session

type Action struct {
	Active string `cfg:"active"`
	Token  *Token `cfg:"token"`
}

type AuthHeaderStyle int

type HostCookieName struct {
	// Host as "localhost:8082"
	Host  string `cfg:"host"`
	Regex string `cfg:"regex"`

	CookieName string `cfg:"cookie_name"`
	// contains filtered or unexported fields
}

type InfAPIKey interface {
	APIKeyData(ctx context.Context, key string) ([]byte, error)
}

type InfIssuer interface {
	// Keyfunc returns the public key for tokens signed by this issuer.
	// It must return ErrKIDNotFound when the token was signed by someone else.
	Keyfunc(token *jwt.Token) (any, error)
	// IssueToken runs an OAuth2 token request (password, refresh_token, ...)
	// in-process and returns the raw JSON body with its HTTP status code.
	IssueToken(ctx context.Context, form url.Values) ([]byte, int, error)
}

type InfKeyFunc interface {
	Keyfunc(token *jwt.Token) (any, error)
}

type InfKeyFuncParser interface {
	InfKeyFunc
	ParseWithClaims(tokenString string, claims jwt.Claims) (*jwt.Token, error)
}

type InfPasskey interface {
	PasskeyToken(ctx context.Context, orig *http.Request, body []byte) ([]byte, int, error)
}

type InfProviderCert interface {
	GetCertURL() string
	GetName() string
}

type InfSignup interface {
	SignupFeatures() SignupFeatures
	// SignupAction runs one of the SignupAction* requests in-process; body is
	// the JSON payload including client credentials.
	SignupAction(ctx context.Context, action string, body []byte) ([]byte, int, error)
}

type JwkKeyFuncParse struct {
	KeyFunc func(token *jwt.Token) (any, error)
}

type KeyFound struct {
	Key  any
	Name string
}

type KeyFuncMulti struct {
	// contains filtered or unexported fields
}

type MetaData struct {
	Error string `json:"error"`
}

type MultipleJWKS struct {
	// contains filtered or unexported fields
}

type MultipleJWKSKey struct {
	URL  string
	Name string
}

type MultipleOptions struct {
	KeySelector func(multiJWKS *MultipleJWKS, token *jwt.Token) (key any, err error)
}

type Oauth2 struct {
	// ClientID is the application's ID.
	ClientID string `cfg:"client_id"`
	// ClientSecret is the application's secret.
	ClientSecret string `cfg:"client_secret" log:"false"`
	// Scope specifies optional requested permissions.
	Scopes []string `cfg:"scopes"`
	// CertURL is the resource server's public key URL.
	CertURL string `cfg:"cert_url"`
	// IntrospectURL is the check the active or not with request.
	IntrospectURL string `cfg:"introspect_url"`
	// UserInfoURL is the get information about user.
	UserInfoURL string `cfg:"userinfo_url"`
	// RevocationURL for token revocation.
	RevocationURL string `cfg:"revocation_url"`
	// AuthURL is the resource server's authorization endpoint
	// use for redirection to login page.
	AuthURL string `cfg:"auth_url"`
	// TokenURL is the resource server's token endpoint URL.
	TokenURL  string `cfg:"token_url"`
	LogoutURL string `cfg:"logout_url"`
	// PasskeyURL is the WebAuthn begin/finish endpoint of a remote auth
	// middleware (e.g. https://auth.example.com/auth/oauth2/passkey).
	// Not needed when the provider uses auth_middleware (in-process).
	PasskeyURL string `cfg:"passkey_url"`
	// APIKeyURL is the static API key validation endpoint of a remote auth
	// middleware (e.g. https://auth.example.com/auth/oauth2/api-key).
	// Not needed when the provider uses auth_middleware (in-process).
	APIKeyURL string `cfg:"api_key_url"`
	// SignupURL is the self-registration endpoint of a remote auth middleware
	// (e.g. https://auth.example.com/auth/oauth2/signup); the verify endpoint
	// is derived as SignupURL + "/verify".
	// Not needed when the provider uses auth_middleware (in-process).
	SignupURL string `cfg:"signup_url"`
	// PasswordResetURL is the forgot-password endpoint of a remote auth
	// middleware (e.g. https://auth.example.com/auth/oauth2/password-reset);
	// the confirm endpoint is derived as PasswordResetURL + "/confirm".
	// Not needed when the provider uses auth_middleware (in-process).
	PasswordResetURL string `cfg:"password_reset_url"`
	// AuthHeaderStyle is optional. If not set, AuthHeaderStyleBasic will be used.
	AuthHeaderStyle AuthHeaderStyle
}

type OptionJWK func(options *optionsJWK)

type Options struct {
	Path     string `cfg:"path"`
	MaxAge   int    `cfg:"max_age"`
	Domain   string `cfg:"domain"`
	Secure   bool   `cfg:"secure"`
	HttpOnly bool   `cfg:"http_only"`
	// SameSite for Lax 2, Strict 3, None 4.
	SameSite http.SameSite `cfg:"same_site"`
}

type Provider struct {
	Name   string  `cfg:"name"`
	Oauth2 *Oauth2 `cfg:"oauth2"`
	// AuthMiddleware is the name of an in-process auth middleware instance.
	// When set, token validation and refresh go directly to that middleware
	// instead of cert_url/token_url over HTTP. oauth2.client_id should match
	// an OAuth client registered in the auth middleware.
	AuthMiddleware string `cfg:"auth_middleware"`
	// Passkey advertises WebAuthn login on the login page for this provider.
	// Requires auth_middleware (in-process) or oauth2.passkey_url (remote).
	Passkey bool `cfg:"passkey"`
	// XUser header set from token claims. Default is email and preferred_username.
	// It set first found value.
	XUser []string `cfg:"x_user"`
	// ClaimHeader is use to map claim to header.
	//   - Example: claim_header = {"X-User-Id": "preferred_username", "X-User-Email": "email"}
	//   - Default is adding "X-User-Id" header with "preferred_username" claim.
	//   - Set empty value to delete the header.
	ClaimHeader      map[string]string `cfg:"claim_header"`
	EmailVerifyCheck bool              `cfg:"email_verify_check"`
	// PasswordFlow is use password flow to get token.
	PasswordFlow bool `cfg:"password_flow"`
	// APIKey enables static X-API-Key authentication at the session layer.
	// The key is validated directly (in-process via auth_middleware or over
	// oauth2.api_key_url); no token exchange happens and downstream services
	// receive the key principal's claims/X-User.
	APIKey bool `cfg:"api_key"`
	// APIKeyHeader is the header carrying the raw API key. Default X-API-Key.
	APIKeyHeader string `cfg:"api_key_header"`
	// Priority is use to sort provider.
	Priority int `cfg:"priority"`
	// Hide is use to hide provider.
	Hide bool `cfg:"hide"`
}

type ProviderWrapper struct {
	Name    string
	Generic *providers.Generic
}

type Registry struct {
	Store map[string]*Session
	// contains filtered or unexported fields
}

type Session struct {
	// SessionKey is the default signing key for configured session stores.
	// A store-specific session_key takes precedence when set.
	SessionKey string `cfg:"session_key"`
	Store      Store  `cfg:"store"`
	// Options for main cookie.
	Options Options `cfg:"options"`

	// CookieName for default cookie name.
	// Overwrite this value with 'cookie_name' ctx value.
	CookieName string `cfg:"cookie_name"`
	// CookieNameHosts for cookie name by host with regexp.
	CookieNameHosts []HostCookieName `cfg:"cookie_name_hosts"`

	Action   Action              `cfg:"action"`
	Provider map[string]Provider `cfg:"provider"`
	// SetProvider is the default provider to set for refresing tokens.
	SetProvider string `cfg:"set_provider"`
	// contains filtered or unexported fields
}

type SignupFeatures struct {
	Signup            bool `json:"signup"`
	PasswordReset     bool `json:"password_reset"`
	PasswordMinLength int  `json:"password_min_length"`
}

type Store struct {
	Active string       `cfg:"active"`
	Redis  *store.Redis `cfg:"redis"`
	File   *store.File  `cfg:"file"`
}

type StoreInf interface {
	Get(r *http.Request, name string) (*sessions.Session, error)
}

type Token struct {
	LoginPath          string `cfg:"login_path"`
	DisableRefresh     bool   `cfg:"disable_refresh"`
	InsecureSkipVerify bool   `cfg:"insecure_skip_verify"`
	// contains filtered or unexported fields
}

type TokenData struct {
	AccessToken      string `json:"access_token"`
	ExpiresIn        int    `json:"expires_in"`
	RefreshExpiresIn int    `json:"refresh_expires_in"`
	RefreshToken     string `json:"refresh_token"`
	TokenType        string `json:"token_type"`
	NotBeforePolicy  int    `json:"not-before-policy"`
	SessionState     string `json:"session_state"`
	Scope            string `json:"scope"`
	IDToken          string `json:"id_token"`
}