plugin

type AuthHandlerGRPCClient struct {
	// contains filtered or unexported fields
}

type AuthHandlerGRPCPlugin struct {
	goplugin.Plugin
	Impl AuthHandlerPlugin
}

type AuthHandlerGRPCServer struct {
	proto.UnimplementedAuthHandlerServiceServer
	Impl AuthHandlerPlugin
	// contains filtered or unexported fields
}

type AuthHandlerInfo struct {
	Name         string            `json:"name" yaml:"name"`
	DisplayName  string            `json:"displayName" yaml:"displayName"`
	Flows        []auth.Flow       `json:"flows" yaml:"flows"`
	Capabilities []auth.Capability `json:"capabilities" yaml:"capabilities"`
}

type AuthHandlerPlugin interface {
	GetAuthHandlers(ctx context.Context) ([]AuthHandlerInfo, error)
	ConfigureAuthHandler(ctx context.Context, handlerName string, cfg ProviderConfig) error
	Login(ctx context.Context, handlerName string, req LoginRequest, deviceCodeCb func(DeviceCodePrompt)) (*LoginResponse, error)
	Logout(ctx context.Context, handlerName string, req LogoutRequest) error
	GetStatus(ctx context.Context, handlerName string, req StatusRequest) (*auth.Status, error)
	GetToken(ctx context.Context, handlerName string, req TokenRequest) (*TokenResponse, error)
	// ListCachedTokens enumerates the handler's cached tokens. Handlers that
	// advertise auth.CapInstanceHostname SHOULD return one entry per live
	// instance, each with CachedTokenInfo.Hostname set to that instance.
	ListCachedTokens(ctx context.Context, handlerName string) ([]*auth.CachedTokenInfo, error)
	PurgeExpiredTokens(ctx context.Context, handlerName string) (int, error)
	DetectAvailableFlows(ctx context.Context, handlerName string) ([]FlowAvailability, error)
	StopAuthHandler(ctx context.Context, handlerName string) error
}

type DeviceCodePrompt struct {
	UserCode        string `json:"userCode" yaml:"userCode"`
	VerificationURI string `json:"verificationUri" yaml:"verificationUri"`
	Message         string `json:"message" yaml:"message"`
}

type FlowAvailability struct {
	Flow      auth.Flow `json:"flow" yaml:"flow"`           // flow name (e.g., "device_code", "pat", "service_principal")
	Available bool      `json:"available" yaml:"available"` // true if environment credentials exist for this flow
	Reason    string    `json:"reason" yaml:"reason"`       // human-readable explanation (e.g., "GITHUB_TOKEN is set")
}

type GRPCClient struct {
	// contains filtered or unexported fields
}

type GRPCPlugin struct {
	goplugin.Plugin
	Impl ProviderPlugin
}

type GRPCServer struct {
	proto.UnimplementedPluginServiceServer
	Impl ProviderPlugin
	// contains filtered or unexported fields
}

type HandshakeConfigData struct {
	ProtocolVersion  uint   `json:"protocolVersion" yaml:"protocolVersion"`
	MagicCookieKey   string `json:"magicCookieKey" yaml:"magicCookieKey"`
	MagicCookieValue string `json:"magicCookieValue" yaml:"magicCookieValue"`
}

type HostServiceClient struct {
	// contains filtered or unexported fields
}

type LoginRequest struct {
	TenantID string        `json:"tenantId,omitempty" yaml:"tenantId,omitempty"`
	Scopes   []string      `json:"scopes,omitempty" yaml:"scopes,omitempty"`
	Flow     auth.Flow     `json:"flow,omitempty" yaml:"flow,omitempty"`
	Timeout  time.Duration `json:"timeout,omitempty" yaml:"timeout,omitempty"`
	// Hostname selects a specific instance (e.g. a cluster or server) for
	// handlers that advertise auth.CapHostname.
	Hostname string `json:"hostname,omitempty" yaml:"hostname,omitempty"`
	// CallbackPort requests a specific loopback port for the OAuth callback
	// server, for handlers that advertise auth.CapCallbackPort. A zero value
	// preserves the handler's default (ephemeral or config-driven) behavior.
	// When set, it is expected to be an unprivileged, in-range TCP port
	// (1024-65535); the host is responsible for validating the value before
	// sending it, and handlers should treat out-of-range values as unset.
	CallbackPort int `json:"callbackPort,omitempty" yaml:"callbackPort,omitempty"`
}

type LoginResponse struct {
	Claims    *auth.Claims `json:"claims,omitempty" yaml:"claims,omitempty"`
	ExpiresAt time.Time    `json:"expiresAt,omitempty" yaml:"expiresAt,omitempty"`
}

type LoginStreamMessage struct {
	DeviceCodePrompt *DeviceCodePrompt `json:"deviceCodePrompt,omitempty" yaml:"deviceCodePrompt,omitempty"`
	Result           *LoginResponse    `json:"result,omitempty" yaml:"result,omitempty"`
	Error            string            `json:"error,omitempty" yaml:"error,omitempty"`
}

type LogoutRequest struct {
	// Hostname selects a specific instance (e.g. a cluster or server) for
	// handlers that advertise auth.CapInstanceHostname.
	Hostname string `json:"hostname,omitempty" yaml:"hostname,omitempty"`
}

type ProviderConfig struct {
	Quiet         bool                       `json:"quiet" yaml:"quiet"`
	NoColor       bool                       `json:"noColor" yaml:"noColor"`
	BinaryName    string                     `json:"binaryName" yaml:"binaryName"`
	HostServiceID uint32                     `json:"hostServiceId,omitempty" yaml:"hostServiceId,omitempty"`
	Profile       string                     `json:"profile,omitempty" yaml:"profile,omitempty"`
	Settings      map[string]json.RawMessage `json:"settings,omitempty" yaml:"settings,omitempty"`
}

type ProviderPlugin interface {
	GetProviders(ctx context.Context) ([]string, error)
	GetProviderDescriptor(ctx context.Context, providerName string) (*provider.Descriptor, error)
	ConfigureProvider(ctx context.Context, providerName string, cfg ProviderConfig) error
	ExecuteProvider(ctx context.Context, providerName string, input map[string]any) (*provider.Output, error)
	ExecuteProviderStream(ctx context.Context, providerName string, input map[string]any, cb func(StreamChunk)) error
	DescribeWhatIf(ctx context.Context, providerName string, input map[string]any) (string, error)
	ExtractDependencies(ctx context.Context, providerName string, inputs map[string]any) ([]string, error)
	StopProvider(ctx context.Context, providerName string) error
}

type SecretRef string

type ServerMode interface {
	ActivateServerMode(ctx context.Context, settings json.RawMessage) error
}

type StatusRequest struct {
	// Hostname selects a specific instance (e.g. a cluster or server) for
	// handlers that advertise auth.CapInstanceHostname.
	Hostname string `json:"hostname,omitempty" yaml:"hostname,omitempty"`
}

type StreamChunk struct {
	Stdout []byte           `json:"stdout,omitempty" yaml:"stdout,omitempty"`
	Stderr []byte           `json:"stderr,omitempty" yaml:"stderr,omitempty"`
	Result *provider.Output `json:"result,omitempty" yaml:"result,omitempty"`
	Error  string           `json:"error,omitempty" yaml:"error,omitempty"`
}

type TokenRequest struct {
	Scope         string             `json:"scope,omitempty" yaml:"scope,omitempty"`
	MinValidFor   time.Duration      `json:"minValidFor,omitempty" yaml:"minValidFor,omitempty"`
	ForceRefresh  bool               `json:"forceRefresh,omitempty" yaml:"forceRefresh,omitempty"`
	ServerContext auth.ServerContext `json:"serverContext,omitempty" yaml:"serverContext,omitempty"`
	Caller        auth.CallerType    `json:"caller,omitempty" yaml:"caller,omitempty"`
	Assertion     string             `json:"assertion,omitempty" yaml:"assertion,omitempty"`
	// Hostname selects a specific instance (e.g. a cluster or server) for
	// handlers that advertise auth.CapTokenHostname.
	Hostname string `json:"hostname,omitempty" yaml:"hostname,omitempty"`
}

type TokenResponse struct {
	AccessToken string    `json:"accessToken" yaml:"accessToken"` //nolint:gosec
	TokenType   string    `json:"tokenType" yaml:"tokenType"`
	ExpiresAt   time.Time `json:"expiresAt" yaml:"expiresAt"`
	Scope       string    `json:"scope,omitempty" yaml:"scope,omitempty"`
	CachedAt    time.Time `json:"cachedAt,omitempty" yaml:"cachedAt,omitempty"`
	Flow        auth.Flow `json:"flow,omitempty" yaml:"flow,omitempty"`
	SessionID   string    `json:"sessionId,omitempty" yaml:"sessionId,omitempty"`
}