appauth

type Auth struct {
	// contains filtered or unexported fields
}

type Config struct {
	IssuerURL string

	// Popup client
	ClientID         string
	ClientSecret     string
	PopupRedirectURL string // MUST be the same route you mount the handler on

	Scopes []string // e.g. []string{oidc.ScopeOpenID, "profile", "email"}

	// Who may receive tokens via postMessage (strict allowlist)
	AllowedPostMessageOrigins []string

	Logger Logger      // optional
	Cache  cache.Cache // optional
}

type Logger interface {
	Printf(format string, v ...any)
}

type Opts struct {
	AnyRole  []string // realm or client roles
	AnyGroup []string
}

type User struct {
	Sub    string         `json:"sub,omitempty"`
	Email  string         `json:"email,omitempty"`
	Name   string         `json:"name,omitempty"`
	Groups []string       `json:"groups,omitempty"`
	Roles  []string       `json:"roles,omitempty"` // merged realm+client roles (best effort)
	Raw    map[string]any `json:"raw,omitempty"`
}