oidcprovider

type Authentication struct {
	UserID   string
	AuthTime time.Time
	// Fresh may only be set by a trusted host after it has verified a new
	// authentication ceremony for this authorization request. It satisfies
	// prompt=login and max_age even when AuthTime has second-level precision.
	Fresh bool
	// AuthID identifies a credential-verified authentication ceremony.
	// Federated sessions without upstream reauthentication proof leave it empty.
	AuthID string
}

type AuthorizationAction string

type AuthorizationClient struct {
	ID     string `json:"id"`
	Name   string `json:"name"`
	Public bool   `json:"public"`
}

type AuthorizationCode struct {
	Hash                string
	GrantID             string
	UserID              string
	ClientID            string
	RedirectURI         string
	Scopes              []string
	Nonce               string
	CodeChallenge       string
	CodeChallengeMethod string
	ExpiresAt           time.Time
	AuthTime            time.Time
	Used                bool
}

type AuthorizationCodeExchange struct {
	CodeHash     string
	ClientID     string
	RedirectURI  string
	CodeVerifier string
	Now          time.Time
	AccessToken  *Token
	RefreshToken *Token
}

type AuthorizationDecision struct {
	Action AuthorizationAction
	Client AuthorizationClient
	Scopes []string
}

type AuthorizeRequest struct {
	Request             string
	RequestURI          string
	IDTokenHint         string
	ClientID            string
	RedirectURI         string
	ResponseType        string
	ResponseMode        string
	Scope               []string
	State               string
	Nonce               string
	CodeChallenge       string
	CodeChallengeMethod string
	Prompt              []string
	MaxAge              *time.Duration
}

type AuthorizeResult struct {
	Code         string
	RedirectURI  string
	State        string
	Issuer       string
	ResponseMode string
}

type Client struct {
	ID                      string
	Name                    string
	SecretHash              string
	RedirectURIs            []string
	Scopes                  []string
	GrantTypes              []string
	TokenEndpointAuthMethod ClientAuthenticationMethod
	RequirePKCE             bool
	Public                  bool
	Enabled                 bool
}

type ClientAuthenticationMethod string

type Config struct {
	Issuer                  string
	AuthorizationCodeTTL    time.Duration
	AccessTokenTTL          time.Duration
	RefreshTokenTTL         time.Duration
	RefreshTokenMaxLifetime time.Duration
	IDTokenTTL              time.Duration
	Store                   Store
	Users                   UserResolver
	Signer                  SigningKeyProvider
	Now                     func() time.Time
	AllowInsecureIssuer     bool
	Random                  io.Reader
	SupportedScopes         []string
}

type Consent struct {
	UserID   string
	ClientID string
	Scopes   []string
}

type DiscoveryMetadata struct {
	Issuer                            string   `json:"issuer"`
	AuthorizationEndpoint             string   `json:"authorization_endpoint"`
	TokenEndpoint                     string   `json:"token_endpoint"`
	UserinfoEndpoint                  string   `json:"userinfo_endpoint"`
	JWKSEndpoint                      string   `json:"jwks_uri"`
	RevocationEndpoint                string   `json:"revocation_endpoint"`
	ResponseTypesSupported            []string `json:"response_types_supported"`
	SubjectTypesSupported             []string `json:"subject_types_supported"`
	IDTokenSigningAlgValues           []string `json:"id_token_signing_alg_values_supported"`
	ScopesSupported                   []string `json:"scopes_supported"`
	ClaimsSupported                   []string `json:"claims_supported"`
	GrantTypesSupported               []string `json:"grant_types_supported"`
	CodeChallengeMethodsSupported     []string `json:"code_challenge_methods_supported"`
	TokenEndpointAuthMethods          []string `json:"token_endpoint_auth_methods_supported"`
	ResponseModesSupported            []string `json:"response_modes_supported"`
	AuthorizationResponseISSSupported bool     `json:"authorization_response_iss_parameter_supported"`
	RevocationEndpointAuthMethods     []string `json:"revocation_endpoint_auth_methods_supported"`
	RequestParameterSupported         bool     `json:"request_parameter_supported"`
	RequestURIParameterSupported      bool     `json:"request_uri_parameter_supported"`
	ClaimsParameterSupported          bool     `json:"claims_parameter_supported"`
}

type IDTokenClaims struct {
	Issuer            string `json:"iss"`
	Subject           string `json:"sub"`
	Audience          string `json:"aud"`
	ExpiresAt         int64  `json:"exp"`
	IssuedAt          int64  `json:"iat"`
	AuthTime          int64  `json:"auth_time,omitempty"`
	Nonce             string `json:"nonce,omitempty"`
	Name              string `json:"name,omitempty"`
	PreferredUsername string `json:"preferred_username,omitempty"`
	Email             string `json:"email,omitempty"`
	EmailVerified     *bool  `json:"email_verified,omitempty"`
	Picture           string `json:"picture,omitempty"`
}

type IDTokenSigner interface {
	SignIDToken(context.Context, IDTokenClaims) (string, error)
}

type JWK struct {
	KTY string `json:"kty"`
	Use string `json:"use,omitempty"`
	Alg string `json:"alg,omitempty"`
	Kid string `json:"kid"`
	N   string `json:"n,omitempty"`
	E   string `json:"e,omitempty"`
	X   string `json:"x,omitempty"`
	Y   string `json:"y,omitempty"`
}

type JWKSet struct {
	Keys []JWK `json:"keys"`
}

type MemoryStore struct {
	// contains filtered or unexported fields
}

type OAuthError struct {
	Code            string
	Description     string
	URI             string
	Cause           error
	RedirectAllowed bool
	RedirectURI     string
	State           string
	ResponseMode    string
}

type Provider struct {
	// contains filtered or unexported fields
}

type PublicKeyProvider interface {
	PublicKeys(context.Context) ([]JWK, error)
}

type PurgeRequest struct {
	Now           time.Time
	RevokedBefore time.Time
}

type PurgeResult struct {
	AuthorizationCodes int
	AccessTokens       int
	RefreshTokens      int
}

type RSAKeySet struct {
	// contains filtered or unexported fields
}

type RefreshTokenRotation struct {
	OldHash      string
	ClientID     string
	Now          time.Time
	AccessToken  *Token
	RefreshToken *Token
}

type SigningKeyProvider interface {
	IDTokenSigner
	PublicKeyProvider
}

type Store interface {
	GetClient(context.Context, string) (*Client, error)
	GetConsent(context.Context, string, string) (*Consent, error)
	SaveConsent(context.Context, *Consent) error
	SaveAuthorizationCode(context.Context, *AuthorizationCode) error
	GetAuthorizationCode(context.Context, string) (*AuthorizationCode, error)
	ExchangeAuthorizationCode(context.Context, AuthorizationCodeExchange) error
	GetAccessToken(context.Context, string) (*Token, error)
	GetRefreshToken(context.Context, string) (*Token, error)
	RotateRefreshToken(context.Context, RefreshTokenRotation) error
	RevokeToken(context.Context, string, string, time.Time) error
	RevokeTokenFamily(context.Context, string, time.Time) error
	RevokeGrant(context.Context, string, string, time.Time) error
	RevokeAuthorizationCodeGrant(context.Context, string, time.Time) error
	Purge(context.Context, PurgeRequest) (PurgeResult, error)
}

type Token struct {
	Hash            string
	GrantID         string
	FamilyID        string
	UserID          string
	ClientID        string
	Scopes          []string
	ExpiresAt       time.Time
	FamilyExpiresAt time.Time
	RevokedAt       *time.Time
	AuthTime        time.Time
}

type TokenRequest struct {
	GrantType    string
	Code         string
	RefreshToken string
	ClientID     string
	ClientSecret string
	AuthMethod   ClientAuthenticationMethod
	RedirectURI  string
	CodeVerifier string
	Scope        []string
}

type TokenResponse struct {
	AccessToken  string
	TokenType    string
	ExpiresIn    int64
	IDToken      string
	RefreshToken string
	Scope        []string
}

type TokenRevocationRequest struct {
	Token         string
	ClientID      string
	ClientSecret  string
	AuthMethod    ClientAuthenticationMethod
	TokenTypeHint string
}

type User struct {
	Subject           string
	Name              string
	PreferredUsername string
	Email             string
	EmailVerified     bool
	Picture           string
}

type UserInfoClaims struct {
	Subject           string `json:"sub"`
	Name              string `json:"name,omitempty"`
	PreferredUsername string `json:"preferred_username,omitempty"`
	Email             string `json:"email,omitempty"`
	EmailVerified     *bool  `json:"email_verified,omitempty"`
	Picture           string `json:"picture,omitempty"`
}

type UserResolver interface {
	ResolveUser(context.Context, string) (*User, error)
}