gateway

type AuthConfig struct {
	AuthorizeEndpoint string   `json:"authorize_endpoint"`
	TokenEndpoint     string   `json:"token_endpoint"`
	ClientID          string   `json:"client_id"`
	Scopes            []string `json:"scopes,omitempty"`
	DefaultProvider   string   `json:"default_provider,omitempty"`

	// CallbackPort, when set, instructs the laptop to bind its
	// PKCE callback listener to exactly this port. Required when
	// the IdP matches redirect_uris strictly (e.g. Supabase OAuth
	// Server). The IdP must have `http://127.0.0.1:<port>` in its
	// redirect_uris allow-list. Zero = random kernel-assigned port
	// (RFC 8252 default for native apps).
	CallbackPort int `json:"callback_port,omitempty"`
}

type Config struct {
	// Provisioner resolves a userID into the user's HostRef. EnsureHost
	// is called per-request; the provisioner caches in-process.
	Provisioner provisioner.Provisioner

	// Images is the embedded image-upload presign server. When non-nil,
	// the gateway mounts POST /v1/images. When nil, the route isn't
	// mounted (404).
	Images *images.Server

	// AuthConfig, when non-nil, makes AuthConfigHandler() return a
	// handler that serves this payload as JSON. Daemons wire that
	// handler pre-auth on GET /auth-config so the laptop can
	// discover the IdP before it has a token.
	AuthConfig *AuthConfig

	// Notify, when non-nil, exposes mobile push notifications:
	//   - /devices (POST, DELETE) mount inside Handler() and inherit
	//     whatever user-auth middleware wraps it (same model as Sync).
	//   - /webhooks/notifications mounts pre-auth via the daemon's
	//     parent mux — see NotifyWebhookHandler. The dispatcher does
	//     its own host-bearer verification, so wrapping it with user
	//     auth would reject the host call outright.
	//
	// Construct the dispatcher with notify.NewDispatcher; the laptop
	// daemon passes its in-process store, cloud embedders pass their
	// pgx-backed implementations. Either way, the gateway just mounts.
	Notify *notify.Dispatcher

	// PreviewRoutes is the persistence for tokenized preview URLs. When
	// set together with PreviewHostLookup and PreviewRootDomain, the
	// gateway mounts:
	//   - /v1/preview/tokens/{token}/share, DELETE /v1/preview/tokens/{token},
	//     GET /v1/preview/tokens — owner-facing token management. Inherits
	//     the outer auth wrap.
	//   - PreviewWebhookHandler() — sprite-facing register/revoke,
	//     analogous to NotifyWebhookHandler. Mounted pre-auth by the
	//     daemon.
	// All four must be set together or none — leaving any nil
	// disables the entire preview surface.
	PreviewRoutes routestore.Store

	// PreviewHostLookup resolves a sprite's notifier_token bearer to
	// the host row, used to authenticate /webhooks/preview/*. Same
	// pattern as notify.Dispatcher's HostLookup.
	PreviewHostLookup PreviewHostLookup

	// PreviewRootDomain is the wildcard zone preview URLs live under,
	// e.g. "clankexample.dev". Combined with the per-token leftmost label
	// (preview-<token>) by pkg/preview/tokens.HostFor. Required to
	// render the URL that the register webhook returns to the sprite.
	PreviewRootDomain string

	// PreviewAuthenticator verifies JWTs on owner-only preview-URL
	// requests. Same Authenticator the daemon's main auth.Middleware
	// uses (clank passes its OIDC verifier here). The subdomain
	// proxy lives OUTSIDE auth.Middleware because public-visibility
	// tokens must accept anonymous requests — so we run Verify inline
	// for owner-only tokens only.
	//
	// Required when PreviewRoutes is set.
	PreviewAuthenticator auth.Authenticator

	// PreviewSigningKey is the HMAC secret used to sign short-lived
	// owner-only preview URLs. Clients that can't carry an
	// Authorization header (Expo's dev-launcher, the RN bundle
	// runtime) authenticate via a `?clank_sig=…&clank_exp=…` bearer
	// minted by POST /v1/preview/tokens/{token}/sign.
	//
	// Required when PreviewRoutes is set. Must be at least
	// tokens.MinSigningKeyBytes (32). When empty in a wired-up
	// gateway, NewGateway generates a random key and logs a warning —
	// fine for dev, but a restart invalidates outstanding signed
	// URLs, so production should persist a configured value.
	PreviewSigningKey []byte

	// IdPDeleter, when non-nil, is invoked as the final step of
	// DELETE /v1/account to delete/disable the user in the operator's
	// external SSO. Optional — nil skips the IdP step (clank-data-only
	// deletion). See the IdPDeleter interface.
	IdPDeleter IdPDeleter
}

type Gateway struct {
	// contains filtered or unexported fields
}

type IdPDeleter interface {
	DeleteUser(ctx context.Context, userID string) error
}

type PreviewHostLookup interface {
	GetHostByNotifierToken(ctx context.Context, notifierToken string) (hoststore.Host, error)
}