oauth2

type Authenticator func(username, password string) bool

type AuthorizationCode struct {
	// Code is the authorization code value.
	Code string `json:"code"`

	// ClientID is the client that requested this code.
	ClientID string `json:"client_id"`

	// RedirectURI is the redirect URI used in the authorization request.
	RedirectURI string `json:"redirect_uri"`

	// Scope is the requested scope.
	Scope string `json:"scope,omitempty"`

	// CodeChallenge is the PKCE code challenge.
	CodeChallenge string `json:"code_challenge"`

	// CodeChallengeMethod is the PKCE challenge method (always "S256").
	CodeChallengeMethod string `json:"code_challenge_method"`

	// Subject is the authenticated user.
	Subject string `json:"subject"`

	// ExpiresAt is when this code expires.
	ExpiresAt time.Time `json:"expires_at"`

	// Used indicates if this code has been exchanged.
	Used bool `json:"used"`

	// CreatedAt is when this code was created.
	CreatedAt time.Time `json:"created_at"`
}

type Client struct {
	// ClientID is the unique client identifier.
	ClientID string `json:"client_id"`

	// ClientSecret is the client secret (may be empty for public clients).
	ClientSecret string `json:"client_secret,omitempty"`

	// ClientName is the human-readable name of the client.
	ClientName string `json:"client_name,omitempty"`

	// RedirectURIs is the list of allowed redirect URIs.
	RedirectURIs []string `json:"redirect_uris"`

	// GrantTypes is the list of allowed grant types.
	// Defaults to ["authorization_code"] if empty.
	GrantTypes []string `json:"grant_types,omitempty"`

	// ResponseTypes is the list of allowed response types.
	// Defaults to ["code"] if empty.
	ResponseTypes []string `json:"response_types,omitempty"`

	// TokenEndpointAuthMethod is the authentication method for the token endpoint.
	// Values: "none", "client_secret_basic", "client_secret_post"
	TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty"`

	// CreatedAt is when the client was registered.
	CreatedAt time.Time `json:"created_at"`
}

type Config struct {
	// Issuer is the OAuth issuer URL (e.g., "https://example.com").
	// This is used in metadata and token responses.
	Issuer string

	// Users is a map of username to password for authentication.
	// For production, consider implementing a custom Authenticator.
	Users map[string]string

	// Authenticator is a custom authentication function.
	// If nil, Users map is used for authentication.
	Authenticator Authenticator

	// Storage is the storage backend for clients, codes, and tokens.
	// If nil, an in-memory storage is used.
	Storage Storage

	// AuthorizationCodeExpiry is how long authorization codes are valid.
	// Defaults to 10 minutes.
	AuthorizationCodeExpiry time.Duration

	// AccessTokenExpiry is how long access tokens are valid.
	// Defaults to 1 hour.
	AccessTokenExpiry time.Duration

	// RefreshTokenExpiry is how long refresh tokens are valid.
	// Defaults to 24 hours. Set to 0 to disable refresh tokens.
	RefreshTokenExpiry time.Duration

	// AllowedScopes is the list of scopes this server supports.
	// If empty, no scope validation is performed.
	AllowedScopes []string

	// LoginPageTemplate is custom HTML for the login page.
	// If empty, a default login page is used.
	LoginPageTemplate string

	// Paths configures the endpoint paths.
	Paths *PathConfig

	// Logger is used for debug logging. If nil, uses slog.Default().
	Logger *slog.Logger

	// Debug enables verbose debug logging.
	Debug bool
}

type MemoryStorage struct {
	// contains filtered or unexported fields
}

type OAuthError struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
	ErrorURI         string `json:"error_uri,omitempty"`
}

type PathConfig struct {
	// Authorization is the authorization endpoint path. Defaults to "/oauth/authorize".
	Authorization string

	// Token is the token endpoint path. Defaults to "/oauth/token".
	Token string

	// Registration is the dynamic client registration path. Defaults to "/oauth/register".
	Registration string

	// Metadata is the authorization server metadata path.
	// Defaults to "/.well-known/oauth-authorization-server".
	Metadata string
}

type RegistrationRequest struct {
	RedirectURIs            []string `json:"redirect_uris"`
	ClientName              string   `json:"client_name,omitempty"`
	GrantTypes              []string `json:"grant_types,omitempty"`
	ResponseTypes           []string `json:"response_types,omitempty"`
	TokenEndpointAuthMethod string   `json:"token_endpoint_auth_method,omitempty"`
}

type RegistrationResponse struct {
	ClientID                string   `json:"client_id"`
	ClientSecret            string   `json:"client_secret,omitempty"`
	ClientName              string   `json:"client_name,omitempty"`
	RedirectURIs            []string `json:"redirect_uris"`
	GrantTypes              []string `json:"grant_types"`
	ResponseTypes           []string `json:"response_types"`
	TokenEndpointAuthMethod string   `json:"token_endpoint_auth_method"`
}

type Server struct {
	// contains filtered or unexported fields
}

type Storage interface {
	// Client operations
	CreateClient(client *Client) error
	GetClient(clientID string) (*Client, error)
	DeleteClient(clientID string) error

	// Authorization code operations
	CreateAuthorizationCode(code *AuthorizationCode) error
	GetAuthorizationCode(code string) (*AuthorizationCode, error)
	DeleteAuthorizationCode(code string) error
	MarkAuthorizationCodeUsed(code string) error

	// Token operations
	CreateToken(token *TokenInfo) error
	GetToken(accessToken string) (*TokenInfo, error)
	GetTokenByRefresh(refreshToken string) (*TokenInfo, error)
	DeleteToken(accessToken string) error
	DeleteTokensByClient(clientID string) error
}

type TokenInfo struct {
	// AccessToken is the access token value.
	AccessToken string `json:"access_token"`

	// RefreshToken is the refresh token value (if issued).
	RefreshToken string `json:"refresh_token,omitempty"`

	// TokenType is always "Bearer".
	TokenType string `json:"token_type"`

	// ClientID is the client this token was issued to.
	ClientID string `json:"client_id"`

	// Subject is the authenticated user.
	Subject string `json:"subject"`

	// Scope is the granted scope.
	Scope string `json:"scope,omitempty"`

	// ExpiresAt is when the access token expires.
	ExpiresAt time.Time `json:"expires_at"`

	// RefreshExpiresAt is when the refresh token expires.
	RefreshExpiresAt time.Time `json:"refresh_expires_at,omitempty"`

	// CreatedAt is when this token was created.
	CreatedAt time.Time `json:"created_at"`
}

type TokenRequest struct {
	GrantType    string
	Code         string
	RedirectURI  string
	ClientID     string
	ClientSecret string
	CodeVerifier string
	RefreshToken string
	Scope        string
}

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	Scope        string `json:"scope,omitempty"`
}