remote

type BearerTokenSource struct {
	// contains filtered or unexported fields
}

type ClientCredentialsPersister func(
	clientID string,
	clientSecret string,
	secretExpiry time.Time,
	registrationAccessToken string,
	registrationClientURI string,
	tokenEndpointAuthMethod string,
	registeredCallbackPort int,
) error

type Config struct {
	ClientID         string        `json:"client_id,omitempty" yaml:"client_id,omitempty"`
	ClientSecret     string        `json:"client_secret,omitempty" yaml:"client_secret,omitempty"` //nolint:gosec // G117
	ClientSecretFile string        `json:"client_secret_file,omitempty" yaml:"client_secret_file,omitempty"`
	Scopes           []string      `json:"scopes,omitempty" yaml:"scopes,omitempty"`
	SkipBrowser      bool          `json:"skip_browser,omitempty" yaml:"skip_browser,omitempty"`
	Timeout          time.Duration `json:"timeout,omitempty" yaml:"timeout,omitempty" swaggertype:"string" example:"5m"`
	CallbackPort     int           `json:"callback_port,omitempty" yaml:"callback_port,omitempty"`
	UsePKCE          bool          `json:"use_pkce" yaml:"use_pkce"`

	// Resource is the OAuth 2.0 resource indicator (RFC 8707).
	Resource string `json:"resource,omitempty" yaml:"resource,omitempty"`

	// OAuth endpoint configuration (from registry)
	Issuer       string `json:"issuer,omitempty" yaml:"issuer,omitempty"`
	AuthorizeURL string `json:"authorize_url,omitempty" yaml:"authorize_url,omitempty"`
	TokenURL     string `json:"token_url,omitempty" yaml:"token_url,omitempty"`

	// Headers for HTTP requests
	Headers []*registry.Header `json:"headers,omitempty" yaml:"headers,omitempty" swaggerignore:"true"`

	// Environment variables for the client
	EnvVars []*registry.EnvVar `json:"env_vars,omitempty" yaml:"env_vars,omitempty" swaggerignore:"true"`

	// OAuth parameters for server-specific customization
	OAuthParams map[string]string `json:"oauth_params,omitempty" yaml:"oauth_params,omitempty"`

	// ScopeParamName overrides the query parameter name used to send scopes in the
	// authorization URL. When empty, the standard "scope" parameter is used.
	// Some providers require a non-standard name (e.g., Slack uses "user_scope").
	ScopeParamName string `json:"scope_param_name,omitempty" yaml:"scope_param_name,omitempty"`

	// Bearer token configuration (alternative to OAuth)
	BearerToken     string `json:"bearer_token,omitempty" yaml:"bearer_token,omitempty"` //nolint:gosec // G117
	BearerTokenFile string `json:"bearer_token_file,omitempty" yaml:"bearer_token_file,omitempty"`

	// Cached OAuth token reference for persistence across restarts.
	// The refresh token is stored securely in the secret manager, and this field
	// contains the reference to retrieve it (e.g., "OAUTH_REFRESH_TOKEN_workload").
	// This enables session restoration without requiring a new browser-based login.
	CachedRefreshTokenRef string    `json:"cached_refresh_token_ref,omitempty" yaml:"cached_refresh_token_ref,omitempty"`
	CachedTokenExpiry     time.Time `json:"cached_token_expiry,omitempty" yaml:"cached_token_expiry,omitempty"`

	// Cached DCR client credentials for persistence across restarts.
	// These are obtained during Dynamic Client Registration and needed to refresh tokens.
	// ClientID is stored as plain text since it's public information.
	CachedClientID        string `json:"cached_client_id,omitempty" yaml:"cached_client_id,omitempty"`
	CachedClientSecretRef string `json:"cached_client_secret_ref,omitempty" yaml:"cached_client_secret_ref,omitempty"`
	// ClientSecretExpiresAt indicates when the client secret expires (if provided by the DCR server).
	// A zero value means the secret does not expire.
	CachedSecretExpiry time.Time `json:"cached_secret_expiry,omitempty" yaml:"cached_secret_expiry,omitempty"`
	// CachedRegTokenRef is a secret manager reference to the registration_access_token
	// returned in the DCR response. Used for RFC 7592 client update operations.
	// Stored as a secret reference since it's sensitive.
	CachedRegTokenRef string `json:"cached_reg_token_ref,omitempty" yaml:"cached_reg_token_ref,omitempty"`

	// CachedCIMDClientID stores the CIMD metadata URL used as client_id when CIMD
	// authentication was used. Kept separate from CachedClientID (which holds
	// DCR-issued IDs) so the two can have independent lifecycles — DCR credential
	// rotation clears CachedClientID without touching the stable CIMD URL.
	// Read by resolveClientCredentials to send the correct client_id on token refresh.
	CachedCIMDClientID string `json:"cached_cimd_client_id,omitempty" yaml:"cached_cimd_client_id,omitempty"`
	// CachedRegClientURI is the registration_client_uri from the DCR response.
	// This is the endpoint used for RFC 7592 client read/update/delete operations.
	// Stored as plain text since it is not sensitive.
	CachedRegClientURI string `json:"cached_reg_client_uri,omitempty" yaml:"cached_reg_client_uri,omitempty"`
	// CachedTokenEndpointAuthMethod is the auth method used for the token endpoint
	// (e.g., "client_secret_basic", "none"). Persisted for RFC 7592 updates.
	CachedTokenEndpointAuthMethod string `json:"cached_token_auth_method,omitempty" yaml:"cached_token_auth_method,omitempty"`
	// CachedDCRCallbackPort is the callback port that was actually registered
	// during DCR. It may differ from CallbackPort when the requested port was
	// unavailable and a fallback port was selected.
	CachedDCRCallbackPort int `json:"cached_dcr_callback_port,omitempty" yaml:"cached_dcr_callback_port,omitempty"`
}

type Handler struct {
	// contains filtered or unexported fields
}

type PersistingTokenSource struct {
	// contains filtered or unexported fields
}

type TokenPersister func(cachedSession string, expiry time.Time) error