providers

type BrowserOpenIdProvider interface {
	OpenIdProvider
	HookHTTPSession(h http.HandlerFunc)
}

type CommitType struct {
	Claim        string
	GQCommitment bool
}

type DefaultProviderVerifier struct {
	// contains filtered or unexported fields
}

type GithubOp struct {
	// contains filtered or unexported fields
}

type GitlabOp struct {
	// contains filtered or unexported fields
}

type GoogleOp struct {
	ClientID     string
	ClientSecret string
	Scopes       []string
	RedirectURIs []string
	GQSign       bool
	// contains filtered or unexported fields
}

type GoogleOptions struct {
	ClientID     string
	ClientSecret string
	Issuer       string // This should almost always be "https://accounts.google.com"
	Scopes       []string
	RedirectURIs []string
	GQSign       bool
}

type MockProvider struct {
	// contains filtered or unexported fields
}

type MockProviderOpts struct {
	Issuer     string
	ClientID   string
	GQSign     bool
	NumKeys    int
	CommitType CommitType
	// We keep VerifierOpts as a variable separate to let us test failures
	// where the mock op does something which causes a verification failure
	VerifierOpts ProviderVerifierOpts
}

type OpenIdProvider interface {
	RequestTokens(ctx context.Context, cic *clientinstance.Claims) ([]byte, error)
	PublicKeyByKeyId(ctx context.Context, keyID string) (*discover.PublicKeyRecord, error)
	PublicKeyByJTK(ctx context.Context, jtk string) (*discover.PublicKeyRecord, error)
	PublicKeyByToken(ctx context.Context, token []byte) (*discover.PublicKeyRecord, error)
	// Returns the OpenID provider issuer as seen in ID token e.g. "https://accounts.google.com"
	Issuer() string
	VerifyIDToken(ctx context.Context, idt []byte, cic *clientinstance.Claims) error
}

type ProviderVerifierOpts struct {
	// If ClientID is specified, then verification will require that the ClientID
	// be present in the audience ("aud") claim of the PK token payload
	ClientID string
	// Describes the place where the cicHash is committed to in the the ID token.
	// For instance the nonce payload claim name where the cicHash was stored during issuance
	CommitType CommitType
	// Specifies whether to skip the Client ID check, defaults to false
	SkipClientIDCheck bool
	// Custom function for discovering public key of Provider
	DiscoverPublicKey *discover.PublicKeyFinder
	// Allows for successful verification of expired tokens
	SkipExpirationCheck bool
	// Only allows GQ signatures, a provider signature under any other algorithm
	// is seen as an error
	GQOnly bool
}