auth

type APIKey struct{}

type AuthContext struct {
	APIName     string
	ProfileName string
	BaseURL     string
	CacheKey    string
	Params      map[string]string // user-supplied only
	TokenStore  TokenStore
	Prompter    Prompter
	Stderr      io.Writer
	HTTPClient  *http.Client
	Logger      Logger
	Force       bool // bypass cached access tokens for a single retry
}

type AuthorizationCode struct {
	// Cache stores fetched tokens.
	Cache TokenStore
	// HTTPClient is used for token requests. Defaults to http.DefaultClient when nil.
	HTTPClient *http.Client
	// OpenBrowser is called with the authorization URL. When nil the default
	// system browser opener is used.
	OpenBrowser func(url string) error
	// Stderr receives status messages during the browser flow.
	Stderr io.Writer
	// Prompt is used to read a pasted authorization code for headless fallback.
	Prompt func(prompt string) (string, error)
	// CanPrompt reports whether manual code entry is safe for this invocation.
	CanPrompt bool
	// NoBrowser skips automatic browser launch and immediately falls back to
	// printing the auth URL for manual use.
	NoBrowser bool
	// Verbose prints the full authorization URL before browser launch.
	Verbose bool
	// CallbackSuccessColor customizes the browser callback success background.
	// Invalid values fall back to the built-in v1 callback color.
	CallbackSuccessColor string
	// CallbackFailureColor customizes the browser callback failure background.
	// Invalid values fall back to the built-in v1 callback color.
	CallbackFailureColor string
	// CallbackSuccessHTML customizes the browser callback success page. When
	// empty, Restish renders the built-in animated page.
	CallbackSuccessHTML string
	// CallbackErrorHTML customizes the browser callback failure page. When
	// empty, Restish renders the built-in animated page. $ERROR, $TITLE, and
	// $DETAILS placeholders are replaced with escaped callback values.
	CallbackErrorHTML string
}

type Bearer struct{}

type CachedToken struct {
	AccessToken  string    `cbor:"access_token" json:"access_token"`
	TokenType    string    `cbor:"token_type,omitempty" json:"token_type,omitempty"`
	RefreshToken string    `cbor:"refresh_token,omitempty" json:"refresh_token,omitempty"`
	Expiry       time.Time `cbor:"expiry,omitempty" json:"expiry,omitempty"`
}

type ClientCredentials struct {
	// Cache stores fetched tokens. If nil, tokens are not cached.
	Cache TokenStore
	// HTTPClient is used for token requests. Defaults to http.DefaultClient when nil.
	HTTPClient *http.Client
}

type DeviceCode struct {
	Cache      TokenStore
	HTTPClient *http.Client
	Stderr     io.Writer
}

type ExternalTool struct {
	Stderr  io.Writer
	Timeout time.Duration
}

type ForceCapable interface {
	SupportsForce()
}

type HTTPBasic struct {
	// Prompter is called when "password" is absent from params.
	// It receives the prompt string and must return the secret value.
	// If nil, a missing password causes an error.
	Prompter func(prompt string) (string, error)
}

type Handler interface {
	// Parameters returns the list of configuration parameters this handler needs.
	Parameters() []Param
	// Authenticate mutates req to add authentication credentials.
	Authenticate(ctx context.Context, req *http.Request, ac AuthContext) error
}

type Logger interface {
	Printf(format string, v ...any)
}

type OIDCConfig struct {
	AuthorizationEndpoint       string `json:"authorization_endpoint"`
	DeviceAuthorizationEndpoint string `json:"device_authorization_endpoint"`
	TokenEndpoint               string `json:"token_endpoint"`
}

type Param struct {
	Name        string
	Description string
	Required    bool
	Secret      bool // true -> don't echo when prompting
}

type Prompter interface {
	Prompt(prompt string) (string, error)
	PromptSecret(prompt string) (string, error)
}

type TokenCache struct {
	// contains filtered or unexported fields
}

type TokenStore interface {
	Get(key string) (*CachedToken, error)
	Set(key string, token CachedToken) error
	Delete(key string) error
	DeletePrefix(prefix string) error
}