auth

type Credentials struct {
	Username string
	Password string
	Token    string

	// Identity is a display name for the authenticated principal, for
	// example the e-mail claim of an OIDC token.
	Identity string
	// Expiry is when Token stops being valid; zero if unknown or not applicable.
	Expiry time.Time
}

type Endpoints struct {
	Authorization string
	Token         string
	Device        string
	// Discovered is true when OIDC discovery succeeded.
	Discovered bool
}

type FileStore struct {
	Dir string
}

type JWTProvider struct {
	Token string
	// contains filtered or unexported fields
}

type LoginRequiredError struct {
	Profile string
}

type OIDCConfig struct {
	// Label names the provider in messages ("Google OAuth", "OIDC").
	Label string
	// Profile is the connection profile, used in the login hint.
	Profile string
	// CacheKey names the token cache entry.
	CacheKey string

	ClientID     string
	ClientSecret string // optional: public clients rely on PKCE alone
	Issuer       string
	// AuthURL, TokenURL and DeviceURL override the endpoints found through
	// OIDC discovery. Without an Issuer they are the only source.
	AuthURL   string
	TokenURL  string
	DeviceURL string

	Audience      string
	Scopes        []string
	UsernameClaim string
	RedirectURI   string
	Flow          string
	TokenType     string
	// AuthParams are extra authorization request parameters.
	AuthParams map[string]string
}

type OIDCProvider struct {
	// contains filtered or unexported fields
}

type Options struct {
	// Interactive permits opening a browser and waiting for the user.
	Interactive bool
	// Out receives messages for the user during login.
	Out io.Writer
	// Store persists OAuth tokens between runs.
	Store TokenStore
	// OpenBrowser opens a URL in the user's browser.
	OpenBrowser func(url string) error
	// HTTPClient is used for all requests to the identity provider.
	HTTPClient *http.Client
}

type PasswordProvider struct {
	Username string
	Password string
}

type Provider interface {
	Authenticate(ctx context.Context) (*Credentials, error)
}

type SessionProvider interface {
	Provider
	// Login runs the interactive login flow even if cached tokens exist.
	Login(ctx context.Context) (*Credentials, error)
	// Logout forgets all cached tokens.
	Logout() error
	// Status describes the cached session without contacting the provider.
	Status() (Status, error)
}

type Status struct {
	LoggedIn    bool
	Identity    string
	Expiry      time.Time
	Refreshable bool
	Storage     string
}

type TokenSet struct {
	AccessToken  string    `json:"access_token,omitempty"`
	IDToken      string    `json:"id_token,omitempty"`
	RefreshToken string    `json:"refresh_token,omitempty"`
	AccessExpiry time.Time `json:"access_expiry,omitempty"`
	IDExpiry     time.Time `json:"id_expiry,omitempty"`
	Identity     string    `json:"identity,omitempty"`

	// Fingerprint identifies the provider configuration the tokens were
	// issued for, so that editing a profile invalidates its cached session.
	Fingerprint string `json:"fingerprint"`

	// Storage says where the set was loaded from or saved to.
	Storage string `json:"-"`
}

type TokenStore interface {
	// Load returns the token set stored under key, or nil if there is none.
	Load(key string) (*TokenSet, error)
	Save(key string, ts *TokenSet) error
	Delete(key string) error
}