oidc

type Config struct {
	IssuerURL    string
	ClientID     string
	ClientSecret string
	RedirectURI  string
	Scopes       []string // defaults to {"openid","email","profile"}
	// AccessType, when non-empty, is sent as the `access_type` auth-code request
	// parameter. Set to "offline" so Google issues a refresh token (the
	// "offline_access" scope alone is insufficient for Google). Other providers
	// ignore the parameter, so requesting it is safe and makes refresh capture
	// work across IdPs.
	AccessType    string
	PKCE          bool // default true
	ClaimMappings struct {
		UserID string // default "sub"
		Groups string // default "groups"
		Email  string // default "email"
	}
}

type IDTokenPrincipal struct {
	Subject    string         // sub
	Issuer     string         // iss — used to resolve the federated tenant
	UserID     string         // mapped from ClaimMappings.UserID
	Email      string         // mapped from ClaimMappings.Email
	Groups     []string       // mapped from ClaimMappings.Groups
	Claims     map[string]any // raw verified claims
	RawIDToken string         // the raw id_token (logging/auditing only)
	// RefreshToken is the refresh_token returned alongside the id_token (if any).
	// It lets the caller (e.g. the aoctl CLI) refresh the session without
	// re-prompting for IdP credentials. The server-side browser flow does not
	// need it and ignores it; it is purely a CLI convenience.
	RefreshToken string
}

type PrincipalProvider interface {
	// AuthCodeURL returns the IdP login URL and the PKCE code_verifier (empty when
	// PKCE is disabled). nonce is the OIDC nonce bound to the ID token.
	AuthCodeURL(state, nonce string) (authURL, codeVerifier string)
	// ExchangeAndVerify exchanges the auth code for tokens, verifies the ID token
	// (signature via JWKS, iss, aud, exp/nbf, nonce) and returns the resolved
	// principal.
	ExchangeAndVerify(ctx context.Context, code, nonce, codeVerifier string) (*IDTokenPrincipal, error)
}

type Provider struct {
	// contains filtered or unexported fields
}