oauth

type Config struct {
	// ClientID is the OAuth client ID
	ClientID string

	// ClientSecret is the OAuth client secret (optional for PKCE flow)
	ClientSecret string

	// RedirectURL is the redirect URL for the OAuth flow
	RedirectURL string

	// AuthURL is the authorization endpoint URL
	AuthURL string

	// TokenURL is the token endpoint URL
	TokenURL string

	// Scopes are the OAuth scopes to request
	Scopes []string

	// UsePKCE enables PKCE (Proof Key for Code Exchange) for enhanced security
	UsePKCE bool

	// CallbackPort is the port for the OAuth callback server (optional, 0 means auto-select)
	CallbackPort int

	// IntrospectionEndpoint is the optional introspection endpoint for validating tokens
	IntrospectionEndpoint string

	// OAuthParams are additional parameters to pass to the authorization URL
	OAuthParams map[string]string
}

type Flow struct {
	// contains filtered or unexported fields
}

type OIDCDiscoveryDocument struct {
	Issuer                        string   `json:"issuer"`
	AuthorizationEndpoint         string   `json:"authorization_endpoint"`
	IntrospectionEndpoint         string   `json:"introspection_endpoint,omitempty"`
	TokenEndpoint                 string   `json:"token_endpoint"`
	UserinfoEndpoint              string   `json:"userinfo_endpoint"`
	JWKSURI                       string   `json:"jwks_uri"`
	CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported,omitempty"`
}

type TokenResult struct {
	AccessToken  string
	RefreshToken string
	TokenType    string
	Expiry       time.Time
	Claims       jwt.MapClaims
	IDToken      string // The OIDC ID token (JWT), if present
}