authprovider

type AppleSecret struct {
	Static        string
	TeamID        string
	KeyID         string
	PrivateKeyPEM []byte
	TTL           time.Duration
}

type AuthRequest struct {
	State         string
	Nonce         string
	CodeChallenge string
	RedirectURI   string
	// Params are extra authorization parameters for this request (for example
	// max_age=0 on a step-up).
	Params map[string]string
}

type Endpoint struct {
	AuthorizeURL string
	TokenURL     string
}

type ExchangeRequest struct {
	Code         string
	CodeVerifier string
	Nonce        string
	RedirectURI  string
}

type Identity struct {
	Subject           string
	Email             string
	EmailVerified     bool
	PreferredUsername string
	DisplayName       string
	// AuthTime is when the user last authenticated interactively at the IdP;
	// zero when the provider does not assert one.
	AuthTime time.Time
}

type Option func(*base)

type Provider interface {
	// Name is the slug used in routes (/oidc/{name}/…) and stored on links.
	Name() string
	DisplayName() string
	// Issuer identifies the identity source; provider links are keyed by it.
	Issuer() string
	// PKCE reports whether the authorization request carries an S256 challenge.
	PKCE() bool
	// ResponseModeFormPost reports whether the IdP posts the authorization
	// response cross-site (response_mode=form_post) instead of redirecting.
	ResponseModeFormPost() bool
	// SupportsStepUp reports whether a completed login proves a fresh
	// interactive authentication (OIDC max_age=0 checked against auth_time).
	// OAuth2 IdPs silently re-authorize an approved app, so they never do.
	SupportsStepUp() bool
	AuthCodeURL(ctx context.Context, req AuthRequest) (string, error)
	Exchange(ctx context.Context, req ExchangeRequest) (Identity, error)
	// Validate checks the static configuration; it performs no network calls.
	Validate() error
}

type Secret interface {
	ClientSecret(ctx context.Context) (string, error)
}

type SecretFunc func(ctx context.Context) (string, error)

type StaticSecret string

type UserInfoFunc func(ctx context.Context, client *http.Client) (Identity, error)