auth

type APIKeyInput struct {
	APIKey string
	Tenant string
}

type BootstrapInput struct {
	AccessToken     string
	PreferredTenant string

	CreateAPIKey     bool
	APIKeyExpiryDays int
	APIKeyName       string
	Picker           TenantPicker

	// RegistrationPrompter is called when the user has no accessible tenant.
	// It should collect registration data interactively and return it. When
	// nil, the zero-tenant case returns the existing "no accessible tenant"
	// error (preserving behaviour for callers that do not support registration).
	RegistrationPrompter func() (*RegistrationInput, error)

	// ConnFor is the control-plane connection builder. Optional. When
	// nil, the package-local default is used. Tests inject a fake.
	ConnFor ControlPlaneConnFunc
}

type BootstrapResult struct {
	Tenant          string
	APIKey          string
	APIKeyExpiresAt time.Time
}

type ControlPlaneConnFunc func(token, tenant string) (*grpc.ClientConn, error)

type DeviceFlowResult struct {
	AccessToken  string
	RefreshToken string
}

type DeviceFlowRetry struct {
	ShouldRetry func(err error) bool
	OnRetry     func(err error)
	OnExhausted func() error
}

type DeviceFlowSink func(verificationURL, userCode string)

type RegisterTenantInput struct {
	AccessToken        string
	Email              string
	Name               string
	OrganizationName   string
	OrganizationDomain string
	// ConnFor is the control-plane connection builder. Optional. When nil,
	// the package-local default is used. Tests inject a fake.
	ConnFor ControlPlaneConnFunc
}

type RegistrationInput struct {
	Email              string
	Name               string
	OrganizationName   string
	OrganizationDomain string
}

type Status struct {
	Profile        string
	Tenant         string
	APIKey         bool
	OAuth          bool
	OAuthExpiresAt time.Time
}

type TenantPicker func(tenants []string) (string, error)