authprovider

type AppleJWTSecret struct {
	TeamID        string
	KeyID         string
	PrivateKeyPEM []byte
	TTL           time.Duration
}

type ClientSecret struct {
	Value    string
	Strategy string
	AppleJWT *AppleJWTSecret
}

type Identity struct {
	Subject           string
	Email             string
	EmailVerified     bool
	PreferredUsername string
	DisplayName       string
}

type Kind string

type Provider struct {
	Name            string
	Kind            Kind
	Issuer          string
	ClientID        string
	ClientSecret    ClientSecret
	Scopes          []string
	PKCE            bool
	AuthorizeURL    string
	TokenURL        string
	UserInfoURL     string
	UserInfoAccept  string
	ExtraAuthParams map[string]string

	// EmailFallbackURL is an optional secondary userinfo endpoint queried when the
	// primary userinfo response yields no email. It exists for OAuth2 providers
	// (GitHub) whose /user email may be empty; the fetched JSON is expected to be an
	// array of {email, primary, verified} entries, and the primary+verified entry is
	// selected. Empty for providers without a fallback.
	EmailFallbackURL    string
	EmailFallbackAccept string

	// IdentityMapper maps a provider's parsed userinfo JSON into an Identity. It is
	// required for OAuth2 providers (OIDC providers read standard ID-token claims via
	// the oidc path instead). Built-ins set this in-code; custom OAuth2 providers must
	// supply their own.
	IdentityMapper func(any) (Identity, error)

	// SecretProvider is the internal escape hatch for callers that already
	// construct dynamic secrets in code. Config-first providers should prefer
	// ClientSecret strategies.
	SecretProvider func(context.Context) (string, error)
}