token

type Broker interface {
	// Refresh uses a refresh token to obtain new access/ID tokens.
	Refresh(ctx context.Context, key Key, refreshToken string) (*scyauth.Token, error)
	// Exchange converts an authorization code to tokens (for OOB/scheduled flows).
	Exchange(ctx context.Context, key Key, code string) (*scyauth.Token, error)
}

type BrokerRegistry interface {
	Broker(ctx context.Context, provider string) (Broker, bool)
}

type InstanceID string

type Key struct {
	Subject  string // user identifier (from EffectiveUserID)
	Provider string // oauth provider name (e.g. "google", "default")
}

type Manager struct {
	// contains filtered or unexported fields
}

type ManagerOption func(*Manager)

type OAuthToken struct {
	Username     string
	Provider     string
	AccessToken  string
	IDToken      string
	RefreshToken string
	ExpiresAt    time.Time

	Issuer      string
	Resource    string
	Scopes      []string
	TokenType   string
	Subject     string
	ProviderRef string
	ClientRef   string
	// IDTokenExpiresAt mirrors the verified ID-token exp; ExpiresAt remains
	// the access-token expiry for compatibility.
	IDTokenExpiresAt time.Time
	// IssuedAt records when the token set was obtained; the refresh policy
	// derives the original selected-token lifetime from it.
	IssuedAt time.Time
}

type Provider interface {
	// EnsureTokens checks if tokens in context are fresh; if not, refreshes
	// from cache or via Broker, and returns updated context.
	EnsureTokens(ctx context.Context, key Key) (context.Context, error)

	// Store persists tokens for later retrieval (called by auth middleware on login/callback).
	Store(ctx context.Context, key Key, tok *scyauth.Token) error

	// Invalidate removes cached tokens for a key (called on logout).
	Invalidate(ctx context.Context, key Key) error
}

type RefreshInvalidGrantError struct {
	// contains filtered or unexported fields
}

type RoutingBroker struct {
	Workspace        Broker
	Registry         BrokerRegistry
	IsWorkspaceAlias WorkspaceAliasMatcher
}

type SecurityData struct {
	AccessToken  string    `json:"accessToken,omitempty"`
	IDToken      string    `json:"idToken,omitempty"`
	RefreshToken string    `json:"refreshToken,omitempty"`
	ExpiresAt    time.Time `json:"expiresAt,omitempty"`
	Subject      string    `json:"subject,omitempty"`
	Provider     string    `json:"provider,omitempty"`
}

type TokenStore interface {
	Get(ctx context.Context, username, provider string) (*OAuthToken, error)
	Put(ctx context.Context, token *OAuthToken) error
	Delete(ctx context.Context, username, provider string) error

	// TryAcquireRefreshLease atomically attempts to acquire a distributed lease
	// for refreshing the token identified by (username, provider). Returns the
	// current version and whether the lease was acquired.
	TryAcquireRefreshLease(ctx context.Context, username, provider, owner string, ttl time.Duration) (version int64, acquired bool, err error)

	// ReleaseRefreshLease releases a previously acquired lease (e.g. on failure).
	ReleaseRefreshLease(ctx context.Context, username, provider, owner string) error

	// CASPut atomically updates the token only if the current version matches
	// expectedVersion and the lease is held by owner. Returns whether the swap succeeded.
	CASPut(ctx context.Context, token *OAuthToken, expectedVersion int64, owner string) (swapped bool, err error)
}

type WorkspaceAliasMatcher func(provider string) bool