github

type AppInfo struct {
	ID          int64  `json:"id"`
	Slug        string `json:"slug"`
	Name        string `json:"name"`
	Description string `json:"description"`
	Owner       struct {
		Login string `json:"login"`
		ID    int64  `json:"id"`
	} `json:"owner"`
}

type Config struct {
	// ClientID is the GitHub OAuth App client ID.
	ClientID string `json:"clientId" yaml:"clientId" doc:"GitHub OAuth App client ID" example:"Ov23li6xn492GhPmt4YG"`

	// ClientSecret is the GitHub OAuth App client secret.
	// Required for the interactive (authorization code) flow. When not set,
	// the interactive flow falls back to device code with browser auto-open —
	// the same behaviour as 'gh auth login'. Not required for device code or PAT flows.
	ClientSecret string `` //nolint:gosec // G117: config field, not a hardcoded credential
	/* 149-byte string literal not displayed */

	// Hostname is the GitHub hostname (e.g. github.com or github.example.com for GHES).
	Hostname string `json:"hostname" yaml:"hostname" doc:"GitHub hostname" example:"github.com"`

	// DefaultScopes is the list of OAuth scopes to request by default.
	DefaultScopes []string `json:"defaultScopes" yaml:"defaultScopes" doc:"Default OAuth scopes to request" maxItems:"20"`

	// MinPollInterval is the minimum polling interval for device code flow.
	MinPollInterval time.Duration `json:"-" yaml:"-"`

	// SlowDownIncrement is the amount to add to polling interval on slow_down.
	SlowDownIncrement time.Duration `json:"-" yaml:"-"`

	// AppID is the GitHub App ID for the installation token flow.
	AppID int64 `json:"appId,omitempty" yaml:"appId,omitempty" doc:"GitHub App ID for installation token flow" example:"123456"`

	// InstallationID is the GitHub App installation ID.
	InstallationID int64 `json:"installationId,omitempty" yaml:"installationId,omitempty" doc:"GitHub App installation ID" example:"78901234"`

	// PrivateKey is the inline PEM-encoded private key for the GitHub App.
	// Can also be provided via the GITHUB_APP_PRIVATE_KEY environment variable.
	PrivateKey string `` //nolint:gosec // Field name, not a credential
	/* 128-byte string literal not displayed */

	// PrivateKeyPath is the file path to the PEM-encoded private key for the GitHub App.
	// Can also be provided via the GITHUB_APP_PRIVATE_KEY_PATH environment variable.
	PrivateKeyPath string `` /* 177-byte string literal not displayed */

	// PrivateKeySecretName is the name of the secret in the secret store that
	// contains the PEM-encoded private key for the GitHub App.
	PrivateKeySecretName string `` /* 145-byte string literal not displayed */
}

type DefaultHTTPClient struct {
	// contains filtered or unexported fields
}

type DeviceCodeResponse struct {
	DeviceCode      string `json:"device_code"`
	UserCode        string `json:"user_code"`
	VerificationURI string `json:"verification_uri"`
	ExpiresIn       int    `json:"expires_in"`
	Interval        int    `json:"interval"`
}

type HTTPClient interface {
	// PostForm sends a POST request with form-encoded body and returns the response.
	PostForm(ctx context.Context, url string, data url.Values) (*http.Response, error)

	// PostJSON sends a POST request with JSON body and custom headers.
	PostJSON(ctx context.Context, url string, body any, headers map[string]string) (*http.Response, error)

	// Get sends a GET request with the given headers and returns the response.
	Get(ctx context.Context, url string, headers map[string]string) (*http.Response, error)
}

type Handler struct {
	// contains filtered or unexported fields
}

type InstallationTokenResponse struct {
	Token       string            `json:"token"`      //nolint:gosec // Not a hardcoded credential
	ExpiresAt   time.Time         `json:"expires_at"` //nolint:gosec // Not a hardcoded credential
	Permissions map[string]string `json:"permissions"`
}

type MockHTTPClient struct {
	Requests  []*MockRequest
	Responses []*MockResponse
	// contains filtered or unexported fields
}

type MockRequest struct {
	Method   string
	Endpoint string
	Data     url.Values
	Headers  map[string]string
}

type MockResponse struct {
	StatusCode int
	Body       any // Will be JSON-encoded
	Err        error
}

type Option func(*Handler)

type TokenErrorResponse struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description"`
	ErrorURI         string `json:"error_uri,omitempty"`
}

type TokenMetadata struct {
	Claims                *auth.Claims `json:"claims"`
	RefreshTokenExpiresAt time.Time    `json:"refreshTokenExpiresAt,omitempty"`
	LastRefresh           time.Time    `json:"lastRefresh"`
	Hostname              string       `json:"hostname"`
	ClientID              string       `json:"clientId,omitempty"`
	Scopes                []string     `json:"scopes,omitempty"`
	IdentityType          string       `json:"identityType,omitempty"`

	// SessionID is a stable identifier for the authentication session.
	// Generated once at login time and preserved across refresh-token rotations.
	SessionID string `json:"sessionId,omitempty"`
}

type TokenResponse struct {
	AccessToken           string `json:"access_token"`            //nolint:gosec // Not a hardcoded credential
	RefreshToken          string `json:"refresh_token,omitempty"` //nolint:gosec // Not a hardcoded credential
	TokenType             string `json:"token_type"`
	Scope                 string `json:"scope"`
	ExpiresIn             int    `json:"expires_in,omitempty"`               // Present when token expiration is enabled
	RefreshTokenExpiresIn int    `json:"refresh_token_expires_in,omitempty"` // Present when token expiration is enabled
}

type User struct {
	Login     string `json:"login"`
	ID        int64  `json:"id"`
	Name      string `json:"name"`
	Email     string `json:"email"`
	AvatarURL string `json:"avatar_url"`
}