token

type Config struct {
	TokenStore  storm.TokenStore
	ClientStore storm.ClientStore
	AuthStore   storm.AuthStore
	CIBAStore   storm.CIBAStore // optional, for CIBA grant type
	Crypto      storm.UniCrypto
	KeyStore    storm.KeyStore
	Decoder     *protocol.Decoder
	Logger      *slog.Logger
	// AuditLogger receives structured audit events for token issuance and auth failures.
	// When nil, events are logged via slog as a fallback.
	AuditLogger storm.AuditLogger
	// DevicePollInterval is the default polling interval for device_code grant (default: 5s).
	DevicePollInterval time.Duration
	// RequireDPoP when true requires a valid DPoP proof for all token requests.
	// Requests without a DPoP proof are rejected with invalid_request.
	// Use this for FAPI 2.0 compliance (sender-constrained tokens via DPoP).
	RequireDPoP bool
	// RequireMtls when true requires a valid mTLS client certificate for all token requests.
	// Requests without a client certificate are rejected with invalid_request.
	// Use this for FAPI 2.0 compliance (sender-constrained tokens via mTLS).
	RequireMtls bool
	// AllowPrivateIPs disables SSRF protection for jwks_uri fetches (testing only).
	AllowPrivateIPs bool
	// SkipTLSCertVerify disables TLS certificate verification on outbound HTTP (testing only).
	SkipTLSCertVerify bool
	// SessionRecorder records client sessions for back-channel logout (optional).
	SessionRecorder storm.ClientSessionRecorder
	// InvalidateRefreshOnUse when true passes the old refresh token to
	// CreateAccessAndRefreshTokens so the storage can atomically invalidate it.
	// This is required by RFC 6749 §10.4 (refresh token rotation) and prevents
	// stolen refresh tokens from being reused. Default: false for backward
	// compatibility with conformance tests. Enable for production deployments.
	InvalidateRefreshOnUse bool
}

type DPoPNonceSender interface {
	// WriteNonceHeader writes the DPoP-Nonce HTTP header to the response.
	WriteNonceHeader(w http.ResponseWriter)
}

type Plugin struct {
	// contains filtered or unexported fields
}