oauth

type AnthropicHook struct{}

type AntigravityHook struct{}

type AuthStyle int

type CallbackServer struct {
	// contains filtered or unexported fields
}

type CodexHook struct{}

type Config struct {
	// BaseURL is the base URL of this server for callback generation
	BaseURL string

	// ProviderConfigs maps provider types to their OAuth configurations
	ProviderConfigs map[ProviderType]*ProviderConfig

	// TokenStorage is the storage for OAuth tokens
	TokenStorage TokenStorage

	// StateExpiry is the duration for which OAuth state is valid
	StateExpiry time.Duration

	// TokenExpiryBuffer is the buffer before token expiry to trigger refresh
	TokenExpiryBuffer time.Duration

	// ProxyURL is the HTTP proxy URL for OAuth requests (e.g., "http://proxy.example.com:8080")
	// Can be set via OAUTH_PROXY_URL environment variable
	ProxyURL *url.URL
}

type DeviceCodeData struct {
	*DeviceCodeResponse
	Provider     ProviderType
	UserID       string
	RedirectTo   string
	Name         string
	ExpiresAt    time.Time
	InitiatedAt  time.Time
	CodeVerifier string // PKCE code verifier (for Device Code PKCE flow)
}

type DeviceCodePendingError struct {
	Message string
}

type DeviceCodeResponse struct {
	// DeviceCode is the device verification code
	DeviceCode string `json:"device_code"`

	// UserCode is the end-user verification code
	UserCode string `json:"user_code"`

	// VerificationURI is the end-user verification URI where user enters the user code
	VerificationURI string `json:"verification_uri"`

	// VerificationURIComplete is the end-user verification URI with user_code pre-filled
	VerificationURIComplete string `json:"verification_uri_complete,omitempty"`

	// ExpiresIn is the lifetime in seconds of the device_code and user_code
	ExpiresIn int64 `json:"expires_in"`

	// Interval is the minimum amount of time in seconds that the client SHOULD wait
	// between polling requests to the token endpoint
	Interval int64 `json:"interval,omitempty"`
}

type DeviceTokenRequest struct {
	// GrantType is the grant type, must be "urn:ietf:params:oauth:grant-type:device_code"
	GrantType string `json:"grant_type"`

	// DeviceCode is the device code from the device authorization response
	DeviceCode string `json:"device_code"`

	// ClientID is the OAuth client ID
	ClientID string `json:"client_id"`

	// ClientSecret is the OAuth client secret (optional for public clients)
	ClientSecret string `json:"client_secret,omitempty"`
}

type GeminiHook struct{}

type IFlowHook struct {
	ClientID     string
	ClientSecret string
}

type Manager struct {
	Debug bool
	// contains filtered or unexported fields
}

type MemoryTokenStorage struct {
	// contains filtered or unexported fields
}

type MetadataTokenStorage interface {
	TokenStorage

	// SaveTokenWithMetadata saves a token with additional metadata
	SaveTokenWithMetadata(userID string, provider ProviderType, token *Token, metadata map[string]string) error

	// GetTokenWithMetadata retrieves a token with metadata
	GetTokenWithMetadata(userID string, provider ProviderType) (*TokenWithMetadata, error)

	// ListAllTokens returns all tokens with their metadata
	ListAllTokens() ([]*TokenWithMetadata, error)
}

type NoopHook struct{}

type OAuthMethod int

type Option func(*Options)

type Options struct {
	// ProxyURL overrides the default proxy for this request
	ProxyURL *url.URL

	// HTTPClient allows passing a custom HTTP client
	HTTPClient *http.Client
}

type ProviderConfig struct {
	// Type is the provider type
	Type ProviderType

	GrantType string

	// DisplayName is the human-readable name
	DisplayName string

	// ClientID is the OAuth client ID
	ClientID string

	// ClientSecret is the OAuth client secret
	ClientSecret string

	// AuthURL is the authorization endpoint URL
	AuthURL string

	// DeviceCodeURL is the device authorization endpoint URL (for Device Code flow)
	DeviceCodeURL string

	// TokenURL is the token endpoint URL
	TokenURL string

	// Scopes is the list of OAuth scopes to request
	Scopes []string

	// AuthStyle is the authentication style (in header, body, etc.)
	AuthStyle AuthStyle

	// OAuthMethod is the OAuth flow method (authorization code or PKCE)
	OAuthMethod OAuthMethod

	// RedirectURL is the OAuth redirect URI (optional, uses default if empty)
	RedirectURL string

	// Callback is the callback route path (optional, defaults to "/callback")
	// Some providers require specific callback paths, e.g., codex requires "/auth/callback"
	Callback string

	// ConsoleURL is the URL to the provider's console for creating OAuth apps
	ConsoleURL string

	// TokenRequestFormat specifies the format of token request body
	// Default is TokenRequestFormatForm (standard OAuth)
	TokenRequestFormat TokenRequestFormat

	// StateEncoding specifies the encoding format for OAuth state parameter
	// Default is StateEncodingHex (standard)
	StateEncoding StateEncoding

	// Hook is the request preprocessing hook for provider-specific behavior
	Hook RequestHook

	// CallbackPorts specifies allowed ports for the callback URL
	// Empty = no constraint (any port is allowed)
	// Some providers require specific ports, e.g., codex allows [1455]
	CallbackPorts []int
}

type ProviderInfo struct {
	Type        ProviderType `json:"type"`
	DisplayName string       `json:"display_name"`
	AuthURL     string       `json:"auth_url,omitempty"`
	Scopes      []string     `json:"scopes,omitempty"`
	Configured  bool         `json:"configured"` // Has client credentials
}

type ProviderType string

type QwenHook struct{}

type Registry struct {
	// contains filtered or unexported fields
}

type RequestHook interface {
	// BeforeAuth is called before building the authorization URL.
	// The params map contains URL query parameters that can be modified or extended.
	BeforeAuth(params map[string]string) error

	// BeforeToken is called before sending any token-related HTTP request.
	// This covers: token exchange, refresh token, device code request, and device token polling.
	// The body map contains request body parameters, header is the HTTP headers.
	BeforeToken(body map[string]string, header http.Header) error

	// AfterToken is called after successful token exchange to fetch additional metadata.
	// Returns additional metadata to be stored with the token (email, project_id, api_key, etc).
	// Can return nil map if no additional metadata is needed.
	AfterToken(ctx context.Context, accessToken string, httpClient *http.Client) (map[string]any, error)
}

type SessionState struct {
	SessionID    string        `json:"session_id"`
	Status       SessionStatus `json:"status"`
	Provider     ProviderType  `json:"provider"`
	UserID       string        `json:"user_id"`
	CreatedAt    time.Time     `json:"created_at"`
	ExpiresAt    time.Time     `json:"expires_at"`
	ProviderUUID string        `json:"provider_uuid,omitempty"` // Set when success
	Error        string        `json:"error,omitempty"`         // Set when failed
	ProxyURL     string        `json:"proxy_url,omitempty"`     // Proxy URL used for this session
}

type SessionStatus string

type StateData struct {
	State         string
	UserID        string
	Provider      ProviderType
	ExpiresAt     time.Time
	Timestamp     int64  // Unix timestamp when state was created
	ExpiresAtUnix int64  // Unix timestamp when state expires
	RedirectTo    string // Optional redirect URL after successful auth
	Name          string // Optional custom provider name
	CodeVerifier  string // PKCE code verifier (for PKCE flow)
	RedirectURI   string // Actual redirect_uri used in auth request (must match in token request)
	SessionID     string // Session ID for status tracking
}

type StateEncoding int

type Token struct {
	// AccessToken is the access token
	AccessToken string `json:"access_token"`

	// RefreshToken is the refresh token (may be empty)
	RefreshToken string `json:"refresh_token"`

	// IDToken is the OpenID Connect ID token (may be empty)
	IDToken string `json:"id_token,omitempty"`

	// TokenType is the type of token (usually "Bearer")
	TokenType string `json:"token_type"`

	// ExpiresIn is the token expiration duration in seconds (from API response)
	ExpiresIn int64 `json:"expires_in"`

	// Expiry is the token expiration time (zero if no expiry)
	Expiry time.Time `json:"-"`

	// Provider is the provider that issued this token
	Provider ProviderType `json:"-"`

	// RedirectTo is the optional URL to redirect to after successful OAuth
	RedirectTo string `json:"-"`

	// Name is the optional custom name for the provider
	Name string `json:"-"`

	// ResourceURL is the optional resource URL endpoint (for some providers like Qwen)
	ResourceURL string `json:"resource_url,omitempty"`

	// Metadata contains additional provider-specific information (email, project_id, api_key, etc)
	Metadata map[string]any `json:"metadata,omitempty"`

	// SessionID is the OAuth session ID for status tracking
	SessionID string `json:"-"`
}

type TokenRequestFormat int

type TokenStorage interface {
	// SaveToken saves a token for the given user and provider
	SaveToken(userID string, provider ProviderType, token *Token) error

	// GetToken retrieves a token for the given user and provider
	GetToken(userID string, provider ProviderType) (*Token, error)

	// DeleteToken removes a token for the given user and provider
	DeleteToken(userID string, provider ProviderType) error

	// ListProviders returns all providers that have tokens for the user
	ListProviders(userID string) ([]ProviderType, error)
}

type TokenWithMetadata struct {
	Token     *Token
	UserID    string
	Provider  ProviderType
	CreatedAt time.Time
	UpdatedAt time.Time
}