oidc_provider

type Config struct {
	// Name identifies this provider (e.g. "google", "apple", "github").
	Name string

	// OAuth2 credentials
	ClientID     string
	ClientSecret string
	RedirectURL  string

	// Scopes to request (e.g. []string{"openid", "email", "profile"})
	Scopes []string

	// AuthCodeOptions are additional options passed to AuthCodeURL.
	AuthCodeOptions []oauth2.AuthCodeOption

	// LoginPath is where to redirect on auth errors.
	LoginPath string
	// SuccessPath is where to redirect after successful login.
	SuccessPath string

	// Issuer is the OIDC issuer URL (e.g. "https://accounts.google.com").
	// Used for OIDC discovery to obtain endpoints and token verification.
	// Ignored when Endpoint is set.
	Issuer string

	// Endpoint sets OAuth2 endpoints manually, skipping OIDC discovery.
	// Required for non-OIDC providers like GitHub.
	Endpoint *oauth2.Endpoint

	// FetchUserInfo extracts user identity from the token response.
	// For OIDC providers, leave nil to use automatic ID token verification.
	// For plain OAuth2 providers, set this to call the provider's userinfo API.
	FetchUserInfo func(ctx context.Context, token *oauth2.Token, nonce string) (*UserInfo, error)
}

type Deps struct {
	DB         *sql.DB
	StateStore StateStore
	Users      dbi.Factory[iam.UserStore]
	OAuth      dbi.Factory[iam.OAuthStore]
	Sessions   iam.SessionStore
}

type Provider struct {
	// contains filtered or unexported fields
}

type StateStore interface {
	// Set stores a state value with expiration.
	Set(key, value string, expiration time.Duration) error
	// GetAndDelete retrieves and deletes a state value (one-time use).
	// Returns empty string and no error if key not found or expired.
	GetAndDelete(key string) (string, error)
}

type UserInfo struct {
	Subject       string
	Email         string
	EmailVerified bool
}