link

type Config struct {
	OnCredentialChange         func(MCPAuthChangeEvent) `json:"-" yaml:"-"`
	WorkspaceNamespace         string                   `json:"workspaceNamespace,omitempty" yaml:"workspaceNamespace,omitempty"`
	TokenEncryptionKey         string                   `json:"tokenEncryptionKey,omitempty" yaml:"tokenEncryptionKey,omitempty"`
	StateEncryptionKey         string                   `json:"stateEncryptionKey,omitempty" yaml:"stateEncryptionKey,omitempty"`
	StateEncryptionKeyPrevious string                   `json:"stateEncryptionKeyPrevious,omitempty" yaml:"stateEncryptionKeyPrevious,omitempty"`
	MCPLinkStateTTLMinutes     int                      `json:"mcpLinkStateTTLMinutes,omitempty" yaml:"mcpLinkStateTTLMinutes,omitempty"`
	// OAuth preserves legacy configURL-derived key selection during migration.
	OAuth *OAuth `json:"oauth,omitempty" yaml:"oauth,omitempty"`
}

type DelegatedCredentialResolver struct {
	// contains filtered or unexported fields
}

type DelegatedMCPAuth struct {
	// contains filtered or unexported fields
}

type DelegatedTokenLister interface {
	ListDelegated(ctx context.Context, userID string) ([]*OAuthToken, error)
}

type DelegatedTokenRefresher interface {
	// RefreshStoredDelegatedToken applies the row's provider-specific refresh
	// policy and, when due, refreshes through that provider's exact
	// client/token endpoint using the distributed lease and CAS write.
	RefreshStoredDelegatedToken(ctx context.Context, stored *OAuthToken) error
	// MaxRefreshLead returns the largest configured provider refresh lead used
	// as the watcher's broad scan horizon.
	MaxRefreshLead(ctx context.Context) time.Duration
}

type DelegatedTokenStore interface {
	GetExact(ctx context.Context, userID, provider string) (*OAuthToken, error)
	Put(ctx context.Context, token *OAuthToken) error
	Delete(ctx context.Context, userID, provider string) error
	TryAcquireRefreshLease(ctx context.Context, userID, provider, owner string, ttl time.Duration) (version int64, acquired bool, err error)
	ReleaseRefreshLease(ctx context.Context, userID, provider, owner string) error
	CASPut(ctx context.Context, token *OAuthToken, expectedVersion int64, owner string) (swapped bool, err error)
}

type ExpiringTokenScanner interface {
	// ScanExpiring returns all stored tokens whose expiry is before horizon
	// and that carry a refresh token. Only tokens that can actually be
	// refreshed need to be returned.
	ScanExpiring(ctx context.Context, horizon time.Time) ([]*OAuthToken, error)
}

type MCPAuthChangeEvent struct {
	// Kind is one of "linked", "disconnected".
	Kind string
	// CanonicalUserID keys credential storage and resolver cooldowns.
	CanonicalUserID string
	// EffectiveUserID keys the MCP manager client pool.
	EffectiveUserID string
	ServerName      string
	ProviderRef     string
	StorageKey      string
}

type MCPAuthConfigProvider interface {
	Options(ctx context.Context, serverName string) (*mcpcfg.MCPClient, error)
}

type MCPAuthState struct {
	CanonicalUserID string    `json:"canonicalUserId"`
	SessionIDHash   string    `json:"sessionIdHash"`
	ServerName      string    `json:"serverName"`
	ProviderRef     string    `json:"providerRef"`
	ClientRef       string    `json:"clientRef,omitempty"`
	Resource        string    `json:"resource,omitempty"`
	Scopes          []string  `json:"scopes,omitempty"`
	CodeVerifier    string    `json:"codeVerifier"`
	ReturnURL       string    `json:"returnURL,omitempty"`
	Nonce           string    `json:"nonce"`
	ExpiresAt       time.Time `json:"expiresAt"`
	// ConfigFingerprint records the non-secret provider-registry fingerprint
	// at initiation; the callback verifies the configuration has not changed
	// underneath the flow.
	ConfigFingerprint string `json:"configFingerprint,omitempty"`
	// RedirectURI pins the exact redirect used on the authorization request so
	// the token exchange sends the identical value.
	RedirectURI string `json:"redirectURI,omitempty"`
}

type MCPLinkBackend struct {
	// contains filtered or unexported fields
}

type MCPLinkCompletion = mcpCallbackResult

type MCPLinkIdentity struct{ CanonicalUserID, EffectiveUserID, SessionID string }

type MCPLinkInitiation = mcpInitiateResult

type MCPLinkStatus = mcpStatusResult

type OAuth struct {
	Name   string       `json:"name,omitempty" yaml:"name,omitempty"`
	Client *OAuthClient `json:"client,omitempty" yaml:"client,omitempty"`
}

type OAuthClient struct {
	Scopes         []string `json:"scopes,omitempty" yaml:"scopes,omitempty"`
	WebUIScopes    []string `json:"webUIScopes,omitempty" yaml:"webUIScopes,omitempty"`
	MobileUIScopes []string `json:"mobileUIScopes,omitempty" yaml:"mobileUIScopes,omitempty"`
	CLIScopes      []string `json:"cliScopes,omitempty" yaml:"cliScopes,omitempty"`

	ConfigURL string `json:"configURL,omitempty" yaml:"configURL,omitempty"`
}

type OAuthStateRecord struct {
	StateHash       string
	FlowHash        string
	CanonicalUserID string
	SessionHash     string
	Provider        string
	ExpiresAt       time.Time
	ConsumedAt      *time.Time
	CreatedAt       time.Time
}

type OAuthStateStore interface {
	CreateOrGetPending(context.Context, *OAuthStateRecord) (*OAuthStateRecord, bool, error)
	Consume(context.Context, string, string, string) error
	DeleteExpired(context.Context, time.Time) (int64, time.Time, error)
}

type OAuthToken struct {
	Username     string    `json:"username"`
	Provider     string    `json:"provider"`
	AccessToken  string    `json:"accessToken"`
	IDToken      string    `json:"idToken,omitempty"`
	RefreshToken string    `json:"refreshToken,omitempty"`
	ExpiresAt    time.Time `json:"expiresAt,omitempty"`

	// Issuer is the normalized OAuth issuer the token was granted by.
	Issuer string `json:"issuer,omitempty"`
	// Resource is the protected resource (audience) the token targets.
	Resource string `json:"resource,omitempty"`
	// Scopes are the granted scopes (authoritative after refresh).
	Scopes []string `json:"scopes,omitempty"`
	// TokenType records accessToken versus idToken usage intent.
	TokenType string `json:"tokenType,omitempty"`
	// Subject is the provider subject extracted from the verified token; it is
	// credential metadata only and never becomes the effective user.
	Subject string `json:"subject,omitempty"`
	// ProviderRef/ClientRef record the workspace provider registry references
	// for delegated tokens (the row provider column stores a fixed-length
	// hashed storage key).
	ProviderRef string `json:"providerRef,omitempty"`
	ClientRef   string `json:"clientRef,omitempty"`
	// IDTokenExpiresAt is the verified ID-token exp. ExpiresAt remains the
	// access-token expiry for compatibility; tokenType=idToken consumers must
	// derive validity and refresh thresholds from this field instead.
	IDTokenExpiresAt time.Time `json:"idTokenExpiresAt,omitempty"`
	// IssuedAt records when the token set was obtained (login, exchange or
	// refresh); the refresh policy uses it to derive the original selected
	// token lifetime for the 20% clamp.
	IssuedAt time.Time `json:"issuedAt,omitempty"`
}

type PreferencesPatch struct {
	DisplayName        *string                           `json:"displayName,omitempty"`
	Timezone           *string                           `json:"timezone,omitempty"`
	DefaultAgentRef    *string                           `json:"defaultAgentRef,omitempty"`
	DefaultModelRef    *string                           `json:"defaultModelRef,omitempty"`
	DefaultEmbedderRef *string                           `json:"defaultEmbedderRef,omitempty"`
	AgentPrefs         map[string]map[string]interface{} `json:"agentPrefs,omitempty"`
}

type Session struct {
	ID       string         `json:"id"`
	UserID   string         `json:"userId,omitempty"`
	Username string         `json:"username"`
	Email    string         `json:"email,omitempty"`
	Subject  string         `json:"subject,omitempty"`
	Provider string         `json:"provider,omitempty"`
	Scopes   []string       `json:"scopes,omitempty"`
	Tokens   *scyauth.Token `json:"-"`
	// TransientRefreshRetryAt suppresses repeated refresh attempts/log spam
	// after a temporary token-endpoint failure. Runtime auth code persists the
	// cooldown through session metadata when a durable store is configured.
	TransientRefreshRetryAt time.Time `json:"-"`
	CreatedAt               time.Time `json:"createdAt"`
	ExpiresAt               time.Time `json:"expiresAt"`
}

type TokenStore interface {
	Get(ctx context.Context, username, provider string) (*OAuthToken, error)
	Put(ctx context.Context, token *OAuthToken) error
	Delete(ctx context.Context, username, provider string) error

	// TryAcquireRefreshLease atomically attempts to acquire a distributed lease
	// for refreshing the token identified by (username, provider).
	TryAcquireRefreshLease(ctx context.Context, username, provider, owner string, ttl time.Duration) (version int64, acquired bool, err error)

	// ReleaseRefreshLease releases a previously acquired lease.
	ReleaseRefreshLease(ctx context.Context, username, provider, owner string) error

	// CASPut atomically updates the token only if the current version matches
	// expectedVersion and the lease is held by owner.
	CASPut(ctx context.Context, token *OAuthToken, expectedVersion int64, owner string) (swapped bool, err error)
}

type User struct {
	ID          string                 `json:"id,omitempty"`
	Username    string                 `json:"username"`
	Email       string                 `json:"email,omitempty"`
	DisplayName string                 `json:"displayName,omitempty"`
	Provider    string                 `json:"provider,omitempty"`
	Subject     string                 `json:"subject,omitempty"`
	Preferences map[string]interface{} `json:"preferences,omitempty"`
	// Disabled marks a deactivated canonical user: disabled users cannot use
	// stored delegated credentials and fail canonical resolution.
	Disabled bool `json:"disabled,omitempty"`
}

type UserByIDLookup interface {
	GetByID(ctx context.Context, id string) (*User, error)
}

type UserInfo = iauth.UserInfo

type UserService interface {
	GetByUsername(ctx context.Context, username string) (*User, error)
	GetBySubjectAndProvider(ctx context.Context, subject, provider string) (*User, error)
	Upsert(ctx context.Context, user *User) error
	UpsertWithProvider(ctx context.Context, username, displayName, email, provider, subject string) (string, error)
	UpdateHashIPByID(ctx context.Context, id, hash string) error
	UpdatePreferences(ctx context.Context, username string, patch *PreferencesPatch) error
}