providers

type BaseConfig struct {
	ClientID     string   `json:"client_id"`
	ClientSecret string   `json:"client_secret"`
	RedirectURL  string   `json:"redirect_url"`
	Scopes       []string `json:"scopes,omitempty"`
}

type BaseProvider struct {
	// contains filtered or unexported fields
}

type CustomClaims struct {
	Claims map[string]any
}

type GitHubConfig struct {
	BaseConfig

	// Organization restricts login to members of specific GitHub orgs (optional)
	AllowedOrgs []string `json:"allowed_orgs,omitempty"`

	// Teams restricts login to members of specific teams (format: "org/team")
	AllowedTeams []string `json:"allowed_teams,omitempty"`

	// GitHub Enterprise support (optional)
	EnterpriseURL string `json:"enterprise_url,omitempty"`
}

type GitHubProvider struct {
	BaseProvider
	// contains filtered or unexported fields
}

type GitHubProviderConfig struct {
	*ProviderConfig
	TeamWhitelist []string // List of org or org/team to check membership
	UserOrgURL    string   // URL template for checking org membership
	UserTeamURL   string   // URL template for checking team membership
}

type GitHubTeamMembershipState struct {
	State string `json:"state"` // "active" or "pending"
	Role  string `json:"role"`  // "member" or "maintainer"
}

type GitHubUserInfo struct {
	ID        int    `json:"id"`
	Login     string `json:"login"`
	Name      string `json:"name"`
	Email     string `json:"email"`
	AvatarURL string `json:"avatar_url"`
	HTMLURL   string `json:"html_url"`
	Type      string `json:"type"`
	Company   string `json:"company"`
	Blog      string `json:"blog"`
	Location  string `json:"location"`
	Bio       string `json:"bio"`
}

type GoogleConfig struct {
	BaseConfig

	// HostedDomain restricts login to a specific G Suite domain (optional)
	HostedDomain string `json:"hosted_domain,omitempty"`
}

type GoogleProvider struct {
	BaseProvider
}

type GoogleUserInfo struct {
	Sub           string `json:"sub"`
	Email         string `json:"email"`
	EmailVerified bool   `json:"email_verified"`
	Name          string `json:"name"`
	GivenName     string `json:"given_name"`
	FamilyName    string `json:"family_name"`
	Picture       string `json:"picture"`
	Locale        string `json:"locale"`
	HostDomain    string `json:"hd"` // G Suite domain
}

type OpenIDConfig struct {
	BaseConfig

	// IssuerURL is used for OIDC discovery (/.well-known/openid-configuration)
	IssuerURL string `json:"issuer_url"`

	// Optional: explicit URLs if discovery is not available
	AuthURL     string `json:"auth_url,omitempty"`
	TokenURL    string `json:"token_url,omitempty"`
	UserInfoURL string `json:"userinfo_url,omitempty"`

	// Optional: claims to extract from the ID token or userinfo response
	ClaimsToExtract []string `json:"claims_to_extract,omitempty"`
}

type OpenIDDiscoveryConfig struct {
	Issuer                string   `json:"issuer"`
	AuthorizationEndpoint string   `json:"authorization_endpoint"`
	TokenEndpoint         string   `json:"token_endpoint"`
	UserinfoEndpoint      string   `json:"userinfo_endpoint"`
	JwksURI               string   `json:"jwks_uri"`
	ScopesSupported       []string `json:"scopes_supported"`
	ClaimsSupported       []string `json:"claims_supported"`
}

type OpenIDProvider struct {
	BaseProvider
	// contains filtered or unexported fields
}

type Provider interface {
	// Name returns the provider identifier (e.g., "google", "github", "openid").
	Name() string

	// Configure initializes the provider with the given configuration.
	Configure(cfg *ProviderConfig) error

	// GetUserInfo exchanges the authorization code for tokens and retrieves user information.
	GetUserInfo(ctx context.Context, r *http.Request, opts ...oauth2.AuthCodeOption) (*UserInfo, *ProviderTokens, error)
}

type ProviderConfig struct {
	// OAuth2 configuration
	ClientID     string
	ClientSecret string
	RedirectURL  string
	Scopes       []string

	// Provider-specific URLs (some providers use discovery, others need explicit URLs)
	AuthURL     string
	TokenURL    string
	UserInfoURL string

	// For OIDC providers
	IssuerURL string

	// Optional: claims to extract from the ID token or userinfo response
	ClaimsToExtract []string

	// Logger
	Logger *zap.Logger
}

type ProviderTokens struct {
	AccessToken  string
	RefreshToken string
	IDToken      string
	TokenType    string
	Expiry       int64 // Unix timestamp
}

type UserInfo struct {
	// Standard claims
	Subject       string `json:"sub"`
	Email         string `json:"email"`
	EmailVerified bool   `json:"email_verified"`
	Name          string `json:"name"`
	Username      string `json:"username,omitempty"`
	Picture       string `json:"picture,omitempty"`

	// Provider-specific identifier
	ProviderUserID string `json:"-"`

	// Raw claims from the provider (for custom claim extraction)
	RawClaims map[string]any `json:"-"`
}