auth

type CanonicalUserResolver struct {
	// contains filtered or unexported fields
}

type Config struct {
	Enabled                 bool     `yaml:"enabled" json:"enabled"`
	CookieName              string   `yaml:"cookieName" json:"cookieName"`
	SessionTTLHours         int      `yaml:"sessionTTLHours,omitempty" json:"sessionTTLHours,omitempty"`
	TokenRefreshLeadMinutes int      `yaml:"tokenRefreshLeadMinutes,omitempty" json:"tokenRefreshLeadMinutes,omitempty"`
	DefaultUsername         string   `yaml:"defaultUsername" json:"defaultUsername"`
	IpHashKey               string   `yaml:"ipHashKey" json:"ipHashKey"`
	TrustedProxies          []string `yaml:"trustedProxies" json:"trustedProxies"`
	RedirectPath            string   `yaml:"redirectPath" json:"redirectPath"`
	// WorkspaceNamespace is the immutable identifier mixed into delegated MCP
	// token storage keys. It is not a filesystem path or display name;
	// changing it requires an explicit token-key migration. Empty selects
	// "default".
	WorkspaceNamespace string `yaml:"workspaceNamespace,omitempty" json:"workspaceNamespace,omitempty"`
	// TokenEncryptionKey is the explicit (env-expandable) encryption key for
	// delegated MCP token storage. When empty, delegated storage falls back to
	// the legacy workspace OAuth client configURL-derived salt. It lets
	// JWT/local-auth workspaces (no OAuth client) use delegated MCP OAuth.
	TokenEncryptionKey string `yaml:"tokenEncryptionKey,omitempty" json:"tokenEncryptionKey,omitempty"`
	// StateEncryptionKey is the active AEAD key material for delegated MCP
	// OAuth callback state (env-expandable). When empty, the delegated token
	// encryption salt is used. StateEncryptionKeyPrevious keeps the retired
	// key decryptable for at least the state TTL plus clock skew after a
	// rotation; new state always seals with the active key.
	StateEncryptionKey         string `yaml:"stateEncryptionKey,omitempty" json:"stateEncryptionKey,omitempty"`
	StateEncryptionKeyPrevious string `yaml:"stateEncryptionKeyPrevious,omitempty" json:"stateEncryptionKeyPrevious,omitempty"`
	// MCPLinkStateTTLMinutes bounds the delegated MCP OAuth state lifetime;
	// values are clamped to the mandated 5–10 minute window (default 7).
	MCPLinkStateTTLMinutes int    `yaml:"mcpLinkStateTTLMinutes,omitempty" json:"mcpLinkStateTTLMinutes,omitempty"`
	OAuth                  *OAuth `yaml:"oauth" json:"oauth"`
	Local                  *Local `yaml:"local" json:"local"`
	JWT                    *JWT   `yaml:"jwt,omitempty" json:"jwt,omitempty"`
}

type DatlyUserService struct {
	// contains filtered or unexported fields
}

type DelegatedCredentialResolver struct {
	// contains filtered or unexported fields
}

type DelegatedMCPAuth struct {
	// contains filtered or unexported fields
}

type DelegatedTokenLister interface {
	ListDelegated(ctx context.Context, userID string) ([]*OAuthToken, error)
}

type DelegatedTokenRefresher interface {
	// RefreshStoredDelegatedToken applies the row's provider-specific refresh
	// policy and, when due, refreshes through that provider's exact
	// client/token endpoint using the distributed lease and CAS write.
	RefreshStoredDelegatedToken(ctx context.Context, stored *OAuthToken) error
	// MaxRefreshLead returns the largest configured provider refresh lead used
	// as the watcher's broad scan horizon.
	MaxRefreshLead(ctx context.Context) time.Duration
}

type DelegatedTokenStore interface {
	GetExact(ctx context.Context, userID, provider string) (*OAuthToken, error)
	Put(ctx context.Context, token *OAuthToken) error
	Delete(ctx context.Context, userID, provider string) error
	TryAcquireRefreshLease(ctx context.Context, userID, provider, owner string, ttl time.Duration) (version int64, acquired bool, err error)
	ReleaseRefreshLease(ctx context.Context, userID, provider, owner string) error
	CASPut(ctx context.Context, token *OAuthToken, expectedVersion int64, owner string) (swapped bool, err error)
}

type ExpiringTokenScanner interface {
	// ScanExpiring returns all stored tokens whose expiry is before horizon
	// and that carry a refresh token. Only tokens that can actually be
	// refreshed need to be returned.
	ScanExpiring(ctx context.Context, horizon time.Time) ([]*OAuthToken, error)
}

type Handler struct {
	// contains filtered or unexported fields
}

type HandlerOption func(*Handler)

type JWT struct {
	Enabled       bool     `yaml:"enabled" json:"enabled"`
	RSA           []string `yaml:"rsa,omitempty" json:"rsa,omitempty"`
	HMAC          string   `yaml:"hmac,omitempty" json:"hmac,omitempty"`
	CertURL       string   `yaml:"certURL,omitempty" json:"certURL,omitempty"`
	RSAPrivateKey string   `yaml:"rsaPrivateKey,omitempty" json:"rsaPrivateKey,omitempty"`
}

type JWTService struct {
	// contains filtered or unexported fields
}

type Local struct {
	Enabled bool `yaml:"enabled" json:"enabled"`
}

type MCPAuthChangeEvent struct {
	// Kind is one of "linked", "disconnected".
	Kind string
	// CanonicalUserID keys credential storage and resolver cooldowns.
	CanonicalUserID string
	// EffectiveUserID keys the MCP manager client pool.
	EffectiveUserID string
	ServerName      string
	ProviderRef     string
	StorageKey      string
}

type MCPAuthConfigProvider interface {
	Options(ctx context.Context, serverName string) (*mcpcfg.MCPClient, error)
}

type MCPAuthState struct {
	CanonicalUserID string    `json:"canonicalUserId"`
	SessionIDHash   string    `json:"sessionIdHash"`
	ServerName      string    `json:"serverName"`
	ProviderRef     string    `json:"providerRef"`
	ClientRef       string    `json:"clientRef,omitempty"`
	Resource        string    `json:"resource,omitempty"`
	Scopes          []string  `json:"scopes,omitempty"`
	CodeVerifier    string    `json:"codeVerifier"`
	ReturnURL       string    `json:"returnURL,omitempty"`
	Nonce           string    `json:"nonce"`
	ExpiresAt       time.Time `json:"expiresAt"`
	// ConfigFingerprint records the non-secret provider-registry fingerprint
	// at initiation; the callback verifies the configuration has not changed
	// underneath the flow.
	ConfigFingerprint string `json:"configFingerprint,omitempty"`
	// RedirectURI pins the exact redirect used on the authorization request so
	// the token exchange sends the identical value.
	RedirectURI string `json:"redirectURI,omitempty"`
}

type Manager struct {
	// contains filtered or unexported fields
}

type OAuth struct {
	Mode          string       `yaml:"mode" json:"mode"`
	Name          string       `yaml:"name" json:"name"`
	Label         string       `yaml:"label" json:"label"`
	UsePopupLogin bool         `yaml:"usePopupLogin,omitempty" json:"usePopupLogin,omitempty"`
	Client        *OAuthClient `yaml:"client" json:"client"`
}

type OAuthClient struct {
	ConfigURL      string   `yaml:"configURL" json:"configURL"`
	DiscoveryURL   string   `yaml:"discoveryURL" json:"discoveryURL"`
	JWKSURL        string   `yaml:"jwksURL" json:"jwksURL"`
	RedirectURI    string   `yaml:"redirectURI" json:"redirectURI"`
	RedirectURIs   []string `yaml:"redirectURIs" json:"redirectURIs"`
	ClientID       string   `yaml:"clientID" json:"clientID"`
	Scopes         []string `yaml:"scopes" json:"scopes"`
	WebUIScopes    []string `yaml:"webUIScopes,omitempty" json:"webUIScopes,omitempty"`
	MobileUIScopes []string `yaml:"mobileUIScopes,omitempty" json:"mobileUIScopes,omitempty"`
	CLIScopes      []string `yaml:"cliScopes,omitempty" json:"cliScopes,omitempty"`
	Issuer         string   `yaml:"issuer" json:"issuer"`
	Audiences      []string `yaml:"audiences" json:"audiences"`
}

type OAuthStateRecord struct {
	StateHash       string
	FlowHash        string
	CanonicalUserID string
	SessionHash     string
	Provider        string
	ExpiresAt       time.Time
	ConsumedAt      *time.Time
	CreatedAt       time.Time
}

type OAuthStateStore interface {
	// CreateOrGetPending returns the stored flow row and whether this call
	// created (or replaced a consumed/expired) row. The creator owns the flow
	// and receives the authorization URL; concurrent callers must poll.
	CreateOrGetPending(ctx context.Context, record *OAuthStateRecord) (stored *OAuthStateRecord, created bool, err error)
	// Consume atomically transitions the state to consumed. It fails with
	// ErrOAuthStateInvalid when the record is absent, expired, already
	// consumed, owned by another canonical user or bound to another session.
	Consume(ctx context.Context, stateHash, canonicalUserID, sessionHash string) error
	// DeleteExpired removes rows expired at or before the horizon and reports
	// the deleted count plus the oldest removed expiry for metrics.
	DeleteExpired(ctx context.Context, before time.Time) (deleted int64, oldestExpiresAt time.Time, err error)
}

type OAuthStateStoreDatly struct {
	// contains filtered or unexported fields
}

type OAuthToken struct {
	Username     string    `json:"username"`
	Provider     string    `json:"provider"`
	AccessToken  string    `json:"accessToken"`
	IDToken      string    `json:"idToken,omitempty"`
	RefreshToken string    `json:"refreshToken,omitempty"`
	ExpiresAt    time.Time `json:"expiresAt,omitempty"`

	// Issuer is the normalized OAuth issuer the token was granted by.
	Issuer string `json:"issuer,omitempty"`
	// Resource is the protected resource (audience) the token targets.
	Resource string `json:"resource,omitempty"`
	// Scopes are the granted scopes (authoritative after refresh).
	Scopes []string `json:"scopes,omitempty"`
	// TokenType records accessToken versus idToken usage intent.
	TokenType string `json:"tokenType,omitempty"`
	// Subject is the provider subject extracted from the verified token; it is
	// credential metadata only and never becomes the effective user.
	Subject string `json:"subject,omitempty"`
	// ProviderRef/ClientRef record the workspace provider registry references
	// for delegated tokens (the row provider column stores a fixed-length
	// hashed storage key).
	ProviderRef string `json:"providerRef,omitempty"`
	ClientRef   string `json:"clientRef,omitempty"`
	// IDTokenExpiresAt is the verified ID-token exp. ExpiresAt remains the
	// access-token expiry for compatibility; tokenType=idToken consumers must
	// derive validity and refresh thresholds from this field instead.
	IDTokenExpiresAt time.Time `json:"idTokenExpiresAt,omitempty"`
	// IssuedAt records when the token set was obtained (login, exchange or
	// refresh); the refresh policy uses it to derive the original selected
	// token lifetime for the 20% clamp.
	IssuedAt time.Time `json:"issuedAt,omitempty"`
}

type PreferencesPatch struct {
	DisplayName        *string                           `json:"displayName,omitempty"`
	Timezone           *string                           `json:"timezone,omitempty"`
	DefaultAgentRef    *string                           `json:"defaultAgentRef,omitempty"`
	DefaultModelRef    *string                           `json:"defaultModelRef,omitempty"`
	DefaultEmbedderRef *string                           `json:"defaultEmbedderRef,omitempty"`
	AgentPrefs         map[string]map[string]interface{} `json:"agentPrefs,omitempty"`
}

type ProtectOption func(*protectConfig)

type Runtime struct {
	// contains filtered or unexported fields
}

type Session struct {
	ID       string         `json:"id"`
	UserID   string         `json:"userId,omitempty"`
	Username string         `json:"username"`
	Email    string         `json:"email,omitempty"`
	Subject  string         `json:"subject,omitempty"`
	Provider string         `json:"provider,omitempty"`
	Scopes   []string       `json:"scopes,omitempty"`
	Tokens   *scyauth.Token `json:"-"`
	// TransientRefreshRetryAt suppresses repeated refresh attempts/log spam
	// after a temporary token-endpoint failure. Runtime auth code persists the
	// cooldown through session metadata when a durable store is configured.
	TransientRefreshRetryAt time.Time `json:"-"`
	CreatedAt               time.Time `json:"createdAt"`
	ExpiresAt               time.Time `json:"expiresAt"`
}

type SessionRecord struct {
	ID             string    `json:"id"`
	UserID         string    `json:"userId,omitempty"`
	Username       string    `json:"username"`
	Email          string    `json:"email,omitempty"`
	Subject        string    `json:"subject,omitempty"`
	Provider       string    `json:"provider,omitempty"`
	Scopes         []string  `json:"scopes,omitempty"`
	AccessToken    string    `json:"accessToken,omitempty"`
	IDToken        string    `json:"idToken,omitempty"`
	RefreshToken   string    `json:"refreshToken,omitempty"`
	TokenExpiresAt time.Time `json:"tokenExpiresAt,omitempty"`
	CreatedAt      time.Time `json:"createdAt"`
	ExpiresAt      time.Time `json:"expiresAt"`
}

type SessionStore interface {
	Get(ctx context.Context, id string) (*SessionRecord, error)
	Upsert(ctx context.Context, rec *SessionRecord) error
	Delete(ctx context.Context, id string) error
}

type SessionStoreDAO struct {
	// contains filtered or unexported fields
}

type TokenStore interface {
	Get(ctx context.Context, username, provider string) (*OAuthToken, error)
	Put(ctx context.Context, token *OAuthToken) error
	Delete(ctx context.Context, username, provider string) error

	// TryAcquireRefreshLease atomically attempts to acquire a distributed lease
	// for refreshing the token identified by (username, provider).
	TryAcquireRefreshLease(ctx context.Context, username, provider, owner string, ttl time.Duration) (version int64, acquired bool, err error)

	// ReleaseRefreshLease releases a previously acquired lease.
	ReleaseRefreshLease(ctx context.Context, username, provider, owner string) error

	// CASPut atomically updates the token only if the current version matches
	// expectedVersion and the lease is held by owner.
	CASPut(ctx context.Context, token *OAuthToken, expectedVersion int64, owner string) (swapped bool, err error)
}

type TokenStoreDAO struct {
	// contains filtered or unexported fields
}

type TokenStoreOption func(*TokenStoreDAO)

type User struct {
	ID          string                 `json:"id,omitempty"`
	Username    string                 `json:"username"`
	Email       string                 `json:"email,omitempty"`
	DisplayName string                 `json:"displayName,omitempty"`
	Provider    string                 `json:"provider,omitempty"`
	Subject     string                 `json:"subject,omitempty"`
	Preferences map[string]interface{} `json:"preferences,omitempty"`
	// Disabled marks a deactivated canonical user: disabled users cannot use
	// stored delegated credentials and fail canonical resolution.
	Disabled bool `json:"disabled,omitempty"`
}

type UserByIDLookup interface {
	GetByID(ctx context.Context, id string) (*User, error)
}

type UserInfo struct {
	Subject string
	Email   string
}

type UserService interface {
	GetByUsername(ctx context.Context, username string) (*User, error)
	GetBySubjectAndProvider(ctx context.Context, subject, provider string) (*User, error)
	Upsert(ctx context.Context, user *User) error
	UpsertWithProvider(ctx context.Context, username, displayName, email, provider, subject string) (string, error)
	UpdateHashIPByID(ctx context.Context, id, hash string) error
	UpdatePreferences(ctx context.Context, username string, patch *PreferencesPatch) error
}

type VerifiedWorkspaceIdentity struct {
	Provider string
	Issuer   string
	Subject  string
	Email    string
}