idp

type Client struct {
	ProviderHost    string
	AuthnPath       string
	AuthorizePath   string
	TokenPath       string
	TenantTokenPath string
	DevicePath      string
	CsrfTokenPath   string
	Insecure        bool
}

type ClientCredentialsRetriever struct {
	*Client
	// ClientID to authenticate as which corresponds to a Client Credentials flow supported IdP client
	ClientID string
	// ClientSecret corresponding to the ClientID above
	ClientSecret *util.Credential
	// Scope(s) to request, separated by spaces -- this will be a custom scope, for example: "backend_service"
	Scope string
}

type Context struct {
	TokenType    string `json:"token_type"`
	AccessToken  string `json:"access_token"`
	ExpiresIn    int    `json:"expires_in"`
	Scope        string `json:"scope"`
	IDToken      string `json:"id_token,omitempty"`
	RefreshToken string `json:"refresh_token,omitempty"`
	StartTime    int64
}

type DeviceCodeInfo struct {
	DeviceCode      string `json:"device_code"`
	UserCode        string `json:"user_code"`
	ExpiresIn       int    `json:"expires_in"`
	Interval        int    `json:"interval"`
	VerificationURI string `json:"verification_uri"`
}

type DeviceFlowRetriever struct {
	*Client
	// ClientID corresponding to a Device flow supported IdP client
	ClientID string
	// Tenant to request an access token for
	Tenant string
	// DeviceCode to poll for the token with
	DeviceCode string
	// ExpiresIn indicates the expiry of the DeviceCode in seconds
	ExpiresIn int
	// Interval indicates the polling interval
	Interval int
}

type HTTPError struct {
	StatusCode int                    `json:"status,omitempty"`
	Body       map[string]interface{} `json:"body,omitempty"`
}

type NoOpTokenRetriever struct {
	Context *Context
}

type OIDCScope string

type PKCERetriever struct {
	*Client
	// ClientID corresponding to a PKCE flow supported IdP client
	ClientID string
	// RedirectURI that has been allowlisted according to the ClientID (NOTE: redirection is not actually needed for this implementation but this URI must match one specified by the IdP)
	RedirectURI string
	// Scope(s) to request, separated by spaces -- "openid email profile" is recommended for individual users
	Scope string
	// Username to authenticate as which must be registered to the ClientID in the IdP
	Username string
	// Password corresponding to the Username above
	Password *util.Credential
}

type RefreshTokenRetriever struct {
	*Client
	// ClientID which corresponds to an Refresh Token ("offline_access" scope) supported IdP client
	ClientID string
	// Scope(s) to request, separated by spaces -- "openid email profile" is recommended for individual users
	Scope string
	// RefreshToken to use to authenticate in order to generate an access token
	RefreshToken *util.Credential
}

type TokenRetriever interface {
	GetTokenContext() (*Context, error)
}