oauth

type Config struct {
	// ClientID is the OAuth client ID
	ClientID string

	// ClientSecret is the OAuth client secret (optional for PKCE flow)
	ClientSecret string //nolint:gosec // G117: field legitimately holds sensitive data

	// RedirectURL is the redirect URL for the OAuth flow
	RedirectURL string

	// AuthURL is the authorization endpoint URL
	AuthURL string

	// TokenURL is the token endpoint URL
	TokenURL string

	// Scopes are the OAuth scopes to request
	Scopes []string

	// UsePKCE enables PKCE (Proof Key for Code Exchange) for enhanced security
	UsePKCE bool

	// CallbackPort is the port for the OAuth callback server (optional, 0 means auto-select)
	CallbackPort int

	// IntrospectionEndpoint is the optional introspection endpoint for validating tokens
	IntrospectionEndpoint string

	// Resource is the OAuth 2.0 resource indicator (RFC 8707).
	Resource string

	// OAuthParams are additional parameters to pass to the authorization URL
	OAuthParams map[string]string

	// ScopeParamName overrides the query parameter name used to send scopes in the
	// authorization URL. When empty (default), the standard "scope" parameter is used.
	// Some providers use non-standard parameter names (e.g., Slack uses "user_scope"
	// for user-token scopes). When set, scopes are sent under this parameter name
	// instead of "scope", and the standard "scope" parameter is cleared.
	ScopeParamName string

	// TokenEndpointTrusted reports that the token endpoint's authority was
	// supplied by the operator — either configured directly, or named by the
	// operator-configured issuer's own metadata document. Because the operator
	// chose that authority, the endpoint may be a private, loopback, or
	// link-local address. The zero value is the guarded posture and is what an
	// endpoint named by a remote MCP server, or by a metadata document pointing
	// at some other authority, must keep.
	TokenEndpointTrusted bool
}

type Flow struct {
	// contains filtered or unexported fields
}

type NonCachingRefresher struct {
	// contains filtered or unexported fields
}

type TokenResult struct {
	AccessToken  string //nolint:gosec // G117: field legitimately holds sensitive data
	RefreshToken string //nolint:gosec // G117: field legitimately holds sensitive data
	TokenType    string
	Expiry       time.Time
	Claims       jwt.MapClaims
	IDToken      string // The OIDC ID token (JWT), if present
}