authprovider

type AppleJWTSecret struct {
	TeamID        string
	KeyID         string
	PrivateKeyPEM []byte
	PrivateKeyEnv string
	TTL           time.Duration
}

type ClientSecret struct {
	Value    string
	Env      string
	Strategy string
	AppleJWT *AppleJWTSecret
}

type FallbackLookup struct {
	URL    string
	Accept string
	Array  bool
	Select map[string]any

	Email         FieldMapping
	EmailVerified FieldMapping
}

type FieldMapping struct {
	Path       string
	Value      any
	Transforms []string
}

type Identity struct {
	Subject           string
	Email             string
	EmailVerified     bool
	PreferredUsername string
	DisplayName       string
}

type Kind string

type Provider struct {
	Name            string
	Kind            Kind
	Issuer          string
	ClientID        string
	ClientSecret    ClientSecret
	Scopes          []string
	PKCE            bool
	AuthorizeURL    string
	TokenURL        string
	UserInfoURL     string
	UserInfoAccept  string
	ExtraAuthParams map[string]string
	UserMapping     UserMapping
	EmailFallback   *FallbackLookup

	// IdentityMapper is an internal escape hatch for providers whose userinfo
	// response cannot be represented by declarative mappings.
	IdentityMapper func(any) (Identity, error)

	// SecretProvider is the internal escape hatch for callers that already
	// construct dynamic secrets in code. Config-first providers should prefer
	// ClientSecret strategies.
	SecretProvider func(context.Context) (string, error)
}

type UserMapping struct {
	Subject           FieldMapping
	Email             FieldMapping
	EmailVerified     FieldMapping
	PreferredUsername FieldMapping
	DisplayName       FieldMapping
}