auth

type AdminUser struct {
	Owner       string `json:"owner"`
	Name        string `json:"name"`
	Email       string `json:"email"`
	DisplayName string `json:"displayName,omitempty"`
	ID          string `json:"id,omitempty"`
}

type FlexAudience string

type FlexRoles []string

type IAMAdminClient struct {
	BaseURL      string // e.g. https://hanzo.id
	ClientID     string
	ClientSecret string
	HTTPClient   *http.Client
}

type IAMClaims struct {
	jwt.StandardClaims

	// Override Audience to handle both string and array formats from IAM.
	Audience FlexAudience `json:"aud,omitempty"`

	// User identification
	Owner       string `json:"owner,omitempty"`
	Name        string `json:"name,omitempty"`
	DisplayName string `json:"displayName,omitempty"`
	Avatar      string `json:"avatar,omitempty"`
	Email       string `json:"email,omitempty"`
	Phone       string `json:"phone,omitempty"`

	// Token metadata
	TokenType string `json:"tokenType,omitempty"`
	Nonce     string `json:"nonce,omitempty"`
	Scope     string `json:"scope,omitempty"`
	Azp       string `json:"azp,omitempty"` // Authorized party

	// Authorization
	IsAdmin     bool      `json:"isAdmin,omitempty"`
	Groups      []string  `json:"groups,omitempty"`
	Roles       FlexRoles `json:"roles,omitempty"`
	Permissions []string  `json:"permissions,omitempty"`

	// User properties (arbitrary key-value pairs from IAM).
	// The "tier" property is used for tiered billing (free/starter/pro/enterprise).
	Properties map[string]string `json:"properties,omitempty"`
}

type IAMClient struct {
	// contains filtered or unexported fields
}

type IAMConfig struct {
	// Issuer is the IAM server URL (e.g., "https://id.hanzo.ai")
	Issuer string

	// ClientID is the OAuth2 client identifier
	ClientID string

	// ClientSecret is the OAuth2 client secret
	ClientSecret string

	// AcceptedAudiences is a list of additional client IDs to accept when
	// acting as a resource server. Tokens issued for any of these audiences
	// (or for ClientID) will be accepted.
	AcceptedAudiences []string

	// AcceptedIssuers is a list of additional issuer URLs to accept.
	// Useful when the IAM server is reachable under multiple domains
	// (e.g., "https://hanzo.id" and "https://iam.hanzo.ai").
	AcceptedIssuers []string

	// JwksURI overrides the JWKS endpoint URL.
	// When set, skips OIDC discovery and fetches JWKS directly from this URL.
	// Useful when the IAM discovery doc returns an HTTPS URL but the internal
	// service is only reachable via HTTP.
	JwksURI string

	// RedirectURL is the callback URL for authorization code flow
	RedirectURL string

	// Scopes to request during authorization (defaults to "openid profile email")
	Scopes []string

	// HTTPClient allows custom HTTP client (for timeouts, proxies, etc.)
	HTTPClient *http.Client
}

type IAMUserInfo struct {
	Sub           string    `json:"sub"`
	Iss           string    `json:"iss,omitempty"`
	Aud           string    `json:"aud,omitempty"`
	Name          string    `json:"preferred_username,omitempty"`
	DisplayName   string    `json:"name,omitempty"`
	Email         string    `json:"email,omitempty"`
	EmailVerified bool      `json:"email_verified,omitempty"`
	Picture       string    `json:"picture,omitempty"`
	Address       string    `json:"address,omitempty"`
	Phone         string    `json:"phone,omitempty"`
	RealName      string    `json:"real_name,omitempty"`
	IsVerified    bool      `json:"is_verified,omitempty"`
	Groups        []string  `json:"groups,omitempty"`
	Roles         FlexRoles `json:"roles,omitempty"`
	Permissions   []string  `json:"permissions,omitempty"`
}

type IntrospectionResponse struct {
	Active    bool   `json:"active"`
	Scope     string `json:"scope,omitempty"`
	ClientID  string `json:"client_id,omitempty"`
	Username  string `json:"username,omitempty"`
	TokenType string `json:"token_type,omitempty"`
	Exp       int64  `json:"exp,omitempty"`
	Iat       int64  `json:"iat,omitempty"`
	Nbf       int64  `json:"nbf,omitempty"`
	Sub       string `json:"sub,omitempty"`
	Aud       string `json:"aud,omitempty"`
	Iss       string `json:"iss,omitempty"`
	Jti       string `json:"jti,omitempty"`
}

type JWK struct {
	Kty string `json:"kty"` // Key type (RSA, EC)
	Kid string `json:"kid"` // Key ID
	Use string `json:"use"` // Key use (sig, enc)
	Alg string `json:"alg"` // Algorithm
	N   string `json:"n"`   // RSA modulus
	E   string `json:"e"`   // RSA exponent
	X   string `json:"x"`   // EC X coordinate
	Y   string `json:"y"`   // EC Y coordinate
	Crv string `json:"crv"` // EC curve
}

type JWKS struct {
	Keys      []JWK     `json:"keys"`
	FetchedAt time.Time `json:"-"`
}

type LoginForm struct {
	Email    string
	Password string
}

type OIDCDiscovery struct {
	Issuer                 string   `json:"issuer"`
	AuthorizationEndpoint  string   `json:"authorization_endpoint"`
	TokenEndpoint          string   `json:"token_endpoint"`
	UserinfoEndpoint       string   `json:"userinfo_endpoint"`
	JwksURI                string   `json:"jwks_uri"`
	IntrospectionEndpoint  string   `json:"introspection_endpoint"`
	RevocationEndpoint     string   `json:"revocation_endpoint"`
	ScopesSupported        []string `json:"scopes_supported"`
	ResponseTypesSupported []string `json:"response_types_supported"`
	GrantTypesSupported    []string `json:"grant_types_supported"`
}

type TokenError struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
	Scope        string `json:"scope,omitempty"`
}