auth

type Authenticator interface {
	Authenticate(r *http.Request) (*Principal, error)
}

type DBAuthenticator struct {
	Resolver interface {
		TokenResolver
		UserResolver
	}
	SessionSecret string
}

type LoginState struct {
	Mode, Redirect, CLIRedirect, CodeChallenge string
	ExpiresAt                                  time.Time
	User                                       OIDCUser
	UserID                                     string
	// MCP OAuth authorization codes reuse the same one-time, persisted code
	// store as CLI login while carrying the audience and public-client binding
	// required by OAuth 2.1.
	OAuthClientID    string
	OAuthRedirectURI string
	OAuthResource    string
	OAuthScope       string
	// WebBindingRequired marks web login states created after browser binding
	// was introduced. Its zero value preserves callbacks for states created by
	// older instances during a rolling deployment.
	WebBindingRequired bool
}

type LoginStateStore interface {
	PutState(ctx context.Context, id string, st LoginState) error
	TakeState(ctx context.Context, id string) (LoginState, bool, error)
	PutCode(ctx context.Context, code string, st LoginState) error
	TakeCode(ctx context.Context, code string) (LoginState, bool, error)
}

type MCPAuthenticator struct {
	Users         UserResolver
	ServiceTokens Authenticator
	SessionSecret string
	Resource      string
}

type OIDC struct {
	Config   *oauth2.Config
	Verifier *oidc.IDTokenVerifier
	Issuer   string
}

type OIDCConfig struct {
	// IssuerURL is the provider's public issuer; ID tokens are validated
	// against it and browsers are sent to its authorization endpoint.
	IssuerURL string
	// InternalIssuerURL optionally names a second base URL where the server
	// reaches the same provider (split horizon, e.g. a docker-compose network
	// where the browser sees http://localhost:5556 but the server must dial
	// http://dex:5556). Discovery, token exchange, and JWKS fetches use it;
	// token `iss` claims keep being validated against IssuerURL.
	InternalIssuerURL string
	ClientID          string
	ClientSecret      string
	RedirectURL       string
}

type OIDCSettings struct {
	IssuerURL         string
	InternalIssuerURL string
	ClientID          string
	ClientSecret      string
	// ProviderName labels the login button ("Continue with <ProviderName>").
	ProviderName string
}

type OIDCUser struct{ Sub, Email, Name, PictureURL string }

type PostgresStateStore struct {
	// contains filtered or unexported fields
}

type Principal struct {
	Type       PrincipalType `json:"type"`
	ID         string        `json:"id"`
	Email      string        `json:"email,omitempty"`
	Name       string        `json:"name,omitempty"`
	PictureURL string        `json:"picture_url,omitempty"`

	// GoogleGroupIDs and GoogleGroupMembershipState are authorization inputs,
	// not principal profile data. Excluding them from JSON prevents a
	// user's group graph (and resolution failures) from leaking through API
	// responses that serialize the authenticated principal.
	GoogleGroupIDs             []string `json:"-"`
	GoogleGroupMembershipState string   `json:"-"`
}

type PrincipalType string

type SessionCodec struct{ Secret []byte }

type StateStore struct {
	// contains filtered or unexported fields
}

type TokenResolver interface {
	ResolveBearerToken(ctx context.Context, tokenHash string) (Principal, error)
}

type UserResolver interface {
	ResolveUser(ctx context.Context, id string) (Principal, error)
}