oauthtest

type ClientCredentialsConfig struct {
	// Enabled controls whether the /token endpoint accepts
	// grant_type=client_credentials and returns an access token
	// if client authentication succeeds.
	Enabled bool
}

type ClientInfo struct {
	Secret       string
	RedirectURIs []string
}

type Config struct {
	// The optional path component of the issuer URL.
	// If non-empty, it should start with a "/". It should not end with a "/".
	// It affects the paths of the server endpoints.
	IssuerPath string
	// Configuration of the metadata endpoint.
	MetadataEndpointConfig *MetadataEndpointConfig
	// Configuration for client registration.
	RegistrationConfig *RegistrationConfig
	// JWTBearerConfig enables RFC 7523 JWT Bearer grant at the /token endpoint.
	// If non-nil, the server accepts grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer.
	JWTBearerConfig *JWTBearerConfig
	// ClientCredentialsConfig enables RFC 6749 Section 4.4 client credentials
	// grant at the /token endpoint.
	ClientCredentialsConfig *ClientCredentialsConfig
	// ScopesSupported is an optional list of scopes to advertise in the
	// authorization server metadata.
	ScopesSupported []string
	// TokenScopeFunc, if set, is called with the scope from the authorization
	// request and returns the scope string to include in the token response.
	TokenScopeFunc func(requestedScope string) string
	// AccessTokenTTL, if non-zero, is the expires_in (in seconds) returned by the
	// /token endpoint for both the authorization_code and refresh_token grants.
	// When zero a default of 3600 is used. Set it small to force a client's reuse
	// token source to treat the access token as expired and refresh it.
	AccessTokenTTL int
	// IssueRefreshToken, if true, includes a refresh_token in token responses and
	// enables grant_type=refresh_token at the /token endpoint.
	IssueRefreshToken bool
	// UnadvertiseIssParameter, if true, omits
	// authorization_response_iss_parameter_supported from metadata while the
	// authorize endpoint still includes iss. Used to test local policy for
	// unadvertised RFC 9207 iss.
	UnadvertiseIssParameter bool
}

type FakeAuthorizationServer struct {
	Mux *http.ServeMux
	// contains filtered or unexported fields
}

type FakeIdPServer struct {
	// contains filtered or unexported fields
}

type IdPConfig struct {
	// PreregisteredClients maps client IDs to their info.
	PreregisteredClients map[string]ClientInfo

	// TokenExchangeConfig enables RFC 8693 token exchange at the /token endpoint.
	// If non-nil, the server accepts grant_type=urn:ietf:params:oauth:grant-type:token-exchange.
	TokenExchangeConfig *TokenExchangeConfig
}

type JWTBearerConfig struct {
	// ValidAssertions is the set of assertion values that are accepted.
	// If empty, any non-empty assertion is accepted.
	ValidAssertions []string
}

type MetadataEndpointConfig struct {
	// Whether to serve the OAuth Authorization Server Metadata at
	// /.well-known/oauth-authorization-server + issuerPath.
	ServeOAuthInsertedEndpoint bool
	// Whether to serve the OAuth Authorization Server Metadata at
	// /.well-known/openid-configuration + issuerPath.
	ServeOpenIDInsertedEndpoint bool
	// Whether to serve the OAuth Authorization Server Metadata at
	// issuerPath + /.well-known/openid-configuration.
	// Should be used when issuerPath is not empty.
	ServeOpenIDAppendedEndpoint bool
}

type RegistrationConfig struct {
	// Whether the client ID metadata document is supported.
	ClientIDMetadataDocumentSupported bool
	// PreregisteredClients is a map of valid ClientIDs to ClientSecrets.
	PreregisteredClients map[string]ClientInfo
	// Whether dynamic client registration is enabled.
	DynamicClientRegistrationEnabled bool
}

type TokenExchangeConfig struct {
	// IDJAGToken is the ID-JAG value returned from token exchange.
	// Defaults to "test-id-jag-token" if empty.
	IDJAGToken string
}