connectors

type Connector interface {
	// LoginURL returns the upstream URL to redirect the user to. The
	// returned connData blob must be persisted with the OAuth state and
	// handed back to HandleCallback unchanged.
	LoginURL(callbackURL, state string) (loginURL string, connData []byte, err error)

	// HandleCallback processes the OAuth callback request and returns the
	// resolved Identity.
	HandleCallback(ctx context.Context, connData []byte, r *http.Request) (Identity, error)
}

type GitHubConfig struct {
	ClientID     string
	ClientSecret string
	RedirectURI  string

	// Orgs restricts login to members of these GitHub organizations.
	// If an Org includes Teams, the user must belong to one of those teams.
	Orgs []GitHubOrg

	// UseLoginAsID, when true, surfaces the GitHub login (e.g. "phinze")
	// as Identity.UserID instead of the numeric user ID. Defaults to false
	// to match OIDC's stable-`sub` convention.
	UseLoginAsID bool
}

type GitHubOrg struct {
	Name  string
	Teams []string
}

type Identity struct {
	UserID            string
	Username          string
	PreferredUsername string
	Email             string
	EmailVerified     bool
	Groups            []string

	// ConnectorData is opaque state that the underlying connector wants
	// to round-trip into a future Refresh call. Currently unused by the
	// route-protection flow; kept on the type so we can plumb it through
	// the session cookie later without changing the interface.
	ConnectorData []byte
}