auth

type Authorizer interface {
	// Authorize adds the Authorization header to req. In OAuth mode it
	// transparently refreshes an expired access token first (returning a
	// non-nil error if the session is dead). In no-credentials mode it is
	// a no-op returning nil so genuinely-public requests still go out.
	Authorize(ctx context.Context, req *http.Request) error

	// BearerToken returns the raw credential string — a fresh OAuth access
	// token (refreshed if needed) or the API key — for carriers that
	// cannot take an *http.Request (the WebSocket dialer). Returns
	// [ErrNoCredentials] in no-credentials mode.
	BearerToken(ctx context.Context) (string, error)

	// ForceRefresh proactively discards any cached credential and obtains a
	// fresh one. In OAuth mode it runs the refresh grant unconditionally
	// (used reactively when the server rejects a token the client still
	// believes is valid — a 401 on the HTTP API, or a token_expired push on
	// the WebSocket — to break the otherwise-possible "reuse the stale
	// token" loop). It is a no-op for the API-key and no-credentials modes.
	// Returns [ErrSessionExpired] when the refresh token is dead.
	ForceRefresh(ctx context.Context) error

	// AccessTokenExpiry reports when the current OAuth access token expires,
	// so a long-lived carrier (the console WebSocket) can proactively
	// refresh in-band before the server force-disconnects. Returns the zero
	// time for the API-key and no-credentials modes (no expiry).
	AccessTokenExpiry() time.Time

	// Mode reports the active credential type.
	Mode() Mode
}

type Credentials struct {
	// APIKey is the merged api_key value (config file, env, or flag).
	APIKey string
	// APIKeyExplicit is true when the key came from an intentional
	// override — the --api-key flag or TRUESTAMP_API_KEY env — as opposed
	// to the config file. An explicit key wins over an OAuth session so
	// CI/headless behavior is deterministic.
	APIKeyExplicit bool
}

type Discovery struct {
	Issuer                            string   `json:"issuer"`
	AuthorizationEndpoint             string   `json:"authorization_endpoint"`
	TokenEndpoint                     string   `json:"token_endpoint"`
	RevocationEndpoint                string   `json:"revocation_endpoint"`
	RegistrationEndpoint              string   `json:"registration_endpoint"`
	GrantTypesSupported               []string `json:"grant_types_supported"`
	ResponseTypesSupported            []string `json:"response_types_supported"`
	CodeChallengeMethodsSupported     []string `json:"code_challenge_methods_supported"`
	ScopesSupported                   []string `json:"scopes_supported"`
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported"`
}

type LoginOptions struct {
	// Open opens a URL in the user's browser. Defaults to browser.OpenURL.
	Open func(string) error
	// Out receives the human-facing "open this URL" guidance. Defaults to
	// io.Discard.
	Out io.Writer
}

type Mode int

type Session struct {
	Issuer        string    `json:"issuer"`
	AuthURL       string    `json:"auth_url"`
	TokenURL      string    `json:"token_url"`
	RevocationURL string    `json:"revocation_url,omitempty"`
	AccessToken   string    `json:"access_token"`
	RefreshToken  string    `json:"refresh_token"`
	TokenType     string    `json:"token_type"`
	Scope         string    `json:"scope,omitempty"`
	Expiry        time.Time `json:"expiry"`
}

type Store struct {
	// contains filtered or unexported fields
}