oauth

type AuthorizationServerMetadata struct {
	Issuer                            string   `json:"issuer"`
	AuthorizationEndpoint             string   `json:"authorization_endpoint"`
	TokenEndpoint                     string   `json:"token_endpoint"`
	GrantTypesSupported               []string `json:"grant_types_supported"`
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported"`
	CodeChallengeMethodsSupported     []string `json:"code_challenge_methods_supported"`
	ScopesSupported                   []string `json:"scopes_supported"`
	ResponseTypesSupported            []string `json:"response_types_supported"`
}

type Config struct {
	// ServerURL is the MCP server URL (e.g. https://mcp.slack.com/mcp). The issuer
	// origin is derived from it for metadata discovery.
	ServerURL string
	// ClientID / ClientSecret are the OAuth client credentials (Slack app credentials).
	ClientID     string
	ClientSecret string
	// RedirectURI is the OAuth redirect URI registered in the app.
	RedirectURI string
	// Scopes overrides discovery.scopes_supported. If empty, the server's scopes win.
	Scopes []string
	// RefreshToken is the current refresh token, if any (seeds the flow without a browser).
	RefreshToken string
	// RefreshTokenSecretRef is where to persist a (rotated) refresh token.
	RefreshTokenSecretRef SecretKeyRef
	// AccessTokenSecretRef is the Secret/key the model-router reads as the bearer
	// (referenced by MCPServer.spec.auth.bearerToken).
	AccessTokenSecretRef SecretKeyRef
	// RefreshInterval bounds how often to attempt a refresh when no expires_in is known.
	// A zero value defaults to 50m.
	RefreshInterval time.Duration
}

type CtrlSecretIO struct {
	Client client.Client
}

type K8sSecrets struct {
	Client kubernetes.Interface
}

type Metadata struct {
	AuthorizationEndpoint    string
	TokenEndpoint            string
	GrantTypes               []string
	CodeChallengeMethods     []string
	TokenEndpointAuthMethods []string
	ScopesSupported          []string
	BearerMethods            []string
	AccessTokenSecretRef     SecretKeyRef // where to write access_token
}

type ProtectedResourceMetadata struct {
	AuthorizationServers     []string `json:"authorization_servers"`
	BearerMethodsSupported   []string `json:"bearer_methods_supported"`
	ScopesSupported          []string `json:"scopes_supported"`
	Resource                 string   `json:"resource"`
	TokenEndpointAuthMethods []string `json:"token_endpoint_auth_methods_supported,omitempty"`
}

type SecretIO interface {
	// ReadKey returns the value and whether the key exists.
	ReadKey(ctx context.Context, namespace, name, key string) ([]byte, bool, error)
	// WriteKey creates-or-updates a single key in the Secret.
	WriteKey(ctx context.Context, namespace, name, key string, value []byte) error
}

type SecretKeyRef struct {
	Namespace string
	Name      string
	Key       string
}

type TokenManager struct {
	HTTPClient *http.Client
	Secrets    SecretIO
}

type TokenResponse struct {
	OK           bool   `json:"ok"` // Slack: absent means standard OAuth (treat as success unless error)
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token,omitempty"` // absent => token not rotated; keep existing
	ExpiresIn    int    `json:"expires_in,omitempty"`    // seconds; absent => unknown lifetime
	TokenType    string `json:"token_type,omitempty"`
	Error        string `json:"error,omitempty"` // OAuth error code (e.g. invalid_grant) or Slack error
}