oauthgoauth2

type AuthURLOptions struct {
	RedirectURL string            // Redirect URL after authentication
	ReturnTo    string            // ReturnTo URL after authentication
	Scopes      []string          // Scopes to request
	Prompt      string            // Prompt to use
	LoginHint   string            // Login hint to use
	Extras      map[string]string // Additional parameters to include in the URL
}

type OAuth2Config struct {
	ClientID      string            // required
	ClientSecret  string            // optional for public clients, required for confidential clients
	Scopes        []string          // scopes to request, defaults to "openid profile email"
	AuthURL       string            // optional, for discovery-based providers
	TokenURL      string            // optional, for discovery-based providers
	UserInfoURL   string            // optional, provide if OIDC is not supported
	RevocationURL string            // optional RFC7009
	ExtraAuth     map[string]string // provider-specific params if needed
	ExtraToken    map[string]string // provider-specific params if needed
	UsePKCE       bool              // controls whether to use PKCE (Proof Key for Code Exchange) in the OAuth2 flow
}

type OAuth2Provider interface {
	UserInfoURL() string
	// Name returns the name of the provider.
	Name() string
	// AuthURL returns the URL to redirect the user to for authentication.
	AuthURL(ctx context.Context, r *http.Request, opts AuthURLOptions) (url string, opaqueState string, err error)
	// Exchange exchanges an authorization code for an access token.
	Exchange(ctx context.Context, r *http.Request, code string, opaqueState string) (*OAuth2Session, error)
	// Refresh refreshes an access token based on a refresh token.
	Refresh(ctx context.Context, refreshToken string) (*OAuth2Session, error)
	// Revoke revokes a token.
	Revoke(ctx context.Context, token string) error
	// GetState Get state from opaque state
	GetState(ctx context.Context, opaqueState string) (*oauthgostate.StatePayload, error)
}

type OAuth2Session struct {
	Provider        string         `json:"provider"`      // Required
	AccessToken     string         `json:"access_token"`  // Required
	RefreshToken    string         `json:"refresh_token"` // Present if the provider supports refresh tokens
	IDToken         string         `json:"id_token"`      // optional; empty in pure OAuth2
	TokenType       string         `json:"token_type"`    // Access token type
	Expiry          time.Time      `json:"expiry"`        // Expiry time of the access token
	Raw             map[string]any `json:"raw"`           // Raw token data
	RequestedScopes []string       `json:"requested_scopes"`
	GrantedScopes   []string       `json:"granted_scopes"`
}

type StandardOAuth2Provider struct {
	// contains filtered or unexported fields
}

type TokenExchangeResult struct {
	Token      *oauth2.Token
	RawBody    map[string]any
	RawHeaders map[string]string
}