config

type Credential struct {
	Token       string
	TokenType   TokenType
	ExpiresAt   time.Time
	ProviderRef string
	Resource    string
	Scopes      []string
}

type CredentialResolver interface {
	Resolve(ctx context.Context, requirement Requirement) (*Credential, error)
	Refresh(ctx context.Context, requirement Requirement) (*Credential, error)
	Invalidate(ctx context.Context, requirement Requirement) error
}

type DiscoveryOptions struct {
	// Timeout caps the whole fetch; defaults to 10s.
	Timeout time.Duration
	// MaxRedirects caps redirect following; defaults to 3.
	MaxRedirects int
	// MaxBodyBytes caps the decoded response size; defaults to 1 MiB.
	MaxBodyBytes int64
	// AllowHTTP permits plain http metadata URLs (tests/dev only); production
	// hosts must leave this false so only HTTPS metadata is trusted.
	AllowHTTP bool
	// ExpectedOrigin pins the metadata fetch to the MCP/resource origin: the
	// initial metadata URL and every redirect must match its parsed scheme
	// and host exactly. Hosts must set it to the protected-resource / MCP
	// transport origin whenever the metadata URL is taken from an untrusted
	// WWW-Authenticate challenge, so a hostile challenge cannot steer the
	// client into fetching arbitrary URLs (SSRF). It is required by default:
	// discovery fails closed when it is empty unless AllowCrossOrigin is set.
	ExpectedOrigin string
	// AllowCrossOrigin is the explicit host-approved opt-out of the
	// ExpectedOrigin pin. Only when it is true may ExpectedOrigin be left
	// empty; an empty ExpectedOrigin alone never silently approves a fetch.
	AllowCrossOrigin bool
	// Transport overrides the HTTP transport used for the fetch.
	Transport http.RoundTripper
}

type OAuthClient struct {
	ConfigURL    string   `yaml:"configURL,omitempty" json:"configURL,omitempty"`
	RedirectURI  string   `yaml:"redirectURI,omitempty" json:"redirectURI,omitempty"`
	Confidential bool     `yaml:"confidential,omitempty" json:"confidential,omitempty"`
	UsePKCE      bool     `yaml:"usePKCE,omitempty" json:"usePKCE,omitempty"`
	RefreshLead  string   `yaml:"refreshLead,omitempty" json:"refreshLead,omitempty"`
	ClockSkew    string   `yaml:"clockSkew,omitempty" json:"clockSkew,omitempty"`
	Scopes       []string `yaml:"scopes,omitempty" json:"scopes,omitempty"`
}

type OAuthLinkRequiredError struct {
	ServerName  string
	ProviderRef string
	Issuer      string
	Resource    string
	Scopes      []string
	// MetadataURL carries the protected-resource metadata URL the requirement
	// was enriched from (challenge-mode provider learning), so hosts can
	// persist the learned issuer/resource binding.
	MetadataURL string
	// Cause preserves the underlying failure (e.g. refresh rejection).
	Cause error
}

type OAuthProvider struct {
	ID            string                  `yaml:"id,omitempty" json:"id,omitempty"`
	Issuer        string                  `yaml:"issuer" json:"issuer"`
	DiscoveryURL  string                  `yaml:"discoveryURL,omitempty" json:"discoveryURL,omitempty"`
	DefaultClient string                  `yaml:"defaultClient,omitempty" json:"defaultClient,omitempty"`
	Clients       map[string]*OAuthClient `yaml:"clients,omitempty" json:"clients,omitempty"`
}

type ProviderRegistry interface {
	// ResolveProvider returns the provider registered under ref.
	ResolveProvider(ctx context.Context, ref string) (*OAuthProvider, error)
	// MatchIssuer returns the single provider whose normalized issuer equals
	// the normalized argument; it must fail when the match is ambiguous.
	MatchIssuer(ctx context.Context, issuer string) (*OAuthProvider, error)
}

type Requirement struct {
	// ServerName identifies the MCP client/server definition.
	ServerName string
	// ProviderRef references a provider registered with the host registry.
	ProviderRef string
	// ClientRef selects a client registration within the provider.
	ClientRef string
	// Issuer is the normalized OAuth issuer when known.
	Issuer string
	// Resource is the protected resource (audience) the credential must target.
	Resource string
	// Scopes are the normalized, deduplicated required scopes.
	Scopes []string
	// TokenType selects access token (default) versus ID token.
	TokenType TokenType
	// Resolution selects eager (default) versus challenge-only resolution.
	Resolution Resolution
	// ReusePolicy is forwarded to the resolver; viant/mcp does not act on it.
	ReusePolicy WorkspaceTokenReusePolicy
	// Provider carries the inline provider definition when the client was
	// configured with one instead of ProviderRef.
	Provider *OAuthProvider
	// MetadataURL records the RFC 9728 protected-resource metadata URL the
	// requirement was enriched from (challenge-mode provider learning). It is
	// informational for the resolver/host; viant/mcp never re-fetches it.
	MetadataURL string
}

type Resolution string

type StaticRegistry struct {
	// contains filtered or unexported fields
}

type TokenType string

type WorkspaceTokenReusePolicy string