oauthserver

type Client struct {
	ID           string
	Secret       string
	RedirectURIs []string
}

type Config struct {
	Issuer         string
	AccessTokenTTL time.Duration
	SigningKey     []byte
	Clients        []Client
	DCR            DCR
	RateLimit      RateLimit
	Upstream       *Upstream

	// DCRUnusedTTL is the age after which an unused dynamically-registered
	// client is reaped by the store's cleanup routine (database path only).
	// Defaults to defaultDCRUnusedTTL when zero.
	DCRUnusedTTL time.Duration

	// DB selects Postgres-backed storage when non-nil; otherwise in-memory
	// storage is used. Ignored when Storage is set. Only the DB path yields a
	// shared (multi-replica) authorization-state store; see New.
	DB *sql.DB
	// Storage overrides storage selection with a pre-chosen backend. When set,
	// DB is ignored and no store-closer is owned by the Handle. An injected
	// Storage backs client/code/token persistence only: the server still uses
	// the in-memory authorization-state store (multi-replica state sharing
	// requires DB). Primarily a test seam.
	Storage oauth.Storage

	// Metrics records token issuance/refresh outcomes; may be nil.
	Metrics *observability.Metrics
}

type DCR struct {
	Enabled                 bool
	AllowedRedirectPatterns []string
	AllowAllRedirectURIs    bool
}

type Handle struct {
	// contains filtered or unexported fields
}

type RateLimit struct {
	Enabled        *bool
	TrustedProxies []string
	TokenRPM       int
	TokenBurst     int
	RegisterRPM    int
	RegisterBurst  int
}

type Upstream struct {
	Issuer       string
	ClientID     string
	ClientSecret string
	RedirectURI  string

	// AuthorizationEndpoint and TokenEndpoint optionally override OIDC discovery
	// for IdPs with broken discovery documents. Empty means discover.
	AuthorizationEndpoint string
	TokenEndpoint         string
}