oauth2

type Cache interface {
	Get(ctx context.Context, key string) (string, error)
	Set(ctx context.Context, key, value string, ttl time.Duration) error
	Delete(ctx context.Context, key string) error
}

type Config struct {
	// Authenticator validates credentials for the password grant.
	// Required for password-grant flows. Optional for pure
	// client_credentials apps — leave nil and only client_credentials
	// will issue tokens.
	Authenticator PasswordAuthenticator

	// ClientStore loads OAuth2 clients by ID. Defaults to a single
	// public anonymous client (id="anonymous", no secret) — fine for
	// trusted-network deploys and tests, wrong for the public
	// internet. Provide NewLoaderClientStore or NewStaticClientStore
	// for real workloads.
	ClientStore oauth2lib.ClientStore

	// TokenStore persists access/refresh/code tokens. Defaults to
	// go-oauth2's in-memory store (single-process only). Use
	// NewCacheTokenStore for horizontally-scaled apps.
	TokenStore oauth2lib.TokenStore

	// IdentityResolver enriches the auth.Identity built from each
	// resolved access token. Defaults to {ID: ti.GetUserID()} with
	// the raw token + TokenInfo on .Extra (a *Session) so logout
	// handlers can revoke without re-extracting.
	IdentityResolver IdentityResolver

	// ErrorMapper translates Authenticator errors → OAuth2 responses.
	// Defaults to DefaultErrorMapper (handles ErrInvalidCredentials,
	// ErrAccountDisabled, ErrAccountLocked, ErrServiceUnavailable).
	// Override or wrap to translate domain errors.
	ErrorMapper ErrorMapper

	// ResponseErrorRewriter runs after go-oauth2 builds an OAuth2
	// error response — use it to soften descriptions, translate
	// strings, or log. Optional.
	ResponseErrorRewriter func(*errors.Response)

	// TokenType is the value emitted as token_type in the response.
	// Defaults to "Bearer". Set to "bearer" (lowercase) when
	// migrating clients written against Spring's DefaultTokenServices.
	TokenType string

	// IncludeJTI adds a unique "jti" extension field to every
	// issued token, useful for revocation lists / replay tracking.
	// Off by default.
	IncludeJTI bool

	// AllowGetAccessRequest mirrors server.SetAllowGetAccessRequest.
	// Off by default — the OAuth2 spec recommends POST.
	AllowGetAccessRequest bool

	// TokenPath is the mount path for the token endpoint. Defaults
	// to "/oauth/token".
	TokenPath string

	// RevokePath, when non-empty, mounts a POST handler that
	// removes the access token from the TokenStore. Empty by default.
	RevokePath string

	// IdentityCache bounds how long a resolved auth.Identity stays
	// in the auth.Manager cache. Defaults to 5 minutes; set to
	// negative to disable caching.
	IdentityCache time.Duration

	// Manager is an escape hatch — when non-nil, the package uses
	// it verbatim and ignores ClientStore / TokenStore. Use for
	// exotic config (custom token generator, code-expiry policy)
	// the rest of Config doesn't expose.
	Manager *manage.Manager

	// ServerCustomizer runs after the *server.Server is built and
	// before Mount, giving callers access to any go-oauth2 setter
	// Config doesn't surface (UserAuthorizationHandler, ScopeHandler,
	// custom AccessTokenExpHandler, etc).
	ServerCustomizer func(*server.Server)

	// AuthExtra are auth.Config fields the caller wants to thread
	// through (OnResolve, OnFail, Permissions, error rewriters).
	// Resolve and Cache are owned by this package and ignored if set.
	AuthExtra auth.Config
}

type ErrorMapper func(err error) *errors.Response

type IdentityResolver func(ctx context.Context, ti oauth2lib.TokenInfo) (*auth.Identity, error)

type LoaderFunc func(ctx context.Context, id string) (oauth2lib.ClientInfo, error)

type PasswordAuthenticator func(ctx context.Context, clientID, username, password string) (userID string, err error)

type Server struct {
	*nexus.Service
	Srv     *server.Server
	Manager *manage.Manager
	// contains filtered or unexported fields
}

type Session struct {
	Token string
	Info  oauth2lib.TokenInfo
}

type StaticClient struct {
	ID, Secret, Domain, UserID string
	Public                     bool
}