lfxv2

type AccessCheckClient struct {
	// contains filtered or unexported fields
}

type ClientConfig struct {
	// APIDomain is the LFX API base domain.
	APIDomain string

	// HTTPClient is the HTTP client to use for API calls.
	// If nil, a default client with 30s timeout will be created.
	HTTPClient *http.Client

	// TokenExchangeClient is the RFC 8693 OAuth2 token exchange client.
	// If provided, the client will automatically exchange MCP tokens (from request context)
	// for target API tokens.
	TokenExchangeClient *TokenExchangeClient

	// DebugLogger is used for debug-level HTTP request/response logging.
	// If nil, debug logging is disabled.
	DebugLogger *slog.Logger
}

type ClientCredentialsClient struct {
	// contains filtered or unexported fields
}

type ClientCredentialsConfig struct {
	// TokenEndpoint is the OAuth2 token endpoint URL (e.g., "https://example.auth0.com/oauth/token").
	TokenEndpoint string

	// ClientID is the M2M client ID.
	ClientID string

	// ClientSecret is the M2M client secret.
	// Ignored if ClientAssertionSigningKey is provided.
	ClientSecret string

	// ClientAssertionSigningKey is the PEM-encoded RSA private key for generating client assertions.
	// If provided, this takes precedence over ClientSecret for client authentication.
	ClientAssertionSigningKey string

	// Audience is the resource server identifier (the "aud" claim in the issued token).
	Audience string

	// HTTPClient is the HTTP client to use. If nil, a default client with 30s timeout is created.
	HTTPClient *http.Client
}

type Clients struct {
	Committee   *committeeservice.Client
	MailingList *mailinglist.Client
	Member      *memberservice.Client
	Project     *projectservice.Client
	QuerySvc    *querysvc.Client
	// contains filtered or unexported fields
}

type SlugResolver struct {
	// contains filtered or unexported fields
}

type TokenExchangeClient struct {
	// contains filtered or unexported fields
}

type TokenExchangeConfig struct {
	// TokenEndpoint is the OAuth2 token endpoint URL (e.g., "https://example.auth0.com/oauth/token").
	TokenEndpoint string

	// ClientID is the M2M client ID for token exchange.
	ClientID string

	// ClientSecret is the M2M client secret for token exchange.
	// Ignored if ClientAssertionSigningKey is provided.
	ClientSecret string

	// ClientAssertionSigningKey is the PEM-encoded RSA private key for generating client assertions.
	// If provided, this takes precedence over ClientSecret for client authentication.
	// The key is used to sign a JWT assertion per RFC 7523.
	ClientAssertionSigningKey string

	// SubjectTokenType is the token type of the incoming subject token (e.g., LFX MCP API identifier).
	SubjectTokenType string

	// Audience is the target audience for the exchanged token (e.g., LFX V2 API identifier).
	Audience string

	// HTTPClient is the HTTP client to use for token exchange.
	// If nil, a default client with 30s timeout will be created.
	HTTPClient *http.Client
}

type TokenExchangeResponse struct {
	AccessToken     string `json:"access_token"`
	IssuedTokenType string `json:"issued_token_type,omitempty"`
	TokenType       string `json:"token_type"`
	ExpiresIn       int    `json:"expires_in"`
	Scope           string `json:"scope,omitempty"`
	RefreshToken    string `json:"refresh_token,omitempty"`
}