auth

type Actor struct {
	Kind Kind

	UserID    int64 // resolved user pk; 0 for anonymous
	UserLogin string
	SiteAdmin bool
	TokenID   int64 // tokens.pk of the credential used; 0 for anonymous

	// App-bound fields; non-zero only for KindInstallation and KindAppJWT.
	AppID          int64
	InstallationID int64

	Scopes    Scopes
	ExpiresAt *time.Time

	// RateKey identifies the rate-limit bucket this actor is charged against.
	RateKey string
}

type CodeRequest struct {
	ClientID    string
	RedirectURI string
	Scope       string
	UserPK      int64
}

type DeviceCodeResult struct {
	DeviceCode      string
	UserCode        string
	VerificationURI string
	ExpiresIn       int
	Interval        int
}

type DeviceTokenOutcome struct {
	Token            *IssuedToken
	Error            string // authorization_pending | slow_down | expired_token | access_denied | ...
	ErrorDescription string
	Interval         int // set with slow_down
}

type Generated struct {
	Plaintext string   // shown once, never stored
	Prefix    string   // "ghp_" etc.
	Hash      [32]byte // sha256(Plaintext); store Hash[:] in tokens.token_hash
	Last8     string   // last eight chars, for the settings UI
}

type IssuedToken struct {
	AccessToken string
	TokenType   string
	Scope       string
}

type Kind uint8

type PATInfo struct {
	ID         int64
	Note       string
	Scopes     string // header form, e.g. "gist, repo"
	LastEight  string
	CreatedAt  time.Time
	LastUsedAt *time.Time
}

type Scope string

type Scopes []Scope

type Service struct {
	// contains filtered or unexported fields
}

type Store interface {
	// Credential resolution.
	TokenByHash(ctx context.Context, hash []byte) (*store.TokenRow, error)
	UserByPK(ctx context.Context, pk int64) (*store.UserRow, error)
	BumpTokenLastUsed(ctx context.Context, at map[int64]time.Time) error

	// Personal access token management (the settings tokens page).
	TokensForUser(ctx context.Context, userPK int64) ([]*store.TokenRow, error)
	DeleteUserToken(ctx context.Context, pk, userPK int64) error

	// OAuth device flow.
	OAuthAppByClientID(ctx context.Context, clientID string) (*store.OAuthAppRow, error)
	InsertOAuthApp(ctx context.Context, a *store.OAuthAppRow) error
	InsertToken(ctx context.Context, t *store.TokenRow) error
	InsertDeviceCode(ctx context.Context, d *store.DeviceCodeRow) error
	DeviceCodeByHash(ctx context.Context, hash []byte) (*store.DeviceCodeRow, error)
	DeviceCodeByUserCode(ctx context.Context, userCode string) (*store.DeviceCodeRow, error)
	SetDeviceState(ctx context.Context, pk int64, state string, userPK int64) error
	SetDeviceInterval(ctx context.Context, pk int64, interval int) error
	SetDevicePolled(ctx context.Context, pk int64, at time.Time) error
	DeleteDeviceCode(ctx context.Context, pk int64) error

	// OAuth web flow (authorization code grant).
	InsertAuthCode(ctx context.Context, a *store.AuthCodeRow) error
	ConsumeAuthCode(ctx context.Context, codeHash []byte) (*store.AuthCodeRow, error)

	// GitHub App auth.
	GitHubAppByPK(ctx context.Context, pk int64) (*store.GitHubAppRow, error)
	InstallationByPK(ctx context.Context, pk int64) (*store.InstallationRow, error)
	InstallationByDBID(ctx context.Context, dbID int64) (*store.InstallationRow, error)
	InstallationByAppAndAccount(ctx context.Context, appPK, accountPK int64) (*store.InstallationRow, error)
	InstallationsByAppPK(ctx context.Context, appPK int64) ([]*store.InstallationRow, error)
	InstallationRepoPKs(ctx context.Context, instPK int64) ([]int64, error)
}