authapi

type AuthorizeHandler struct {
	// PKCE may be nil; when set, /authorize will stash any code_challenge it
	// receives so the matching /oauth/token exchange can verify the
	// code_verifier.
	PKCE *pkce.Store
	// AllowedRedirectURIs is the allow-list of absolute redirect_uri values
	// that /authorize will 302 to. Mirrors Auth0's per-application
	// "Allowed Callback URLs" tenant setting. Same threat model as
	// LogoutHandler.AllowedReturnURLs but on the higher-value endpoint:
	// /authorize carries `code` / `access_token` in the URL, so an
	// unvalidated redirect_uri leaks them to attacker-controlled hosts.
	// Relative URIs are always permitted. Empty list = no enforcement
	// (test-friendly default).
	AllowedRedirectURIs []string
}

type DBConnectionsChangePasswordHandler struct{}

type DBConnectionsSignupHandler struct{}

type Deps struct {
	Router                       chi.Router
	Keys                         *jwks.KeySet
	Issuer                       string
	DefaultAudience              string
	Log                          zerolog.Logger
	Claims                       *claims.Store
	ClaimMappings                *claims.MappingStore
	Permissions                  *permissions.Store
	PKCE                         *pkce.Store
	MFA                          *mfa.Store
	LogoutAllowedURLs            []string
	AuthorizeAllowedRedirectURIs []string
}

type DiscoveryHandler struct {
	// contains filtered or unexported fields
}

type LogoutHandler struct {
	AllowedReturnURLs []string
}

type PasswordlessStartHandler struct{}

type PasswordlessVerifyHandler struct {
	Keys            *jwks.KeySet
	DefaultAudience string
	Claims          *claims.Store
	Permissions     *permissions.Store
}

type RevokeHandler struct{}

type TokenHandler struct {
	Keys            *jwks.KeySet
	Issuer          string
	DefaultAudience string
	Log             zerolog.Logger
	Claims          *claims.Store
	// ClaimMappings may be nil. When a request-parameter → claim-name
	// mapping is registered (via /admin0/claims/mappings), the value of that
	// body parameter is projected into every minted access token, taking
	// precedence over the global claims store. Empty store = feature off.
	ClaimMappings *claims.MappingStore
	Permissions   *permissions.Store
	// PKCE may be nil. When set and the authorization_code grant supplies a
	// code that was stashed at /authorize with a code_challenge, the matching
	// code_verifier is required and verified.
	PKCE *pkce.Store
	// MFA may be nil. When set and IsRequired() returns true, the password
	// and password-realm grants return 403 mfa_required + mfa_token instead
	// of minting; the three Auth0 mfa-* grants then trade the mfa_token plus
	// a fixed canned challenge for an access_token.
	MFA *mfa.Store
}

type UserInfoHandler struct {
	Keys *jwks.KeySet
}