oidckit

type AppleSecretConfig struct {
	TeamID        string        // Apple Developer Team ID (iss)
	KeyID         string        // Key ID (kid in header)
	ClientID      string        // Service ID / App ID (sub)
	PrivateKeyPEM []byte        // contents of the .p8 private key
	TTL           time.Duration // default 5 minutes if <= 0 (Apple allows up to 6 months)
}

type Claims struct {
	Subject           string
	Email             *string
	EmailVerified     *bool
	Name              *string
	PreferredUsername *string
	AuthTime          time.Time
	RawIDToken        string
}

type Manager struct {
	// contains filtered or unexported fields
}

type RPClient struct {
	Issuer       string
	ClientID     string
	ClientSecret string // For Apple, supply a generated JWT client secret
	// ClientSecretProvider, if set, is called to obtain a fresh client_secret
	// whenever an RP is constructed (e.g., for Apple where the secret is a short‑lived ES256 JWT).
	ClientSecretProvider func(ctx context.Context) (string, error)
	Scopes               []string
	// Optional: additional auth params (e.g., response_mode)
	ExtraAuthParams map[string]string
	PKCE            bool
}

type RPConfig struct {
	ClientID     string
	ClientSecret string
	// Optional: dynamic secret minting
	SecretProvider func(ctx context.Context) (string, error)
	// Optional: additional/override scopes. "openid" will be ensured.
	Scopes []string
}

type StateCache interface {
	Put(ctx context.Context, state string, data StateData) error
	Get(ctx context.Context, state string) (StateData, bool, error)
	Del(ctx context.Context, state string) error
}

type StateData struct {
	Provider    string
	Verifier    string
	Nonce       string
	RedirectURI string
	LinkUserID  string
	ReturnTo    string
	// Reauth* fields identify a step-up reauthentication flow for an existing
	// session. Login/link flows leave these empty.
	ReauthUserID    string
	ReauthSessionID string
	ReauthReturnTo  string
	ReauthStartedAt time.Time
	UI              string // "popup" to trigger popup HTML callback; else redirect
	PopupNonce      string // echoed in popup postMessage for opener validation
}