:"URI to redirect after authorization"`
	Scope               string `query:"scope" doc:"Space-separated list of requested scopes"`
	State               string `query:"state" doc:"Opaque value for CSRF protection"`
	CodeChallenge       string `query:"code_challenge" doc:"PKCE code challenge"`
	CodeChallengeMethod string `query:"code_challenge_method" enum:"S256,plain" doc:"PKCE code challenge method"`
	Nonce               string `query:"nonce" doc:"OpenID Connect nonce for replay protection"`
}

type AuthorizeOutput struct {
	Location string `header:"Location" doc:"Redirect URI with authorization code or token"`
}

type Client struct {
	// ID is the client identifier.
	ID string `json:"id"`

	// Secret is the client secret (never serialized).
	Secret string `json:"-"`

	// SecretHash is the bcrypt hash of the secret.
	SecretHash string `json:"secret_hash,omitempty"`

	// Type is "public" or "confidential".
	Type ClientType `json:"type"`

	// Name is a human-readable name.
	Name string `json:"name"`

	// Description is an optional description.
	Description string `json:"description,omitempty"`

	// RedirectURIs are allowed redirect URIs.
	RedirectURIs []string `json:"redirect_uris"`

	// GrantTypes are allowed grant types.
	GrantTypes []string `json:"grant_types"`

	// ResponseTypes are allowed response types.
	ResponseTypes []string `json:"response_types"`

	// Scopes are allowed scopes.
	Scopes []string `json:"scopes"`

	// Audience restricts the token audience.
	Audience []string `json:"audience,omitempty"`

	// AccessTokenLifetime overrides the default for this client.
	AccessTokenLifetime *time.Duration `json:"access_token_lifetime,omitempty"`

	// RefreshTokenLifetime overrides the default for this client.
	RefreshTokenLifetime *time.Duration `json:"refresh_token_lifetime,omitempty"`

	// Metadata holds arbitrary client metadata.
	Metadata map[string]any `json:"metadata,omitempty"`

	// CreatedAt is when the client was created.
	CreatedAt time.Time `json:"created_at"`

	// UpdatedAt is when the client was last updated.
	UpdatedAt time.Time `json:"updated_at"`
}

type ClientConfig struct {
	// ID is the client identifier.
	ID string `json:"id" yaml:"id" jsonschema:"required,description=Unique client identifier"`

	// Secret is the client secret (for confidential clients).
	// Supports environment variable expansion: ${CLIENT_SECRET}
	Secret string `json:"secret,omitempty" yaml:"secret,omitempty" jsonschema:"description=Client secret (supports env var expansion)"`

	// Type is "public" or "confidential".
	Type string `json:"type" yaml:"type" jsonschema:"required,enum=public,enum=confidential,description=Client type"`

	// Name is a human-readable name.
	Name string `json:"name" yaml:"name" jsonschema:"required,description=Human-readable client name"`

	// Description is an optional description.
	Description string `json:"description,omitempty" yaml:"description,omitempty" jsonschema:"description=Client description"`

	// RedirectURIs are allowed redirect URIs.
	RedirectURIs []string `json:"redirect_uris,omitempty" yaml:"redirect_uris,omitempty" jsonschema:"description=Allowed redirect URIs"`

	// GrantTypes are allowed grant types.
	// Options: "authorization_code", "refresh_token", "client_credentials"
	GrantTypes []string `json:"grant_types,omitempty" yaml:"grant_types,omitempty" jsonschema:"description=Allowed OAuth grant types"`

	// ResponseTypes are allowed response types.
	// Options: "code", "token"
	ResponseTypes []string `json:"response_types,omitempty" yaml:"response_types,omitempty" jsonschema:"description=Allowed OAuth response types"`

	// Scopes are allowed scopes.
	Scopes []string `json:"scopes,omitempty" yaml:"scopes,omitempty" jsonschema:"description=Allowed OAuth scopes"`

	// Audience restricts the token audience.
	Audience []string `json:"audience,omitempty" yaml:"audience,omitempty" jsonschema:"description=Allowed token audiences"`

	// AccessTokenLifetime overrides the default for this client.
	AccessTokenLifetime *Duration `` /* 140-byte string literal not displayed */

	// RefreshTokenLifetime overrides the default for this client.
	RefreshTokenLifetime *Duration `` /* 143-byte string literal not displayed */
}

type ClientManager interface {
	// CreateClient creates a new OAuth client.
	CreateClient(ctx context.Context, client *Client) error

	// GetClientByID retrieves a client by ID.
	GetClientByID(ctx context.Context, id string) (*Client, error)

	// UpdateClient updates an existing client.
	UpdateClient(ctx context.Context, client *Client) error

	// DeleteClient deletes a client.
	DeleteClient(ctx context.Context, id string) error

	// ListClients returns all clients.
	ListClients(ctx context.Context) ([]*Client, error)
}

type ClientType string

type Config struct {
	// Issuer is the OAuth/OIDC issuer URL (required).
	// Example: "https://auth.example.com"
	Issuer string `json:"issuer" yaml:"issuer" jsonschema:"required,format=uri,description=OAuth/OIDC issuer URL"`

	// Database configures persistent storage.
	// If nil, in-memory storage is used (suitable for embedded mode).
	Database *DatabaseConfig `json:"database,omitempty" yaml:"database,omitempty" jsonschema:"description=Database configuration for persistent storage"`

	// Keys configures signing key management.
	Keys KeyConfig `json:"keys,omitempty" yaml:"keys,omitempty" jsonschema:"description=Signing key configuration"`

	// Tokens configures token lifetimes.
	Tokens TokenConfig `json:"tokens,omitempty" yaml:"tokens,omitempty" jsonschema:"description=Token lifetime configuration"`

	// Clients defines statically configured OAuth clients.
	Clients []ClientConfig `json:"clients,omitempty" yaml:"clients,omitempty" jsonschema:"description=Static OAuth client configurations"`

	// Federation configures CoreControl integration.
	Federation *FederationConfig `json:"federation,omitempty" yaml:"federation,omitempty" jsonschema:"description=CoreControl federation configuration"`

	// Features enables/disables optional features.
	Features FeatureConfig `json:"features,omitempty" yaml:"features,omitempty" jsonschema:"description=Feature flags"`
}

type ConfigFormat string

type ConsentSession struct {
	AccessToken map[string]any `json:"access_token,omitempty"`
	IDToken     map[string]any `json:"id_token,omitempty"`
}

type CoreControlDiscovery struct {
	Issuer                string   `json:"issuer"`
	AuthorizationEndpoint string   `json:"authorization_endpoint"`
	TokenEndpoint         string   `json:"token_endpoint"`
	UserinfoEndpoint      string   `json:"userinfo_endpoint"`
	JwksURI               string   `json:"jwks_uri"`
	IntrospectionEndpoint string   `json:"introspection_endpoint"`
	RevocationEndpoint    string   `json:"revocation_endpoint"`
	ScopesSupported       []string `json:"scopes_supported"`
}

type CredentialType string

type DatabaseConfig struct {
	// Driver is the database driver: "postgres", "sqlite", "mysql"
	Driver string `json:"driver" yaml:"driver" jsonschema:"required,enum=postgres,enum=sqlite,enum=mysql,description=Database driver"`

	// DSN is the database connection string.
	// Supports environment variable expansion: ${DATABASE_URL}
	DSN string `json:"dsn" yaml:"dsn" jsonschema:"required,description=Database connection string (supports env var expansion)"`
}

type DefaultIdentitySyncHandler struct {
	// contains filtered or unexported fields
}

type DefaultSessionProvider struct {
	// contains filtered or unexported fields
}

type DefaultSessionProviderOption func(*DefaultSessionProvider)

type DeviceInfo struct {
	IPAddress string `json:"ip_address,omitempty"`
	UserAgent string `json:"user_agent,omitempty"`
	DeviceID  string `json:"device_id,omitempty"`
}

type Duration time.Duration

type EmbeddedAuthProvider struct {
	// contains filtered or unexported fields
}

type EmbeddedAuthProviderOption func(*EmbeddedAuthProvider)

type EmbeddedIdentityProvider struct {
	// contains filtered or unexported fields
}

type EmbeddedOAuthClientStore struct {
	// contains filtered or unexported fields
}

type EmbeddedOAuthProvider struct {
	// contains filtered or unexported fields
}

type EntStorage struct {
	// contains filtered or unexported fields
}

type EntStorageOption func(*EntStorage)

type FeatureConfig struct {
	// RequirePKCE requires PKCE for all authorization code flows.
	// Default: true for public clients, configurable for confidential
	RequirePKCE bool `` /* 139-byte string literal not displayed */

	// AllowDynamicRegistration enables RFC 7591 dynamic client registration.
	AllowDynamicRegistration bool `` /* 172-byte string literal not displayed */

	// EnableDeviceFlow enables the device authorization grant (RFC 8628).
	EnableDeviceFlow bool `` /* 155-byte string literal not displayed */

	// EnableJWTAccessTokens issues JWT access tokens instead of opaque tokens.
	EnableJWTAccessTokens bool `` /* 171-byte string literal not displayed */
}

type FederationClient struct {
	// contains filtered or unexported fields
}

type FederationConfig struct {
	// Enabled enables federation mode.
	Enabled bool `json:"enabled" yaml:"enabled" jsonschema:"description=Enable CoreControl federation"`

	// CoreControlURL is the CoreControl server URL.
	CoreControlURL string `json:"corecontrol_url" yaml:"corecontrol_url" jsonschema:"format=uri,description=CoreControl server URL"`

	// AppID is this application's identifier in the federation.
	AppID string `json:"app_id" yaml:"app_id" jsonschema:"description=Application ID in the federation"`

	// ClientID is the OAuth client ID for CoreControl.
	ClientID string `json:"client_id" yaml:"client_id" jsonschema:"description=OAuth client ID for CoreControl"`

	// ClientSecret is the OAuth client secret for CoreControl.
	// Supports environment variable expansion: ${CORECONTROL_SECRET}
	ClientSecret string `json:"client_secret" yaml:"client_secret" jsonschema:"description=OAuth client secret (supports env var expansion)"`
}

type FederationEndpoints struct {
	// contains filtered or unexported fields
}

type FederationHealthResponse struct {
	Status       string            `json:"status"`
	AppID        string            `json:"app_id"`
	Version      string            `json:"version"`
	Capabilities []string          `json:"capabilities"`
	Details      map[string]string `json:"details,omitempty"`
}

type GlobalIdentity struct {
	ID           uuid.UUID              `json:"id"`
	FederationID uuid.UUID              `json:"federation_id"`
	Email        string                 `json:"email"`
	DisplayName  string                 `json:"display_name"`
	Status       string                 `json:"status"`
	Attributes   map[string]interface{} `json:"attributes,omitempty"`
	CreatedAt    time.Time              `json:"created_at"`
	UpdatedAt    time.Time              `json:"updated_at"`
}

type Identity struct {
	// ID is the unique identifier.
	ID uuid.UUID `json:"id"`

	// State is the identity state (active, inactive, etc.).
	State IdentityState `json:"state"`

	// Traits holds identity attributes (email, name, etc.).
	// In Kratos, this maps to the identity traits.
	Traits IdentityTraits `json:"traits"`

	// Metadata holds administrative metadata.
	Metadata map[string]any `json:"metadata,omitempty"`

	// Credentials holds credential information (password hash, etc.).
	// Note: Sensitive data should not be returned in queries.
	Credentials []IdentityCredential `json:"credentials,omitempty"`

	// CreatedAt is when the identity was created.
	CreatedAt time.Time `json:"created_at"`

	// UpdatedAt is when the identity was last updated.
	UpdatedAt time.Time `json:"updated_at"`
}

type IdentityCredential struct {
	Type        CredentialType `json:"type"`
	Identifiers []string       `json:"identifiers,omitempty"`
}

type IdentityFilter struct {
	Email    string
	State    IdentityState
	PageSize int
	Page     int
}

type IdentityMapping struct {
	ID               uuid.UUID `json:"id"`
	GlobalIdentityID uuid.UUID `json:"global_identity_id"`
	AppID            string    `json:"app_id"`
	LocalPrincipalID uuid.UUID `json:"local_principal_id"`
	MappedAt         time.Time `json:"mapped_at"`
	SyncStatus       string    `json:"sync_status"`
}

type IdentityProvider interface {
	// CreateIdentity creates a new identity.
	CreateIdentity(ctx context.Context, identity *Identity) error

	// GetIdentity retrieves an identity by ID.
	GetIdentity(ctx context.Context, id uuid.UUID) (*Identity, error)

	// GetIdentityByEmail retrieves an identity by email address.
	GetIdentityByEmail(ctx context.Context, email string) (*Identity, error)

	// UpdateIdentity updates an existing identity.
	UpdateIdentity(ctx context.Context, identity *Identity) error

	// DeleteIdentity deletes an identity.
	DeleteIdentity(ctx context.Context, id uuid.UUID) error

	// ListIdentities lists identities with optional filtering.
	ListIdentities(ctx context.Context, filter *IdentityFilter) ([]*Identity, error)
}

type IdentityState string

type IdentitySyncHandler interface {
	// SyncIdentity is called when CoreControl wants to sync an identity to this app.
	// The handler should create/update/delete the local principal as appropriate.
	SyncIdentity(ctx context.Context, req *IdentitySyncRequest) (*IdentitySyncResponse, error)
}

type IdentitySyncRequest struct {
	Action   string          `json:"action"` // create, update, delete
	Identity *GlobalIdentity `json:"identity"`
}

type IdentitySyncResponse struct {
	LocalPrincipalID uuid.UUID `json:"local_principal_id"`
	Status           string    `json:"status"` // synced, pending, failed
	Error            string    `json:"error,omitempty"`
}

type IdentityTraits struct {
	Email         string `json:"email"`
	EmailVerified bool   `json:"email_verified,omitempty"`
	Name          string `json:"name,omitempty"`
	GivenName     string `json:"given_name,omitempty"`
	FamilyName    string `json:"family_name,omitempty"`
	Picture       string `json:"picture,omitempty"`
	Locale        string `json:"locale,omitempty"`
}

type IntrospectInput struct {
	Token         string `form:"token" required:"true" doc:"The token to introspect"`
	TokenTypeHint string `form:"token_type_hint" enum:"access_token,refresh_token" doc:"Hint about the token type"`

	// Client authentication
	Authorization string `header:"Authorization" doc:"Basic authentication header (client_id:client_secret)"`
}

type IntrospectOutput struct {
	Body IntrospectResponse
}

type IntrospectResponse struct {
	Active    bool   `json:"active" doc:"Whether the token is active"`
	Scope     string `json:"scope,omitempty" doc:"Scopes associated with the token"`
	ClientID  string `json:"client_id,omitempty" doc:"Client that requested the token"`
	Username  string `json:"username,omitempty" doc:"Resource owner username"`
	TokenType string `json:"token_type,omitempty" doc:"Token type"`
	Exp       int64  `json:"exp,omitempty" doc:"Token expiration timestamp"`
	Iat       int64  `json:"iat,omitempty" doc:"Token issue timestamp"`
	Nbf       int64  `json:"nbf,omitempty" doc:"Token not-before timestamp"`
	Sub       string `json:"sub,omitempty" doc:"Subject (user ID)"`
	Aud       string `json:"aud,omitempty" doc:"Intended audience"`
	Iss       string `json:"iss,omitempty" doc:"Token issuer"`
	Jti       string `json:"jti,omitempty" doc:"JWT ID"`
}

type JWKSInput struct{}

type JWKSOutput struct {
	Body jose.JSONWebKeySet
}

type KeyConfig struct {
	// Algorithm is the signing algorithm: "RS256" (default), "ES256"
	Algorithm string `` /* 136-byte string literal not displayed */

	// RotationDays is how often to rotate keys (0 = never)
	RotationDays int `` /* 138-byte string literal not displayed */

	// PrivateKey is an optional pre-configured RSA private key.
	// If nil, a key will be generated automatically.
	// This field is not serialized - for programmatic use only.
	PrivateKey *rsa.PrivateKey `json:"-" yaml:"-" jsonschema:"-"`
}

type MemoryStorage struct {
	// contains filtered or unexported fields
}

type OAuthAuthorizeRequest struct {
	ClientID            string `json:"client_id"`
	RedirectURI         string `json:"redirect_uri"`
	ResponseType        string `json:"response_type"`
	Scope               string `json:"scope"`
	State               string `json:"state"`
	Nonce               string `json:"nonce,omitempty"`
	CodeChallenge       string `json:"code_challenge,omitempty"`
	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
	Prompt              string `json:"prompt,omitempty"`
	MaxAge              int    `json:"max_age,omitempty"`
	UILocales           string `json:"ui_locales,omitempty"`
	ACRValues           string `json:"acr_values,omitempty"`
}

type OAuthAuthorizeResponse struct {
	// Code is the authorization code (for code flow).
	Code string `json:"code,omitempty"`

	// RedirectTo is the URL to redirect the user to.
	RedirectTo string `json:"redirect_to"`

	// Error information if authorization failed.
	Error            string `json:"error,omitempty"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type OAuthClient struct {
	// ClientID is the unique client identifier.
	ClientID string `json:"client_id"`

	// ClientSecret is the client secret (hashed in storage).
	ClientSecret string `json:"client_secret,omitempty"`

	// ClientName is the human-readable client name.
	ClientName string `json:"client_name,omitempty"`

	// RedirectURIs are the allowed redirect URIs.
	RedirectURIs []string `json:"redirect_uris"`

	// GrantTypes are the allowed grant types.
	GrantTypes []string `json:"grant_types"`

	// ResponseTypes are the allowed response types.
	ResponseTypes []string `json:"response_types"`

	// Scope is the allowed scope.
	Scope string `json:"scope"`

	// Audience are the allowed audiences.
	Audience []string `json:"audience,omitempty"`

	// TokenEndpointAuthMethod is the authentication method for the token endpoint.
	TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty"`

	// Public indicates if this is a public client (no secret).
	Public bool `json:"public"`

	// Metadata holds custom client metadata.
	Metadata map[string]any `json:"metadata,omitempty"`

	// CreatedAt is when the client was created.
	CreatedAt time.Time `json:"created_at,omitzero"`

	// UpdatedAt is when the client was last updated.
	UpdatedAt time.Time `json:"updated_at,omitzero"`
}

type OAuthClientStore interface {
	// CreateClient creates a new OAuth client.
	CreateClient(ctx context.Context, client *OAuthClient) error

	// GetClient retrieves a client by ID.
	GetClient(ctx context.Context, clientID string) (*OAuthClient, error)

	// UpdateClient updates an existing client.
	UpdateClient(ctx context.Context, client *OAuthClient) error

	// DeleteClient deletes a client.
	DeleteClient(ctx context.Context, clientID string) error

	// ListClients lists all clients.
	ListClients(ctx context.Context) ([]*OAuthClient, error)
}

type OAuthConsentAccept struct {
	GrantScopes []string        `json:"grant_scopes"`
	Remember    bool            `json:"remember"`
	RememberFor int             `json:"remember_for,omitempty"`
	Session     *ConsentSession `json:"session,omitempty"`
}

type OAuthConsentReject struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type OAuthConsentRequest struct {
	Challenge       string   `json:"challenge"`
	ClientID        string   `json:"client_id"`
	RequestedScopes []string `json:"requested_scopes"`
	Subject         string   `json:"subject"`
	Skip            bool     `json:"skip"`
}

type OAuthConsentResponse struct {
	RedirectTo string `json:"redirect_to"`
}

type OAuthError struct {
	Error            string `json:"error" doc:"Error code"`
	ErrorDescription string `json:"error_description,omitempty" doc:"Human-readable error description"`
	ErrorURI         string `json:"error_uri,omitempty" doc:"URI with more information about the error"`
}

type OAuthIntrospection struct {
	Active    bool     `json:"active"`
	Scope     string   `json:"scope,omitempty"`
	ClientID  string   `json:"client_id,omitempty"`
	Username  string   `json:"username,omitempty"`
	TokenType string   `json:"token_type,omitempty"`
	Exp       int64    `json:"exp,omitempty"`
	Iat       int64    `json:"iat,omitempty"`
	Nbf       int64    `json:"nbf,omitempty"`
	Sub       string   `json:"sub,omitempty"`
	Aud       []string `json:"aud,omitempty"`
	Iss       string   `json:"iss,omitempty"`
	Jti       string   `json:"jti,omitempty"`
}

type OAuthLoginAccept struct {
	Subject     string         `json:"subject"`
	Remember    bool           `json:"remember"`
	RememberFor int            `json:"remember_for,omitempty"`
	ACR         string         `json:"acr,omitempty"`
	Context     map[string]any `json:"context,omitempty"`
}

type OAuthLoginReject struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type OAuthLoginRequest struct {
	Challenge       string   `json:"challenge"`
	ClientID        string   `json:"client_id"`
	RequestedScopes []string `json:"requested_scopes"`
	Skip            bool     `json:"skip"`
	Subject         string   `json:"subject,omitempty"`
}

type OAuthLoginResponse struct {
	RedirectTo string `json:"redirect_to"`
}

type OAuthProvider interface {

	// Authorize handles the authorization request.
	// Returns an authorization code or error.
	Authorize(ctx context.Context, req *OAuthAuthorizeRequest) (*OAuthAuthorizeResponse, error)

	// Token handles token requests (authorization code, refresh, client credentials).
	Token(ctx context.Context, req *OAuthTokenRequest) (*OAuthTokenResponse, error)

	// Introspect validates and returns information about a token.
	Introspect(ctx context.Context, token string, tokenTypeHint string) (*OAuthIntrospection, error)

	// Revoke revokes an access or refresh token.
	Revoke(ctx context.Context, token string, tokenTypeHint string) error

	// UserInfo returns claims about the authenticated user (OIDC).
	UserInfo(ctx context.Context, accessToken string) (*OAuthUserInfo, error)

	// GetConsentRequest retrieves a pending consent request.
	GetConsentRequest(ctx context.Context, challenge string) (*OAuthConsentRequest, error)

	// AcceptConsent accepts a consent request.
	AcceptConsent(ctx context.Context, challenge string, accept *OAuthConsentAccept) (*OAuthConsentResponse, error)

	// RejectConsent rejects a consent request.
	RejectConsent(ctx context.Context, challenge string, reject *OAuthConsentReject) (*OAuthConsentResponse, error)

	// GetLoginRequest retrieves a pending login request.
	GetLoginRequest(ctx context.Context, challenge string) (*OAuthLoginRequest, error)

	// AcceptLogin accepts a login request.
	AcceptLogin(ctx context.Context, challenge string, accept *OAuthLoginAccept) (*OAuthLoginResponse, error)

	// RejectLogin rejects a login request.
	RejectLogin(ctx context.Context, challenge string, reject *OAuthLoginReject) (*OAuthLoginResponse, error)
}

type OAuthTokenRequest struct {
	GrantType    string `json:"grant_type"`
	Code         string `json:"code,omitempty"`
	RedirectURI  string `json:"redirect_uri,omitempty"`
	RefreshToken string `json:"refresh_token,omitempty"`
	ClientID     string `json:"client_id,omitempty"`
	ClientSecret string `json:"client_secret,omitempty"`
	CodeVerifier string `json:"code_verifier,omitempty"`
	Scope        string `json:"scope,omitempty"`
}

type OAuthTokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int64  `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
	Scope        string `json:"scope,omitempty"`
}

type OAuthUserInfo struct {
	Sub           string `json:"sub"`
	Name          string `json:"name,omitempty"`
	GivenName     string `json:"given_name,omitempty"`
	FamilyName    string `json:"family_name,omitempty"`
	Email         string `json:"email,omitempty"`
	EmailVerified bool   `json:"email_verified,omitempty"`
	Picture       string `json:"picture,omitempty"`
	Locale        string `json:"locale,omitempty"`
	Zoneinfo      string `json:"zoneinfo,omitempty"`
}

type OpenIDConfigInput struct{}

type OpenIDConfigOutput struct {
	Body OpenIDConfiguration
}

type OpenIDConfiguration struct {
	Issuer                            string   `json:"issuer"`
	AuthorizationEndpoint             string   `json:"authorization_endpoint"`
	TokenEndpoint                     string   `json:"token_endpoint"`
	UserinfoEndpoint                  string   `json:"userinfo_endpoint,omitempty"`
	JwksURI                           string   `json:"jwks_uri"`
	RegistrationEndpoint              string   `json:"registration_endpoint,omitempty"`
	IntrospectionEndpoint             string   `json:"introspection_endpoint,omitempty"`
	RevocationEndpoint                string   `json:"revocation_endpoint,omitempty"`
	ScopesSupported                   []string `json:"scopes_supported,omitempty"`
	ResponseTypesSupported            []string `json:"response_types_supported"`
	ResponseModesSupported            []string `json:"response_modes_supported,omitempty"`
	GrantTypesSupported               []string `json:"grant_types_supported,omitempty"`
	SubjectTypesSupported             []string `json:"subject_types_supported"`
	IDTokenSigningAlgValuesSupported  []string `json:"id_token_signing_alg_values_supported"`
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`
	ClaimsSupported                   []string `json:"claims_supported,omitempty"`
	CodeChallengeMethodsSupported     []string `json:"code_challenge_methods_supported,omitempty"`
}

type Option func(*Server)

type Providers struct {
	Identity       IdentityProvider
	Authentication AuthenticationProvider
	OAuth          OAuthProvider
	OAuthClients   OAuthClientStore
}

type ProvidersOption func(*providersConfig)

type RevokeInput struct {
	Token         string `form:"token" required:"true" doc:"The token to revoke"`
	TokenTypeHint string `form:"token_type_hint" enum:"access_token,refresh_token" doc:"Hint about the token type"`

	// Client authentication
	Authorization string `header:"Authorization" doc:"Basic authentication header (client_id:client_secret)"`
}

type RevokeOutput struct{}

type SSOSession struct {
	ID               uuid.UUID `json:"id"`
	GlobalIdentityID uuid.UUID `json:"global_identity_id"`
	AuthTime         time.Time `json:"auth_time"`
	ExpiresAt        time.Time `json:"expires_at"`
	AppsAccessed     []string  `json:"apps_accessed"`
}

type SSOTokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
	Scope        string `json:"scope,omitempty"`
}

type Server struct {
	// contains filtered or unexported fields
}

type SessionProvider interface {
	// GetAuthenticatedUser returns the authenticated user ID from the request.
	// Returns empty string if the user is not authenticated.
	GetAuthenticatedUser(r *http.Request) string

	// RedirectToLogin returns the URL to redirect unauthenticated users to.
	// The returnURL is the original authorization request URL to return to after login.
	RedirectToLogin(returnURL string) string

	// HasConsent checks if the user has already granted consent for the client and scopes.
	// Returns true if consent exists and is still valid.
	HasConsent(ctx context.Context, userID, clientID string, scopes []string) bool

	// RedirectToConsent returns the URL to redirect users for consent approval.
	// The returnURL is the original authorization request URL to return to after consent.
	RedirectToConsent(returnURL string) string

	// SaveConsent records that the user has granted consent for the client and scopes.
	SaveConsent(ctx context.Context, userID, clientID string, scopes []string) error

	// GetUserClaims returns additional claims to include in the ID token.
	// Common claims: name, email, picture, etc.
	GetUserClaims(ctx context.Context, userID string, scopes []string) map[string]interface{}
}

type Storage interface {
	// Fosite storage interfaces
	fosite.ClientManager

	// Authorization code operations
	CreateAuthorizeCodeSession(ctx context.Context, code string, request fosite.Requester) error
	GetAuthorizeCodeSession(ctx context.Context, code string, session fosite.Session) (fosite.Requester, error)
	InvalidateAuthorizeCodeSession(ctx context.Context, code string) error

	// Access token operations
	CreateAccessTokenSession(ctx context.Context, signature string, request fosite.Requester) error
	GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)
	DeleteAccessTokenSession(ctx context.Context, signature string) error

	// Refresh token operations
	CreateRefreshTokenSession(ctx context.Context, signature string, accessSignature string, request fosite.Requester) error
	GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)
	DeleteRefreshTokenSession(ctx context.Context, signature string) error
	RevokeRefreshToken(ctx context.Context, requestID string) error
	RevokeAccessToken(ctx context.Context, requestID string) error
	RotateRefreshToken(ctx context.Context, requestID string, refreshTokenSignature string) error

	// PKCE operations
	CreatePKCERequestSession(ctx context.Context, signature string, requester fosite.Requester) error
	GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)
	DeletePKCERequestSession(ctx context.Context, signature string) error

	// Client assertion JWT tracking
	ClientAssertionJWTValid(ctx context.Context, jti string) error
	SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error

	// Client management operations (extended)
	CreateClient(ctx context.Context, client *Client) error
	GetClientByID(ctx context.Context, id string) (*Client, error)
	UpdateClient(ctx context.Context, client *Client) error
	DeleteClient(ctx context.Context, id string) error
	ListClients(ctx context.Context) ([]*Client, error)

	// User management for federation (optional - may return ErrNotImplemented)
	CreateUser(ctx context.Context, user *User) error
	GetUserByID(ctx context.Context, id uuid.UUID) (*User, error)
	GetUserByEmail(ctx context.Context, email string) (*User, error)
	GetUserByFederationID(ctx context.Context, federationID uuid.UUID) (*User, error)
	UpdateUser(ctx context.Context, user *User) error
	DeleteUser(ctx context.Context, id uuid.UUID) error
}

type StoredRequest struct {
	ID            string
	ClientID      string
	Scopes        []string
	GrantedScopes []string
	Form          map[string][]string
	Session       *StoredSession
	RequestedAt   time.Time
}

type StoredSession struct {
	// Subject is the user ID.
	Subject string `json:"sub"`

	// Username is the human-readable username.
	Username string `json:"username,omitempty"`

	// Email is the user's email.
	Email string `json:"email,omitempty"`

	// Claims are additional claims.
	Claims map[string]any `json:"claims,omitempty"`

	// ExpiresAt maps token types to expiration times (unix timestamps).
	ExpiresAt map[string]int64 `json:"expires_at"`

	// RequestedAt is when the session was created (unix timestamp).
	RequestedAt int64 `json:"requested_at"`
}

type TokenConfig struct {
	// AccessTokenLifetime is how long access tokens are valid.
	// Default: 15 minutes
	AccessTokenLifetime Duration `` /* 151-byte string literal not displayed */

	// RefreshTokenLifetime is how long refresh tokens are valid.
	// Default: 7 days
	RefreshTokenLifetime Duration `` /* 158-byte string literal not displayed */

	// IDTokenLifetime is how long ID tokens are valid.
	// Default: 1 hour
	IDTokenLifetime Duration `` /* 133-byte string literal not displayed */

	// AuthCodeLifetime is how long authorization codes are valid.
	// Default: 10 minutes
	AuthCodeLifetime Duration `` /* 147-byte string literal not displayed */
}

type TokenData struct {
	// AccessTokenSignature is the hashed access token.
	AccessTokenSignature string

	// RefreshTokenSignature is the hashed refresh token.
	RefreshTokenSignature string

	// ClientID is the client that owns the token.
	ClientID string

	// Subject is the user ID.
	Subject string

	// Scopes are the granted scopes.
	Scopes []string

	// Session holds the session data.
	Session *StoredSession

	// AccessExpiresAt is when the access token expires.
	AccessExpiresAt int64

	// RefreshExpiresAt is when the refresh token expires.
	RefreshExpiresAt int64

	// Revoked indicates the token has been revoked.
	Revoked bool

	// RequestID is used for token family tracking.
	RequestID string
}

type TokenInput struct {
	GrantType    string `form:"grant_type" required:"true" enum:"authorization_code,refresh_token,client_credentials" doc:"OAuth 2.0 grant type"`
	Code         string `form:"code" doc:"Authorization code (for authorization_code grant)"`
	RedirectURI  string `form:"redirect_uri" doc:"Redirect URI (must match authorization request)"`
	ClientID     string `form:"client_id" doc:"Client identifier (if not using Basic auth)"`
	ClientSecret string `form:"client_secret" doc:"Client secret (if not using Basic auth)"`
	RefreshToken string `form:"refresh_token" doc:"Refresh token (for refresh_token grant)"`
	Scope        string `form:"scope" doc:"Requested scopes (for refresh_token or client_credentials)"`
	CodeVerifier string `form:"code_verifier" doc:"PKCE code verifier"`

	// Basic auth credentials (alternative to form-based client auth)
	Authorization string `header:"Authorization" doc:"Basic authentication header (client_id:client_secret)"`
}

type TokenOutput struct {
	Body TokenResponse
}

type TokenResponse struct {
	AccessToken  string `json:"access_token" doc:"The access token"`
	TokenType    string `json:"token_type" doc:"Token type (typically 'Bearer')"`
	ExpiresIn    int    `json:"expires_in,omitempty" doc:"Token lifetime in seconds"`
	RefreshToken string `json:"refresh_token,omitempty" doc:"Refresh token for obtaining new access tokens"`
	Scope        string `json:"scope,omitempty" doc:"Granted scopes (may differ from requested)"`
	IDToken      string `json:"id_token,omitempty" doc:"OpenID Connect ID token"`
}

type User struct {
	ID            uuid.UUID      `json:"id"`
	Email         string         `json:"email"`
	EmailVerified bool           `json:"email_verified,omitempty"`
	Name          string         `json:"name"`
	GivenName     string         `json:"given_name,omitempty"`
	FamilyName    string         `json:"family_name,omitempty"`
	Picture       string         `json:"picture,omitempty"`
	Locale        string         `json:"locale,omitempty"`
	Active        bool           `json:"active"`
	Federated     bool           `json:"federated"`
	FederationID  *uuid.UUID     `json:"federation_id,omitempty"`
	Metadata      map[string]any `json:"metadata,omitempty"`
	CreatedAt     time.Time      `json:"created_at,omitzero"`
	UpdatedAt     time.Time      `json:"updated_at,omitzero"`
}