oidc

type AuthURLOption func(*AuthURLOptions)

type AuthURLOptions struct {
	RedirectURI string
	Scopes      []string
	Nonce       string
	PKCE        *PKCE
	ExtraParams map[string]string
}

type Config struct {
	// Enabled controls whether OIDC verification is active.
	Enabled bool `mapstructure:"enabled"`

	// Issuer is the OIDC provider's issuer URL (e.g., "https://accounts.google.com").
	// Used for auto-discovery of JWKS endpoint, authorization endpoint, etc.
	Issuer string `mapstructure:"issuer"`

	// ClientID is the OAuth2 client ID (also used as expected "aud" claim).
	ClientID string `mapstructure:"client_id"`

	// ClientSecret is the OAuth2 client secret (for confidential clients).
	ClientSecret string `mapstructure:"client_secret"`

	// RedirectURL is the OAuth2 callback URL.
	RedirectURL string `mapstructure:"redirect_url"`

	// Scopes are the OAuth2 scopes to request (default: ["openid", "email", "profile"]).
	Scopes []string `mapstructure:"scopes"`

	// SupportedSigningAlgs restricts allowed ID token signing algorithms (default: ["RS256"]).
	SupportedSigningAlgs []string `mapstructure:"supported_signing_algs"`

	// JWKSCacheDuration controls how long JWKS keys are cached (default: "1h").
	JWKSCacheDuration time.Duration `mapstructure:"jwks_cache_duration"`

	// HTTPTimeout is the timeout for discovery and JWKS HTTP requests (default: "10s").
	HTTPTimeout time.Duration `mapstructure:"http_timeout"`

	// SkipIssuerCheck skips issuer validation (for testing only).
	SkipIssuerCheck bool `mapstructure:"skip_issuer_check"`
}

type DiscoveryEndpoints struct {
	Authorization string
	Token         string
	UserInfo      string
	JWKS          string
}

type ExchangeOption func(*ExchangeOptions)

type ExchangeOptions struct {
	RedirectURI  string
	CodeVerifier string
}

type IDToken struct {
	// Issuer is the "iss" claim.
	Issuer string

	// Subject is the "sub" claim (provider's unique user ID).
	Subject string

	// Audience is the "aud" claim.
	Audience []string

	// ExpiresAt is the "exp" claim.
	ExpiresAt time.Time

	// IssuedAt is the "iat" claim.
	IssuedAt time.Time

	// Nonce is the "nonce" claim (for replay protection).
	Nonce string

	// Claims holds all token claims for project-specific extraction.
	Claims map[string]interface{}
}

type PKCE struct {
	// CodeVerifier is the random secret (kept by the client, sent during exchange).
	CodeVerifier string

	// CodeChallenge is the SHA-256 hash of the verifier (sent in the auth URL).
	CodeChallenge string

	// CodeChallengeMethod is always "S256".
	CodeChallengeMethod string
}

type Provider interface {
	// Name returns the provider identifier (e.g., "google", "github").
	Name() string

	// AuthURL returns the authorization URL for initiating the OAuth2 flow.
	// The state parameter should be a cryptographically random value for CSRF protection.
	// Options allow passing additional parameters (PKCE, nonce, login_hint, etc.).
	AuthURL(state string, opts ...AuthURLOption) string

	// Exchange trades an authorization code for tokens.
	// Returns the token set (access, refresh, ID token if OIDC) and user information.
	Exchange(ctx context.Context, code string, opts ...ExchangeOption) (*TokenResult, error)

	// UserInfo fetches the user's profile from the provider using an access token.
	// Not all providers support this endpoint (GitHub uses a different API).
	UserInfo(ctx context.Context, accessToken string) (*UserInfo, error)
}

type TokenResult struct {
	// AccessToken is the OAuth2 access token.
	AccessToken string

	// RefreshToken is the OAuth2 refresh token (may be empty).
	RefreshToken string

	// IDToken is the raw OIDC ID token JWT string (empty for non-OIDC providers).
	IDToken string

	// TokenType is typically "Bearer".
	TokenType string

	// ExpiresAt is when the access token expires.
	ExpiresAt time.Time

	// Scopes are the granted scopes (may differ from requested).
	Scopes []string
}

type UserInfo struct {
	// Subject is the provider's unique identifier for the user.
	Subject string `json:"sub"`

	// Email is the user's email address (may be empty if not in scope).
	Email string `json:"email,omitempty"`

	// EmailVerified indicates if the provider has verified the email.
	EmailVerified bool `json:"email_verified,omitempty"`

	// Name is the user's full display name.
	Name string `json:"name,omitempty"`

	// GivenName is the user's first name.
	GivenName string `json:"given_name,omitempty"`

	// FamilyName is the user's last name.
	FamilyName string `json:"family_name,omitempty"`

	// Picture is a URL to the user's profile picture.
	Picture string `json:"picture,omitempty"`

	// Locale is the user's locale (e.g., "en-US").
	Locale string `json:"locale,omitempty"`

	// Raw holds all claims from the provider for project-specific extraction.
	Raw map[string]interface{} `json:"raw,omitempty"`
}

type Verifier struct {
	// contains filtered or unexported fields
}

type VerifierConfig struct {
	// ClientID is the expected "aud" claim in the ID token (required).
	ClientID string

	// SkipExpiryCheck skips the expiry validation (for testing only).
	SkipExpiryCheck bool

	// SkipIssuerCheck skips the issuer validation.
	SkipIssuerCheck bool

	// SupportedSigningAlgs restricts allowed signing algorithms.
	// Default: ["RS256"].
	SupportedSigningAlgs []string

	// HTTPClient is an optional HTTP client for discovery and JWKS requests.
	// Useful for testing or custom TLS configurations.
	HTTPClient *http.Client

	// JWKSCacheDuration controls how long JWKS keys are cached (default: 1h).
	JWKSCacheDuration time.Duration
}