auth

type Claims struct {
	Issuer    string
	Subject   string
	TenantID  string
	ObjectID  string
	ClientID  string
	Email     string
	Name      string
	Username  string
	IssuedAt  time.Time
	ExpiresAt time.Time
}

type Error struct {
	Handler   string
	Operation string
	Cause     error
}

type Flow string

type Handler interface {
	// Name returns the unique identifier for this auth handler.
	Name() string

	// DisplayName returns a human-readable name for display purposes.
	DisplayName() string

	// Login initiates the authentication flow.
	// For interactive flows (like device code), this blocks until completion or timeout.
	// Returns the authenticated identity claims on success.
	Login(ctx context.Context, opts LoginOptions) (*Result, error)

	// Logout clears stored credentials for this handler.
	Logout(ctx context.Context) error

	// Status returns the current authentication status.
	// Returns a status with Authenticated=false if not logged in.
	Status(ctx context.Context) (*Status, error)

	// GetToken returns a valid access token for the specified options.
	// Uses cached tokens when available and valid for the requested duration,
	// otherwise refreshes from the identity provider.
	// Returns ErrNotAuthenticated if user is not logged in.
	// Returns ErrTokenExpired if refresh token has expired (re-login required).
	GetToken(ctx context.Context, opts TokenOptions) (*Token, error)

	// InjectAuth adds authentication to an HTTP request.
	// This is the primary method used by providers (like HTTP) to authenticate requests.
	// Automatically handles token acquisition/refresh as needed.
	InjectAuth(ctx context.Context, req *http.Request, opts TokenOptions) error

	// SupportedFlows returns the authentication flows this handler supports.
	SupportedFlows() []Flow
}

type IdentityType string

type LoginOptions struct {
	TenantID           string
	Scopes             []string
	Flow               Flow
	Timeout            time.Duration
	DeviceCodeCallback func(userCode, verificationURI, message string)
}

type MockHandler struct {
	NameValue        string
	DisplayNameValue string
	FlowsValue       []Flow

	LoginResult    *Result
	LoginErr       error
	LogoutErr      error
	StatusResult   *Status
	StatusErr      error
	GetTokenResult *Token
	GetTokenErr    error
	InjectAuthErr  error

	LoginCalls      []LoginOptions
	LogoutCalls     int
	StatusCalls     int
	GetTokenCalls   []TokenOptions
	InjectAuthCalls []TokenOptions
	// contains filtered or unexported fields
}

type Registry struct {
	// contains filtered or unexported fields
}

type Result struct {
	Claims    *Claims
	ExpiresAt time.Time
}

type Status struct {
	Authenticated bool
	Claims        *Claims
	ExpiresAt     time.Time
	LastRefresh   time.Time
	TenantID      string
	IdentityType  IdentityType // Type of identity: "user", "service-principal", or "workload-identity"
	ClientID      string       // For service principal/workload identity: the application ID
	TokenFile     string       // For workload identity: path to the federated token file
	Scopes        []string     // Scopes granted during login
}

type Token struct {
	AccessToken string //nolint:gosec // G117: not a hardcoded credential, stores runtime token data
	TokenType   string
	ExpiresAt   time.Time
	Scope       string
}

type TokenOptions struct {
	Scope        string
	MinValidFor  time.Duration
	ForceRefresh bool
}