mcpauth

type APIKey struct {
	KeyHash   string    `json:"key_hash"`
	UserID    string    `json:"user_id"`
	CreatedAt time.Time `json:"created_at"`
}

type Code struct {
	Code          string
	ClientID      string
	RedirectURI   string
	CodeChallenge string
	Resource      string
	UserID        string
	Scopes        []string
	ExpiresAt     time.Time
	// contains filtered or unexported fields
}

type Config struct {
	// ServerURL is the public-facing base URL of the server (e.g.
	// "https://example.com"). Used for issuer, metadata endpoints,
	// and audience validation.
	ServerURL string

	// Users validates credentials during the authorization code flow.
	// Required for /oauth/authorize to work.
	Users UserAuthenticator

	// Persist is the durable storage backend. Pass nil for in-memory
	// only operation (useful in tests and single-process deployments).
	Persist Persistence

	// Logger receives structured log output. Defaults to slog.Default()
	// when nil.
	Logger *slog.Logger

	// APIKeyPrefix, when non-empty, enables API key authentication in
	// the middleware. Bearer tokens starting with this prefix are
	// treated as API keys rather than OAuth access tokens.
	APIKeyPrefix string

	// LoginTitle is the heading shown on the login page.
	// Defaults to "Sign In" when empty.
	LoginTitle string

	// LoginSubtitle is the subtitle shown on the login page.
	// Defaults to "Sign in to grant access to your account." when empty.
	LoginSubtitle string

	// GrantTypes lists the grant types advertised in server metadata.
	// Defaults to ["authorization_code", "refresh_token"] when nil.
	GrantTypes []string

	// TrustedProxyHeader, when non-empty, is the HTTP header used to
	// extract the client IP address (e.g. "X-Forwarded-For"). Only set
	// this when the server runs behind a trusted reverse proxy.
	TrustedProxyHeader string

	// LoginTemplate, when non-nil, replaces the built-in login page
	// with a custom template. The template receives a LoginData struct.
	// When nil, the default built-in login page is used.
	LoginTemplate *template.Template

	// ClientSecretValidator, when non-nil, replaces the default SHA-256
	// constant-time comparison used to validate client secrets. This allows
	// callers to use bcrypt or other hashing schemes for stored secrets.
	//
	// The function receives the raw secret from the incoming request and
	// the stored hash from the OAuthClient.SecretHash field. Return true
	// if the secret matches the hash.
	//
	// When nil, the default behavior computes SHA-256(rawSecret) and
	// performs a constant-time comparison against storedHash. This is safe
	// for high-entropy generated secrets but not suitable for user-chosen
	// passwords.
	ClientSecretValidator func(rawSecret, storedHash string) bool
}

type LoginData struct {
	CSRFToken           string
	ClientID            string
	ClientName          string
	RedirectURI         string
	State               string
	CodeChallenge       string
	CodeChallengeMethod string
	Scope               string
	Resource            string
	Error               string
	Title               string
	Subtitle            string
}

type MapAuthenticator struct {
	// contains filtered or unexported fields
}

type OAuthClient struct {
	ClientID                string   `json:"client_id"`
	ClientName              string   `json:"client_name,omitempty"`
	RedirectURIs            []string `json:"redirect_uris"`
	GrantTypes              []string `json:"grant_types,omitempty"`
	ResponseTypes           []string `json:"response_types,omitempty"`
	TokenEndpointAuthMethod string   `json:"token_endpoint_auth_method,omitempty"`
	SecretHash              string   `json:"secret_hash,omitempty"`
	IssuedAt                int64    `json:"client_id_issued_at,omitempty"`
	UserID                  string   `json:"user_id,omitempty"`
}

type OAuthToken struct {
	Token        string    `json:"token,omitempty"`
	TokenHash    string    `json:"token_hash"`
	Kind         string    `json:"kind,omitempty"`
	UserID       string    `json:"user_id"`
	Resource     string    `json:"resource"`
	Scopes       []string  `json:"scopes,omitempty"`
	ExpiresAt    time.Time `json:"expires_at"`
	RefreshToken string    `json:"refresh_token,omitempty"`
	RefreshHash  string    `json:"refresh_hash,omitempty"`
	ClientID     string    `json:"client_id,omitempty"`
}

type Persistence interface {
	SaveOAuthToken(token OAuthToken) error
	DeleteOAuthToken(tokenHash string) error
	AllOAuthTokens() ([]OAuthToken, error)

	SaveOAuthClient(client OAuthClient) error
	DeleteOAuthClient(clientID string) error
	AllOAuthClients() ([]OAuthClient, error)

	SaveAPIKey(hash string, key APIKey) error
	DeleteAPIKey(hash string) error
	AllAPIKeys() (map[string]APIKey, error)
}

type ProtectedResourceMetadata struct {
	Resource               string   `json:"resource"`
	AuthorizationServers   []string `json:"authorization_servers"`
	ScopesSupported        []string `json:"scopes_supported,omitempty"`
	BearerMethodsSupported []string `json:"bearer_methods_supported"`
}

type Server struct {
	// contains filtered or unexported fields
}

type ServerMetadata struct {
	Issuer                            string   `json:"issuer"`
	AuthorizationEndpoint             string   `json:"authorization_endpoint"`
	TokenEndpoint                     string   `json:"token_endpoint"`
	RegistrationEndpoint              string   `json:"registration_endpoint,omitempty"`
	ScopesSupported                   []string `json:"scopes_supported,omitempty"`
	ResponseTypesSupported            []string `json:"response_types_supported"`
	GrantTypesSupported               []string `json:"grant_types_supported,omitempty"`
	CodeChallengeMethodsSupported     []string `json:"code_challenge_methods_supported,omitempty"`
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`
}

type UserAccountChecker interface {
	// IsAccountActive returns true if the user account is enabled.
	// Returns (false, nil) for disabled accounts.
	// Returns non-nil error only for system failures.
	IsAccountActive(ctx context.Context, userID string) (bool, error)
}

type UserAuthenticator interface {
	// ValidateCredentials checks username/password and returns the user ID
	// on success. Returns ("", nil) if credentials are invalid.
	// Returns non-nil error only for system failures (database down, etc.).
	ValidateCredentials(ctx context.Context, username, password string) (userID string, err error)
}