oauthclient

type Connector struct {
	// Provider is ProviderGitHub or ProviderGoogle.
	Provider string

	// OAuth2 is the client configuration (endpoints, credentials, scopes).
	OAuth2 *oauth2.Config

	// APIURL is the GitHub API base URL (for ProviderGitHub) or the userinfo
	// endpoint URL (for ProviderGoogle).
	APIURL string

	// HTTPClient, if set, is used for the token exchange and profile calls.
	HTTPClient *http.Client
}

type MemoryStateStore struct {
	// contains filtered or unexported fields
}

type ProviderConfig struct {
	ClientID     string
	ClientSecret string //nolint:gosec // G117: config field, not a hardcoded secret
	RedirectURL  string
	Scopes       []string
}

type StateData struct {
	// Provider is the provider the flow was started for.
	Provider string `json:"provider"`

	// RedirectURL is the (already validated) post-login destination.
	RedirectURL string `json:"redirect_url,omitempty"`

	// Nonce is an optional OpenID Connect nonce.
	Nonce string `json:"nonce,omitempty"`

	// PKCEVerifier is the PKCE code verifier for the token exchange.
	PKCEVerifier string `json:"pkce_verifier,omitempty"`
}

type StateManager struct {
	CookieName string
	MaxAge     int
	Secure     bool // Secure flag for cookies (default: true, requires HTTPS)
	SameSite   http.SameSite
}

type StateStore interface {
	// Put stores data under state for ttl.
	Put(ctx context.Context, state string, data StateData, ttl time.Duration) error

	// Take returns and deletes the data for state. It returns ErrInvalidState
	// when the state is unknown or expired.
	Take(ctx context.Context, state string) (StateData, error)
}

type SystemAuthConfig struct {
	ProviderConfig
	BaseURL string // SystemAuth server base URL
}

type User struct {
	// ProviderID is the unique identifier from the OAuth provider.
	ProviderID string `json:"provider_id"`

	// Provider is the name of the OAuth provider (google, github, etc.).
	Provider string `json:"provider"`

	// Email is the user's email address.
	Email string `json:"email"`

	// EmailVerified reports whether the provider asserts that the user
	// controls Email. Only a verified email may be used to link an upstream
	// identity to an existing account.
	EmailVerified bool `json:"email_verified"`

	// Name is the user's display name.
	Name string `json:"name"`

	// AvatarURL is the URL to the user's profile picture.
	AvatarURL string `json:"avatar_url,omitempty"`

	// Username is the user's username (primarily for GitHub).
	Username string `json:"username,omitempty"`

	// AccessToken is the OAuth access token.
	AccessToken string `json:"-"`

	// RefreshToken is the OAuth refresh token (if provided).
	RefreshToken string `json:"-"`

	// TokenExpiry is when the access token expires.
	TokenExpiry time.Time `json:"-"`

	// Raw contains the raw user data from the provider.
	Raw map[string]any `json:"raw,omitempty"`
}