social

type AppleConfig struct {
	// TeamID, KeyID and PrivateKey sign client secrets: the Team ID, and the
	// ID and .p8 key of a Sign in with Apple key.
	TeamID     string
	KeyID      string
	PrivateKey *ecdsa.PrivateKey
	// ServicesID is the web client; empty for native apps only.
	ServicesID string
	// BundleIDs are the iOS apps ID tokens may be issued for.
	BundleIDs  []string
	Endpoints  Endpoints
	HTTPClient *http.Client
	Now        func() time.Time
}

type Endpoints struct {
	AuthURL   string
	TokenURL  string
	KeysURL   string
	RevokeURL string
	// Issuers are the accepted "iss" values of ID tokens.
	Issuers []string
	// APIURL is the base URL of GitHub's REST API, which returns the person
	// and their email addresses; unused by other providers.
	APIURL string
}

type GitHubConfig struct {
	// ClientID and ClientSecret are the OAuth app's.
	ClientID     string
	ClientSecret string
	Endpoints    Endpoints
	HTTPClient   *http.Client
}

type GoogleConfig struct {
	// ClientID and ClientSecret are the Web application client. Android apps
	// use ClientID too.
	ClientID     string
	ClientSecret string
	// NativeClientIDs are the iOS and Android client IDs ID tokens may be
	// issued for.
	NativeClientIDs []string
	Endpoints       Endpoints
	HTTPClient      *http.Client
	Now             func() time.Time
}

type Identity struct {
	// Provider is Google, Apple or GitHub.
	Provider string
	// Subject identifies the person at the provider; it never changes. For
	// GitHub it is the numeric user ID in decimal, not the login, which
	// people can rename.
	Subject string
	Email   string
	// EmailVerified reports that the provider checked the person owns Email.
	EmailVerified bool
	// PrivateEmail reports an Apple relay address.
	PrivateEmail bool
	// HostedDomain is the Google Workspace domain of the account ("hd"),
	// empty for personal Google accounts and Apple.
	HostedDomain string
	// Name is the person's name, when the provider sends it; for GitHub, the
	// login when the profile has no name.
	Name string
	// Audience is the client ID the token was issued for (for GitHub, the
	// OAuth app's client ID).
	Audience string
}

type Notification struct {
	// ID identifies the notification ("jti", or a hash of the payload when
	// Apple sends none). Remember it until IssuedAt plus
	// [MaxNotificationAge] and ignore a notification seen before: a replayed
	// payload carries the same ID.
	ID string
	// Type is one of the Notification constants.
	Type    string
	Subject string
	Email   string
	// PrivateEmail reports an Apple relay address.
	PrivateEmail bool
	// At is when the event happened; IssuedAt when Apple signed the
	// notification.
	At       time.Time
	IssuedAt time.Time
}

type Provider struct {
	// contains filtered or unexported fields
}

type Token struct {
	Identity Identity
	// RefreshToken is set when the provider returns one (Apple); store it
	// encrypted to revoke it later.
	RefreshToken string
}