provider

type AppleSecret struct {
	Static        string
	TeamID        string
	KeyID         string
	PrivateKeyPEM []byte
	TTL           time.Duration
}

type AuthRequest struct {
	State         string
	Nonce         string
	CodeChallenge string
	RedirectURI   string
	// Params are extra authorization parameters for this request (for example
	// max_age=0 on a step-up).
	Params map[string]string
}

type Endpoint struct {
	AuthorizeURL string
	TokenURL     string
}

type ExchangeRequest struct {
	Code         string
	CodeVerifier string
	Nonce        string
	RedirectURI  string
}

type HealthChecker interface {
	CheckHealth(ctx context.Context) error
}

type Identity struct {
	Subject           string
	Email             string
	EmailVerified     bool
	PreferredUsername string
	DisplayName       string
	// AuthTime is when the user last authenticated interactively at the IdP;
	// zero when the provider does not assert one.
	AuthTime time.Time
}

type Option func(*base)

type Provider interface {
	// Name is the slug used in routes (/oidc/{name}/…) and stored on links.
	Name() string
	DisplayName() string
	// Issuer identifies the identity source; provider links are keyed by it.
	Issuer() string
	// PKCE reports whether the authorization request carries an S256 challenge.
	PKCE() bool
	// ResponseModeFormPost reports whether the IdP posts the authorization
	// response cross-site (response_mode=form_post) instead of redirecting.
	ResponseModeFormPost() bool
	// SupportsStepUp reports whether a completed login proves a fresh
	// interactive authentication (OIDC max_age=0 checked against auth_time).
	// OAuth2 IdPs silently re-authorize an approved app, so they never do.
	SupportsStepUp() bool
	// TrustsEmailVerification reports whether this provider's email_verified
	// assertion is proof that the user controls the address. Only then may
	// AuthKit create an account with that address verified; otherwise the
	// address is ignored at registration (ak#393). Generic OIDC/OAuth2 IdPs
	// often let a tenant or user choose the claimed email, so they are
	// untrusted unless the host opts in with WithTrustedEmailVerification.
	TrustsEmailVerification() bool
	// AuthCodeURL and Exchange wrap ErrUnavailable when the provider
	// could not be reached or answered 5xx/429.
	AuthCodeURL(ctx context.Context, req AuthRequest) (string, error)
	Exchange(ctx context.Context, req ExchangeRequest) (Identity, error)
	// Validate checks the static configuration; it performs no network calls.
	Validate() error
	// contains filtered or unexported methods
}

type Secret interface {
	ClientSecret(ctx context.Context) (string, error)
}

type SecretFunc func(ctx context.Context) (string, error)

type StaticSecret string

type UserInfoFunc func(ctx context.Context, client *http.Client) (Identity, error)