auth

type Claims struct{}

type ErrorResponse struct {
	Error string `json:"error"`
}

type Request struct {
	// 10-char App Id prefix found in App identifiers section
	TeamID string

	//ClientID is the "Services ID" value that you get when navigating to your "sign in with Apple"-enabled service ID
	ClientID string

	// This is the ID of the private key
	KeyID string

	// This is the private key file (.p8). You can download it from apple portal
	ClientSecret []byte

	HttpClient httpClient
}

type TokenResponse struct {

	// The refresh token used to regenerate new access tokens when validating an authorization code.
	// Store this token securely on your server.
	// The refresh token isn’t returned when validating an existing refresh token.
	RefreshToken string `json:"refresh_token"`

	// A token used to access allowed data,
	// such as generating and exchanging transfer identifiers during user migration
	AccessToken string `json:"access_token"`

	// The amount of time, in seconds, before the access token expires.
	ExpiresIn int `json:"expires_in"`

	// A JSON Web Token (JWT) that contains the user’s identity information.
	IDToken string `json:"id_token"`

	// The type of access token, which is always bearer.
	TokenType string `json:"token_type"`

	Claims claims
}

type User struct {
	// The unique identifier for the user (sub).
	ID string `json:"id"`

	// A string value that represents the user’s email address.
	// The email address is either the user’s real email address or the proxy address,
	// depending on their private email relay service.
	Email string `json:"email"`

	// A string or Boolean value that indicates whether the service verifies the email.
	EmailVerified bool `json:"email_verified"`

	// A string or Boolean value that indicates whether the email
	// that the user shares is the proxy address.
	// The value can either be a string ("true" or "false") or a Boolean (true or false).
	IsPrivateEmail bool `json:"is_private_email"`

	// An Integer value that indicates whether the user appears to be a real person.
	// Use the value of this claim to mitigate fraud.
	// The possible values are: 0 (or Unsupported), 1 (or Unknown), 2 (or LikelyReal).
	RealUserStatus int `json:"real_user_status"`
}

type Validation interface {

	// Validates request using the authorization code received in an authorization
	// response sent to your app.
	// Returns accessToken, refreshToken, idToken
	ValidateCode(ctx context.Context, code string) (*TokenResponse, error)

	// Validate request using destinatio URI provided in authorization request
	// Returns accessToken, refreshToken, idToken
	ValidateCodeWithRedirectURI(ctx context.Context, code string, redirectURI string) (*TokenResponse, error)

	// Validates given refresh token
	// Returns accessToken and idToken
	ValidateRefreshToken(ctx context.Context, refreshToken string) (*TokenResponse, error)
}