auth

type Auth struct {
	// contains filtered or unexported fields
}

type Client struct {
	ID           string
	Name         string
	URI          string
	RedirectURIs []string
	CreatedAt    time.Time
}

type Code struct {
	Hash        string
	ClientID    string
	GitHubID    int64
	RedirectURI string
	Challenge   string // PKCE S256 code challenge
	Scope       string
	Resource    string
	ExpiresAt   time.Time
}

type Grant struct {
	ID          string
	ClientID    string
	ClientName  string
	GitHubID    int64
	RedirectURI string
	Scope       string // space-separated
	Resource    string // audience of its access tokens
	CreatedAt   time.Time
	LastUsedAt  *time.Time
}

type OAuth interface {
	// AuthorizeURL returns the GitHub page that asks the user to sign in.
	AuthorizeURL(redirectURL, state string) string
	// ExchangeUser trades an authorization code for the signed-in user.
	ExchangeUser(ctx context.Context, code, redirectURL string) (github.User, error)
}

type OAuthStore interface {
	// CreateClient stores a client and returns it with its ID and creation
	// time.
	CreateClient(ctx context.Context, c Client) (Client, error)
	// Client returns a registered client, and whether it exists.
	Client(ctx context.Context, id string) (Client, bool, error)
	// CountClients returns the number of registered clients.
	CountClients(ctx context.Context) (int, error)
	// CreateCode stores an authorization code.
	CreateCode(ctx context.Context, c Code) error
	// RedeemCode spends the unexpired code with the given hash. issue
	// validates it and returns the grant and tokens to create; its error is
	// returned and the code is spent anyway. It reports false if the code is
	// unknown or expired. Redeeming a code twice revokes the grant it
	// produced and returns ErrReplayed.
	RedeemCode(ctx context.Context, hash string, issue func(Code) (Grant, []Token, error)) (Grant, bool, error)
	// RotateRefreshToken spends the unexpired refresh token with the given
	// hash. issue validates its grant and user and returns the tokens that
	// replace it; if it fails, nothing changes. It reports false if the
	// token is unknown or expired. Presenting a rotated token revokes its
	// grant and returns ErrReplayed.
	RotateRefreshToken(ctx context.Context, hash string, issue func(Grant, User) ([]Token, error)) (Grant, bool, error)
	// AccessToken returns the grant and user of an unexpired access token,
	// and whether it exists.
	AccessToken(ctx context.Context, hash string) (Grant, User, bool, error)
	// TouchGrant records that a grant was used at the given time.
	TouchGrant(ctx context.Context, id string, at time.Time) error
	// Grants returns a user's live grants, newest first.
	Grants(ctx context.Context, githubID int64) ([]Grant, error)
	// DeleteGrant revokes a user's grant, reporting whether it existed.
	DeleteGrant(ctx context.Context, id string, githubID int64) (bool, error)
	// RevokeToken revokes the grant of a token, if the token was issued to
	// clientID or clientID is empty.
	RevokeToken(ctx context.Context, hash, clientID string) error
	// DeleteExpiredOAuth removes expired codes and tokens, dead grants, and
	// clients created before staleBefore that were never used.
	DeleteExpiredOAuth(ctx context.Context, staleBefore time.Time) error
	// DeleteDisallowedGrants revokes grants and codes of logins outside
	// allowed.
	DeleteDisallowedGrants(ctx context.Context, allowed []string) error
}

type Store interface {
	// UpsertUser creates the user or updates its profile.
	UpsertUser(ctx context.Context, u User) error
	// CreateSession stores a session that expires at the given time.
	CreateSession(ctx context.Context, tokenHash string, githubID int64, expires time.Time) error
	// SessionUser returns the user of an unexpired session, and whether the
	// session exists.
	SessionUser(ctx context.Context, tokenHash string) (User, bool, error)
	// DeleteSession removes a session.
	DeleteSession(ctx context.Context, tokenHash string) error
	// DeleteDisallowedSessions removes sessions for logins outside allowed.
	DeleteDisallowedSessions(ctx context.Context, allowed []string) error

	OAuthStore
}

type Token struct {
	Hash      string
	Refresh   bool
	ExpiresAt time.Time
}

type User struct {
	GitHubID  int64
	Login     string
	Name      string
	AvatarURL string
}