cloud

type AuthCaller struct {
	// contains filtered or unexported fields
}

type AuthConfig struct {
	// AuthorizeEndpoint is the IdP's /authorize URL, e.g.
	// "https://abc.supabase.co/oauth/authorize".
	AuthorizeEndpoint string `json:"authorize_endpoint"`

	// TokenEndpoint is the IdP's /token URL, e.g.
	// "https://abc.supabase.co/oauth/token".
	TokenEndpoint string `json:"token_endpoint"`

	// ClientID is the public OAuth client identifier the laptop
	// presents at both endpoints. PKCE replaces the client secret;
	// nothing secret is shipped to the laptop.
	ClientID string `json:"client_id"`

	// Scopes are the OAuth scopes the laptop should request. Joined
	// with spaces on the authorize URL per RFC 6749 §3.3.
	Scopes []string `json:"scopes,omitempty"`

	// DefaultProvider is an optional IdP hint (e.g. "github") the
	// gateway suggests as the primary sign-in option. Passed as the
	// non-spec `provider` query param when set; ignored by IdPs that
	// don't recognise it.
	DefaultProvider string `json:"default_provider,omitempty"`

	// CallbackPort, when set, tells the laptop to bind its PKCE
	// callback listener to exactly this port (instead of a random
	// kernel-assigned port). Required by IdPs that match
	// redirect_uris strictly — Supabase OAuth Server, for example.
	// The IdP must have the same `http://127.0.0.1:<port>` registered
	// as a redirect_uri for the OAuth client.
	CallbackPort int `json:"callback_port,omitempty"`
}

type Client struct {
	// contains filtered or unexported fields
}

type OAuthClient struct {
	// AuthorizeEndpoint is the IdP's authorize URL, e.g.
	// "https://abc.supabase.co/oauth/authorize" or
	// "https://auth.example.com/oauth/authorize".
	AuthorizeEndpoint string

	// TokenEndpoint is the IdP's token URL, e.g.
	// "https://abc.supabase.co/oauth/token".
	TokenEndpoint string

	// ClientID is the public OAuth client identifier registered with
	// the IdP. PKCE replaces the client secret, so no secret here.
	ClientID string

	// Scopes are the OAuth scopes requested at /authorize. Joined
	// with spaces per RFC 6749 §3.3. May be empty.
	Scopes []string

	// Provider is an optional IdP hint passed as the non-standard
	// `provider` query parameter on /authorize. Used by Supabase Auth
	// (and similar) to route the user straight to GitHub / Google /
	// etc. Ignored by IdPs that don't recognise it.
	Provider string

	// OpenBrowser is the function called to launch the user's
	// browser. Optional; defaults to the platform's standard
	// open command. Tests inject a no-op.
	OpenBrowser func(target string) error

	// CallbackHosts is the set of bind hosts the localhost listener
	// will try in order. Default ["127.0.0.1", "localhost"]; most
	// IdPs allow either as a wildcard in their redirect-URI config.
	CallbackHosts []string

	// CallbackPort, when non-zero, pins the localhost listener to
	// exactly this port. Default 0 = kernel-assigned random port,
	// which is what RFC 8252 §7.3 recommends for native apps.
	//
	// Set this when the IdP rejects redirect_uris with arbitrary
	// loopback ports (Supabase OAuth Server, for example, requires
	// an exact match against the registered redirect_uris). The
	// gateway communicates the required port via AuthConfig.
	// If the port is already in use, Login returns an error.
	CallbackPort int

	// HTTPClient is used for the token exchange. Optional;
	// defaults to a 30s-timeout client.
	HTTPClient *http.Client

	// Prompt receives the manual-paste URL when OpenBrowser fails so
	// the user can still complete the flow by opening the link in any
	// browser. nil → os.Stderr (visible by default for CLI callers).
	// Set to io.Discard from TUI contexts where stderr writes would
	// corrupt the display.
	Prompt io.Writer
}

type Session struct {
	AccessToken  string
	RefreshToken string
	UserID       string
	UserEmail    string
	ExpiresAt    int64
}