oauth2

type AccessTokenModel struct {
	BaseSessionModel
}

type AuthCodeModel struct {
	BaseSessionModel
}

type BaseConfig = fosite.Config

type BaseSessionModel struct {
	core.BaseRecordProxy
}

type ClientModel struct {
	core.BaseRecordProxy
}

type Config struct {
	*BaseConfig

	PathPrefix                             string
	UserCollection                         string
	UserInfoClaimStrategy                  UserInfoClaimStrategy
	EnableRFC7591DynamicClientRegistration bool
	EnableRFC9728ProtectedResourceMetadata bool

	// MasterKeyProvider supplies the at-rest encryption master key for
	// envelope-encrypting OAuth2 key material in _params. If nil, the
	// DefaultMasterKeyProvider (reads OAUTH2_MASTER_KEY env) is used.
	// When the provider returns a nil master, encryption is disabled
	// and values are stored in legacy plaintext form (dev / back-compat).
	MasterKeyProvider MasterKeyProvider

	// DynamicClientRegistrationInitialAccessTokens, when EnableRFC7591…
	// is true, gates the /oauth2/register endpoint behind RFC 7591 §3
	// Initial Access Tokens. Each entry is a bearer token operators must
	// hand out to legitimate registration callers. Requests without an
	// Authorization: Bearer <token> header matching one of these values
	// are rejected with 401.
	//
	// Nil OR empty disables the gate, BUT the plugin then refuses to
	// register the /register route at all unless
	// AllowUnauthenticatedDynamicClientRegistration is also set (a loud
	// opt-in for development environments where rate-limit + network
	// boundary already gate the endpoint).
	DynamicClientRegistrationInitialAccessTokens []string

	// AllowUnauthenticatedDynamicClientRegistration acknowledges that DCR
	// is intentionally exposed with no Initial Access Token requirement.
	// REQUIRED when EnableRFC7591DynamicClientRegistration is true and
	// DynamicClientRegistrationInitialAccessTokens is empty; otherwise
	// the /register route is silently NOT bound.
	//
	// Use only in development or in environments where the registration
	// endpoint is reachable solely from a trusted network segment. Public
	// deployments should always populate InitialAccessTokens instead.
	AllowUnauthenticatedDynamicClientRegistration bool

	// LoginRedirectURL — when non-empty, GET/POST /oauth2/login redirects
	// (302) to this URL with the original query string (including
	// interaction_id) appended. The destination page is the consumer's
	// responsibility to render: authenticate the user against the right
	// collection, then POST back to /oauth2/login/complete with the
	// obtained pb_token + decision + consented_scopes.
	//
	// Empty (default) — the bundled plugin UI at /oauth2/login is served.
	//
	// This is the integration hook that lets a multi-tenant host re-use
	// its own branded /members/login or /admin/login flow instead of
	// presenting end users with two distinct login screens.
	//
	// Relative URLs ("/members/login") and absolute URLs
	// ("https://other.host/login") are both honored. The plugin does NOT
	// validate the destination — the consumer is trusted to point at a
	// page it controls.
	LoginRedirectURL string
}

type Consent struct {
	ID             string
	UserID         string
	UserCollection string
	ClientID       string
	GrantedScopes  []string
	GrantedAt      time.Time
}

type DefaultUserInfoClaimStrategy struct{}

type Instance struct {
	// contains filtered or unexported fields
}

type Interaction struct {
	ID              string
	ClientID        string
	ClientName      string
	UserCollection  string
	RedirectURI     string
	RequestForm     url.Values
	RequestedScopes []string
	Prompt          string
	RequestedAt     time.Time
	ExpiresAt       time.Time
}

type JTIModel struct {
	core.BaseRecordProxy
}

type MasterKeyProvider interface {
	// Master returns the 32-byte raw master key. If encryption-at-rest is
	// disabled, Master must return (nil, nil) -- callers treat that as
	// "plaintext mode".
	Master(ctx context.Context) ([]byte, error)
	// Fingerprint returns a short stable hex identifier for the master
	// key (first 8 bytes of its SHA-256). Returns ("", nil) when no
	// master is configured.
	Fingerprint(ctx context.Context) (string, error)
}

type MasterKeyringProvider interface {
	Keyring(ctx context.Context) (map[string][]byte, error)
}

type OAuth2Store struct {
	// contains filtered or unexported fields
}

type OpenIDConnectSessionModel struct {
	BaseSessionModel
}

type PKCEModel struct {
	BaseSessionModel
}

type PocketBaseStrategy struct {
	App    core.App
	Config interface {
		fosite.AccessTokenIssuerProvider
		fosite.AccessTokenLifespanProvider
		fosite.JWTScopeFieldProvider
	}
	HMACSHAStrategy fositeoauth2.CoreStrategy
}

type RFC7591ClientMetadata struct {
	RFC7591ClientMetadataRequest
	ClientID              string `json:"client_id"`
	ClientSecret          string `json:"client_secret"`
	ClientSecretExpiresAt int64  `json:"client_secret_expires_at"`
}

type RFC7591ClientMetadataRequest struct {
	Scope                   string              `json:"scope"`
	RedirectURIs            []string            `json:"redirect_uris"`
	TokenEndpointAuthMethod string              `json:"token_endpoint_auth_method"`
	GrantTypes              []string            `json:"grant_types"`
	ResponseTypes           []string            `json:"response_types"`
	Contacts                []string            `json:"contacts,omitempty"`
	ClientName              string              `json:"client_name"`
	ClientURI               string              `json:"client_uri,omitempty"`
	LogoURI                 string              `json:"logo_uri,omitempty"`
	TermsOfServiceURI       string              `json:"tos_uri,omitempty"`
	PolicyURI               string              `json:"policy_uri,omitempty"`
	JwksURI                 string              `json:"jwks_uri,omitempty"`
	Jwks                    *jose.JSONWebKeySet `json:"jwks,omitempty"`
	SoftwareID              string              `json:"software_id,omitempty"`
	SoftwareVersion         string              `json:"software_version,omitempty"`

	// The following fields are not part of the RFC7591 but are required for OpenID Connect client registration.
	// @ref https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.6.2
	RequestURIs []string `json:"request_uris,omitempty"`
}

type RFC7591ClientStorage interface {
	// RegisterClient registers a new client with the given metadata
	// and returns the created client or an error if the registration failed.
	RegisterClient(ctx context.Context, client *RFC7591ClientMetadataRequest) (fosite.Client, string, error)
}

type RefreshTokenModel struct {
	BaseSessionModel
}

type Session struct {
	fositeopenid.DefaultSession

	CollectionId string `json:"collection,omitempty"`
}

type SessionModel interface {
	core.RecordProxy

	GetCollectionName() string
}

type UserInfoAddressClaim struct {
	// Formatted
	// Full mailing address, formatted for display or use on a mailing label. This field MAY
	// contain multiple lines, separated by newlines. Newlines can be represented either as a
	// carriage return/line feed pair ("\r\n") or as a single line feed character ("\n").
	Formatted string `json:"formatted,omitempty"`

	// Street Address
	// Full street address component, which MAY include house number, street name, Post Office Box,
	// and multi-line extended street address information. This field MAY contain multiple lines,
	// separated by newlines. Newlines can be represented either as a carriage return/line feed
	// pair ("\r\n") or as a single line feed character ("\n").
	StreetAddress string `json:"street_address,omitempty"`

	// Locality
	// City or locality component.
	Locality string `json:"locality,omitempty"`

	// Region
	// State, province, prefecture, or region component.
	Region string `json:"region,omitempty"`

	// Postal Code
	// Zip code or postal code component.
	PostalCode string `json:"postal_code,omitempty"`

	// Country
	// Country name component.
	Country string `json:"country,omitempty"`
}

type UserInfoClaimStrategy interface {
	GetUserInfoClaims(e *core.RequestEvent, scopes []string) (interface{}, error)
}

type UserInfoClaims struct {
	// Subject
	// Identifier for the End-User at the Issuer.
	Sub string `json:"sub"`

	// Name
	// End-User's full name in displayable form including all name parts,
	// possibly including titles and suffixes, ordered according to the
	// End-User's locale and preferences.
	Name string `json:"name,omitempty"`

	// Given Name
	// Given name(s) or first name(s) of the End-User. Note that in some
	// cultures, people can have multiple given names; all can be present,
	// with the names being separated by space characters.
	GivenName string `json:"given_name,omitempty"`

	// Family Name
	// Surname(s) or last name(s) of the End-User. Note that in some
	// cultures, people can have multiple family names or no family name;
	// all can be present, with the names being separated by space
	// characters.
	FamilyName string `json:"family_name,omitempty"`

	// Middle Name
	// Middle name(s) of the End-User. Note that in some cultures, people
	// can have multiple middle names; all can be present, with the names
	// being separated by space characters.
	MiddleName string `json:"middle_name,omitempty"`

	// Nickname
	// Casual name of the End-User that may or may not be the same as the
	// given_name. For instance, a nickname value of Mike might be returned
	// alongside a given_name value of Michael.
	Nickname string `json:"nickname,omitempty"`

	// Preferred Username
	// Shorthand name by which the End-User wishes to be referred to at the
	// RP, such as janedoe or j.doe. This value MAY be any valid JSON string
	// including special characters such as @, /, or whitespace. The RP MUST
	// NOT rely upon this value being unique, as discussed in Section 5.7.
	PreferredUsername string `json:"preferred_username,omitempty"`

	// Profile
	// URL of the End-User's profile page. The contents of this Web page SHOULD
	// be about the End-User.
	Profile string `json:"profile,omitempty"`

	// Picture
	// URL of the End-User's profile picture. This URL MUST refer to an image
	// file (for example, a PNG, JPEG, or GIF image file), rather than to a
	// Web page containing an image. Note that this URL SHOULD specifically
	// reference a profile photo of the End-User suitable for displaying when
	// describing the End-User, rather than an arbitrary photo taken by the End-User.
	Picture string `json:"picture,omitempty"`

	// Website
	// URL of the End-User's Web page or blog. This Web page SHOULD contain
	// information published by the End-User or an organization that the End-User
	// is affiliated with.
	Website string `json:"website,omitempty"`

	// Email
	// End-User's preferred e-mail address. Its value MUST conform to the RFC 5322
	// addr-spec syntax. The RP MUST NOT rely upon this value being unique, as
	// discussed in Section 5.7.
	Email string `json:"email,omitempty"`

	// Email Verified
	// True if the End-User's e-mail address has been verified; otherwise false.
	// When this Claim Value is true, this means that the OP took affirmative steps
	// to ensure that this e-mail address was controlled by the End-User at the time
	// the verification was performed. The means by which an e-mail address is
	// verified is context specific, and dependent upon the trust framework or
	// contractual agreements within which the parties are operating.
	EmailVerified bool `json:"email_verified,omitempty"`

	// Gender
	// End-User's gender. Values defined by this specification are female and male.
	// Other values MAY be used when neither of the defined values are applicable.
	Gender string `json:"gender,omitempty"`

	// Birthdate
	// End-User's birthday, represented as an ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.
	// The year MAY be 0000, indicating that it is omitted. To represent only the year,
	// YYYY format is allowed. Note that depending on the underlying platform's date
	// elated function, providing just year can result in varying month and day, so the
	// implementers need to take this factor into account to correctly process the dates.
	Birthdate string `json:"birthdate,omitempty"`

	// ZoneInfo
	// String from IANA Time Zone Database [IANA.time‑zones] representing the End-User's
	// time zone. For example, Europe/Paris or America/Los_Angeles.
	ZoneInfo string `json:"zoneinfo,omitempty"`

	// Locale
	// End-User's locale, represented as a BCP47 [RFC5646] language tag. This is typically
	// an ISO 639 Alpha-2 [ISO639] language code in lowercase and an ISO 3166-1 Alpha-2
	// [ISO3166‑1] country code in uppercase, separated by a dash. For example, en-US or
	// fr-CA. As a compatibility note, some implementations have used an underscore as
	// the separator rather than a dash, for example, en_US; Relying Parties MAY choose
	// to accept this locale syntax as well.
	Locale string `json:"locale,omitempty"`

	// Phone Number
	// End-User's preferred telephone number. E.164 [E.164] is RECOMMENDED as the format of
	// this Claim, for example, +1 (425) 555-1212 or +56 (2) 687 2400. If the phone number
	// contains an extension, it is RECOMMENDED that the extension be represented using the
	// RFC 3966 [RFC3966] extension syntax, for example, +1 (604) 555-1234;ext=5678.
	PhoneNumber string `json:"phone_number,omitempty"`

	// Phone Number Verified
	// True if the End-User's phone number has been verified; otherwise false. When this Claim
	// Value is true, this means that the OP took affirmative steps to ensure that this phone
	// number was controlled by the End-User at the time the verification was performed. The
	// means by which a phone number is verified is context specific, and dependent upon the
	// trust framework or contractual agreements within which the parties are operating. When
	// true, the phone_number Claim MUST be in E.164 format and any extensions MUST be
	// represented in RFC 3966 format.
	PhoneNumberVerified bool `json:"phone_number_verified,omitempty"`

	// Address
	// End-User's preferred postal address. The value of the address member is a JSON [RFC8259]
	// structure containing some or all of the members defined in Section 5.1.1.
	Address *UserInfoAddressClaim `json:"address,omitempty"`

	// Updated At
	// Time the End-User's information was last updated. Its value is a JSON number representing
	// the number of seconds from 1970-01-01T00:00:00Z as measured in UTC until the date/time.
	UpdatedAt int64 `json:"updated_at,omitempty"`
}