oauth

type AuthorizationCode struct {
	ID string `json:"id"`
	// Code carries the raw value when issuing; Storage implementations
	// persist only its SHA-256 digest (HashToken), so records read back
	// from storage hold the digest, never a usable credential.
	Code          string         `json:"code"`
	ClientID      string         `json:"client_id"`
	UserID        string         `json:"user_id"`
	UserClaims    map[string]any `json:"user_claims"`
	CodeChallenge string         `json:"code_challenge"`
	RedirectURI   string         `json:"redirect_uri"`
	Scope         string         `json:"scope"`
	ExpiresAt     time.Time      `json:"expires_at"`
	Used          bool           `json:"used"`
	CreatedAt     time.Time      `json:"created_at"`
}

type AuthorizationRequest struct {
	ResponseType        string
	ClientID            string
	RedirectURI         string
	Scope               string
	State               string
	CodeChallenge       string
	CodeChallengeMethod string
}

type AuthorizationState struct {
	// ClientID is the OAuth client's client_id (e.g., Claude Desktop).
	ClientID string

	// RedirectURI is where to send the client after authentication.
	RedirectURI string

	// State is the client's original state parameter.
	State string

	// CodeChallenge is the PKCE challenge from the client.
	CodeChallenge string

	// CodeChallengeMethod is the PKCE method (S256; the only supported method).
	CodeChallengeMethod string

	// Scope is the requested scope.
	Scope string

	// UpstreamState is the state for the upstream IdP (e.g., Keycloak).
	UpstreamState string

	// PromptNoneAttempted tracks whether we already tried prompt=none
	// for this flow. Used to prevent infinite redirect loops when the
	// upstream IdP returns login_required.
	PromptNoneAttempted bool

	// CreatedAt is when this state was created.
	CreatedAt time.Time
}

type Client struct {
	ID           string    `json:"id"`
	ClientID     string    `json:"client_id"`
	ClientSecret string    `json:"client_secret"` // #nosec G117 -- bcrypt hashed, required for OAuth client storage
	Name         string    `json:"name"`
	RedirectURIs []string  `json:"redirect_uris"`
	GrantTypes   []string  `json:"grant_types"`
	RequirePKCE  bool      `json:"require_pkce"`
	CreatedAt    time.Time `json:"created_at"`
	Active       bool      `json:"active"`
	// DynamicallyRegistered marks clients created through the unauthenticated
	// DCR /register endpoint (RFC 7591), as opposed to pre-registered
	// config-file clients. Only DCR clients are eligible for TTL-based cleanup
	// of unused registrations.
	DynamicallyRegistered bool `json:"dynamically_registered"`
}

type DCRConfig struct {
	// Enabled enables DCR.
	Enabled bool

	// AllowedRedirectPatterns are regex patterns for allowed redirect URIs.
	// The registration endpoint is unauthenticated, so leaving this empty
	// denies all registrations unless AllowAllRedirectURIs is set.
	AllowedRedirectPatterns []string

	// AllowAllRedirectURIs explicitly opts out of redirect URI pattern
	// matching, accepting any HTTPS (or loopback HTTP) redirect URI. An
	// attacker-controlled redirect URI is the setup for authorization-code
	// interception, so this is an explicit escape hatch rather than the
	// default for an empty pattern list.
	AllowAllRedirectURIs bool

	// DefaultGrantTypes are the default grant types for new clients.
	DefaultGrantTypes []string

	// RequirePKCE requires PKCE for all clients.
	RequirePKCE bool
}

type DCRRequest struct {
	ClientName              string   `json:"client_name"`
	RedirectURIs            []string `json:"redirect_uris"`
	GrantTypes              []string `json:"grant_types,omitempty"`
	TokenEndpointAuthMethod string   `json:"token_endpoint_auth_method,omitempty"`
}

type DCRResponse struct {
	ClientID              string   `json:"client_id"`
	ClientSecret          string   `json:"client_secret,omitempty"` // #nosec G117 -- required by OAuth 2.0 DCR spec (RFC 7591)
	ClientName            string   `json:"client_name"`
	RedirectURIs          []string `json:"redirect_uris"`
	GrantTypes            []string `json:"grant_types"`
	ClientSecretExpiresAt int      `json:"client_secret_expires_at"` // 0 means never
}

type DCRService struct {
	// contains filtered or unexported fields
}

type ErrorResponse struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type MemoryStateStore struct {
	// contains filtered or unexported fields
}

type MemoryStorage struct {
	// contains filtered or unexported fields
}

type PKCEMethod string

type RateLimitConfig struct {
	// Enabled turns limiting on/off; nil means enabled (platform default-on).
	Enabled *bool

	// TrustedProxies is the set of CIDRs whose X-Forwarded-For headers are
	// trusted for client attribution. Empty means trust none: the direct peer
	// address is used and forwarding headers are ignored.
	TrustedProxies []string

	// TokenRPM / TokenBurst limit /token per client IP.
	TokenRPM   int
	TokenBurst int

	// RegisterRPM / RegisterBurst limit /register per client IP.
	RegisterRPM   int
	RegisterBurst int
}

type RefreshToken struct {
	ID string `json:"id"`
	// Token carries the raw value when issuing; Storage implementations
	// persist only its SHA-256 digest (HashToken), so records read back
	// from storage hold the digest, never a usable credential.
	Token      string         `json:"token"`
	ClientID   string         `json:"client_id"`
	UserID     string         `json:"user_id"`
	UserClaims map[string]any `json:"user_claims"`
	Scope      string         `json:"scope"`
	ExpiresAt  time.Time      `json:"expires_at"`
	CreatedAt  time.Time      `json:"created_at"`
}

type Server struct {
	// contains filtered or unexported fields
}

type ServerConfig struct {
	// Issuer is the OAuth issuer URL.
	Issuer string

	// AccessTokenTTL is the access token lifetime.
	AccessTokenTTL time.Duration

	// RefreshTokenTTL is the refresh token lifetime.
	RefreshTokenTTL time.Duration

	// AuthCodeTTL is the authorization code lifetime.
	AuthCodeTTL time.Duration

	// SigningKey is the HMAC key used to sign JWT access tokens.
	// If not provided, tokens will be opaque (not recommended for production).
	// Generate with: openssl rand -base64 32
	SigningKey []byte

	// DCR configures Dynamic Client Registration.
	DCR DCRConfig

	// Upstream configures the upstream identity provider (e.g., Keycloak).
	Upstream *UpstreamConfig

	// RateLimit configures rate limiting for the unauthenticated /token and
	// /register endpoints. Limiting is on by default (see RateLimitConfig).
	RateLimit RateLimitConfig
}

type StateStore interface {
	// SaveState stores an authorization state, replacing any existing
	// state under the same key.
	SaveState(ctx context.Context, key string, state *AuthorizationState) error

	// GetState retrieves an authorization state.
	GetState(ctx context.Context, key string) (*AuthorizationState, error)

	// DeleteState removes an authorization state.
	DeleteState(ctx context.Context, key string) error

	// CleanupExpiredStates removes states older than maxAge.
	CleanupExpiredStates(ctx context.Context, maxAge time.Duration) error
}

type Storage interface {
	// Client management
	CreateClient(ctx context.Context, client *Client) error
	GetClient(ctx context.Context, clientID string) (*Client, error)
	UpdateClient(ctx context.Context, client *Client) error
	DeleteClient(ctx context.Context, clientID string) error
	ListClients(ctx context.Context) ([]*Client, error)

	// Authorization code management. Implementations persist only the
	// SHA-256 digest of the code value (HashToken); the get, delete, and
	// consume methods take the raw value and hash it before comparison.
	SaveAuthorizationCode(ctx context.Context, code *AuthorizationCode) error
	GetAuthorizationCode(ctx context.Context, code string) (*AuthorizationCode, error)
	DeleteAuthorizationCode(ctx context.Context, code string) error
	// ConsumeAuthorizationCode atomically deletes the authorization code
	// and returns it, so single-use invalidation and retrieval cannot
	// diverge: a replayed or concurrently exchanged code fails because
	// the record is already gone. Returns an error when the code does
	// not exist.
	ConsumeAuthorizationCode(ctx context.Context, code string) (*AuthorizationCode, error)
	CleanupExpiredCodes(ctx context.Context) error

	// Token management. Implementations persist only the SHA-256 digest
	// of the token value (HashToken); the get, delete, and consume
	// methods take the raw value and hash it before comparison.
	SaveRefreshToken(ctx context.Context, token *RefreshToken) error
	GetRefreshToken(ctx context.Context, token string) (*RefreshToken, error)
	DeleteRefreshToken(ctx context.Context, token string) error
	// ConsumeRefreshToken atomically deletes the refresh token and
	// returns it, backing rotation: the old token is provably invalid
	// before new tokens are issued. Returns an error when the token
	// does not exist.
	ConsumeRefreshToken(ctx context.Context, token string) (*RefreshToken, error)
	DeleteRefreshTokensForClient(ctx context.Context, clientID string) error
	CleanupExpiredTokens(ctx context.Context) error
}

type TokenRequest struct {
	GrantType    string
	Code         string
	RedirectURI  string
	ClientID     string
	ClientSecret string // #nosec G117 -- required by OAuth 2.1 token request (RFC 6749 §4.1.3)
	CodeVerifier string
	RefreshToken string // #nosec G117 -- required by OAuth 2.1 refresh grant (RFC 6749 §6)
	Scope        string
}

type TokenResponse struct {
	AccessToken  string `json:"access_token"` // #nosec G117 -- required by OAuth 2.1 token response (RFC 6749 §5.1)
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"` // #nosec G117 -- required by OAuth 2.1 token response (RFC 6749 §5.1)
	Scope        string `json:"scope,omitempty"`
}

type UpstreamConfig struct {
	// Issuer is the upstream IdP issuer URL (e.g., Keycloak realm URL).
	Issuer string

	// ClientID is the MCP server's client ID in the upstream IdP.
	ClientID string

	// ClientSecret is the MCP server's client secret.
	ClientSecret string // #nosec G117 -- required for upstream IdP token exchange

	// RedirectURI is the callback URL for the upstream IdP.
	RedirectURI string

	// AuthorizationEndpoint, when set, is used verbatim as the upstream IdP's
	// authorization endpoint, bypassing OIDC discovery. Empty (default) means
	// discover it from the issuer's well-known configuration document. Provide it
	// only for IdPs whose discovery document is broken or unreachable.
	AuthorizationEndpoint string

	// TokenEndpoint, when set, is used verbatim as the upstream IdP's token
	// endpoint, bypassing OIDC discovery. Empty (default) means discover it.
	// Discovery is skipped entirely only when BOTH endpoints are set.
	TokenEndpoint string
}