social

type AdminCatalogProvider struct {
	ID   string `json:"id"`
	Name string `json:"name"`
}

type AdminCatalogResponse struct {
	Providers []AdminCatalogProvider `json:"providers"`
}

type AdminDeleteProviderRequest struct {
	Provider string `path:"provider" description:"Provider ID"`
	AppID    string `query:"app_id"  description:"App identifier; omit for global scope"`
}

type AdminDeleteProviderResponse struct {
	Status string `json:"status"`
}

type AdminListProvidersRequest struct {
	AppID string `query:"app_id" description:"App identifier; omit for global scope"`
}

type AdminListProvidersResponse struct {
	Providers []AdminProvider `json:"providers"`
}

type AdminProvider struct {
	Name         string   `json:"name"`
	ClientID     string   `json:"client_id"`
	ClientSecret string   `json:"client_secret,omitempty"`
	RedirectURL  string   `json:"redirect_url,omitempty"`
	Scopes       []string `json:"scopes,omitempty"`
	Enabled      bool     `json:"enabled"`
	HasSecret    bool     `json:"has_secret"`
}

type AdminProviderResponse struct {
	Provider AdminProvider `json:"provider"`
}

type AdminUpsertProviderRequest struct {
	Provider string `path:"provider" description:"Provider ID (google, github, ...)"`
	AppID    string `query:"app_id" description:"App identifier; omit for global scope"`

	ClientID     string   `json:"client_id"      description:"OAuth client ID"`
	ClientSecret string   `json:"client_secret"  description:"OAuth client secret. Pass empty string to leave the existing value unchanged."`
	RedirectURL  string   `json:"redirect_url,omitempty"`
	Scopes       []string `json:"scopes,omitempty"`
	Enabled      *bool    `json:"enabled,omitempty"`
}

type CallbackRequest struct {
	Provider string `path:"provider"`
	State    string `query:"state,omitempty"`
	Code     string `query:"code,omitempty"`
	Error    string `query:"error,omitempty"`
}

type CallbackResponse struct {
	User         any    `json:"user"`
	SessionToken string `json:"session_token"`
	RefreshToken string `json:"refresh_token"`
	ExpiresAt    any    `json:"expires_at"`
	Provider     string `json:"provider"`
	IsNewUser    bool   `json:"is_new_user"`
	RedirectURL  string `json:"redirect_url,omitempty"`
	FrontendURL  string `json:"frontend_url,omitempty"`
}

type Config struct {
	// Providers is the list of enabled OAuth providers.
	Providers []Provider

	// Domain is the external base URL of the server (e.g. "https://api.example.com").
	// When a provider does not specify a RedirectURL, the callback URL is
	// auto-generated as {Domain}/v1/social/{provider}/callback.
	// If empty, the callback URL is derived from the incoming request's Host header.
	Domain string

	// SessionTokenTTL is the lifetime of sessions created via social sign-in (default: 1 hour).
	SessionTokenTTL time.Duration

	// SessionRefreshTTL is the lifetime of refresh tokens (default: 30 days).
	SessionRefreshTTL time.Duration
}

type EncryptedStore struct {
	// contains filtered or unexported fields
}

type MemoryStore struct {
	// contains filtered or unexported fields
}

type MongoStore struct {
	// contains filtered or unexported fields
}

type OAuthConnection struct {
	ID             id.OAuthConnectionID `json:"id"`
	AppID          id.AppID             `json:"app_id"`
	UserID         id.UserID            `json:"user_id"`
	Provider       string               `json:"provider"`
	ProviderUserID string               `json:"provider_user_id"`
	Email          string               `json:"email"`
	AccessToken    string               `json:"-"`
	RefreshToken   string               `json:"-"`
	ExpiresAt      time.Time            `json:"expires_at,omitempty"`
	Metadata       map[string]string    `json:"metadata,omitempty"`
	CreatedAt      time.Time            `json:"created_at"`
	UpdatedAt      time.Time            `json:"updated_at"`
}

type Plugin struct {
	// contains filtered or unexported fields
}

type PostgresStore struct {
	// contains filtered or unexported fields
}

type Provider interface {
	// Name returns the provider's unique identifier (e.g., "google", "github").
	Name() string

	// OAuth2Config returns the OAuth2 configuration for this provider.
	OAuth2Config() *oauth2.Config

	// FetchUser uses an OAuth2 token to retrieve the user's profile
	// from the provider's API.
	FetchUser(ctx context.Context, token *oauth2.Token) (*ProviderUser, error)
}

type ProviderConfig struct {
	ClientID     string
	ClientSecret string
	RedirectURL  string
	Scopes       []string
}

type ProviderEmail struct {
	Email    string `json:"email"`
	Verified bool   `json:"verified"`
	Primary  bool   `json:"primary"`
}

type ProviderSetting struct {
	Name         string   `json:"name"`
	ClientID     string   `json:"client_id"`
	ClientSecret string   `json:"client_secret"`
	RedirectURL  string   `json:"redirect_url"`
	Scopes       []string `json:"scopes,omitempty"`
	Enabled      bool     `json:"enabled"`
}

type ProviderUser struct {
	ProviderUserID string `json:"provider_user_id"`
	// Email is the provider's primary email (kept for backward compatibility).
	Email string `json:"email"`
	// EmailVerified reports whether the provider considers Email verified.
	// Defaults to false when the provider doesn't expose verification — the
	// matching algorithm treats unknown verification as unverified so an
	// unverified address can never silently link to or hijack an account.
	EmailVerified bool `json:"email_verified"`
	// Emails is the full set of addresses the provider exposes (may be empty,
	// in which case Email/EmailVerified is used as a single entry).
	Emails    []ProviderEmail `json:"emails,omitempty"`
	FirstName string          `json:"first_name"`
	LastName  string          `json:"last_name"`
	AvatarURL string          `json:"avatar_url,omitempty"`
}

type SqliteStore struct {
	// contains filtered or unexported fields
}

type StartRequest struct {
	Provider    string `path:"provider"`
	FrontendURL string `json:"frontend_url,omitempty" query:"frontend_url,omitempty"`
	RedirectURL string `json:"redirect_url,omitempty" query:"redirect_url,omitempty"`
}

type StartResponse struct {
	AuthURL string `json:"auth_url"`
}

type Store interface {
	CreateOAuthConnection(ctx context.Context, c *OAuthConnection) error
	// GetOAuthConnection resolves a provider identity inside one app. The
	// same provider user in two apps is two connections; without the app in
	// the key, a login in one app would land on the other's account.
	GetOAuthConnection(ctx context.Context, appID id.AppID, provider, providerUserID string) (*OAuthConnection, error)
	GetOAuthConnectionsByUserID(ctx context.Context, userID id.UserID) ([]*OAuthConnection, error)
	// UpdateOAuthConnection persists changes to an existing connection
	// (refreshed access/refresh tokens, expiry, email).
	UpdateOAuthConnection(ctx context.Context, c *OAuthConnection) error
	DeleteOAuthConnection(ctx context.Context, connID id.OAuthConnectionID) error
}