modules/auth/social

const (
	NotificationEmailDisabled  = "email-disabled"
	NotificationEmailEnabled   = "email-enabled"
	NotificationConsentRevoked = "consent-revoked"
	NotificationAccountDelete  = "account-delete"
)

const (
	Google = "google"
	Apple  = "apple"
)

const (
	// MaxTokenAge is how old an ID token can be when it's verified.
	MaxTokenAge = 10 * time.Minute
)

var (
	// ErrInvalidConfig reports a configuration that can't be used.
	ErrInvalidConfig = errors.New("social: invalid configuration")
	// ErrInvalidToken reports an ID token or notification that fails
	// verification: signature, issuer, audience, nonce, age or claims.
	ErrInvalidToken = errors.New("social: invalid ID token")
	// ErrExchange reports an authorization code the provider refused, or a
	// provider that couldn't be reached.
	ErrExchange = errors.New("social: authorization code exchange failed")
	// ErrWebUnavailable reports a provider configured only for native apps.
	ErrWebUnavailable = errors.New("social: web sign-in is not configured")
)

func NewPKCEVerifier() string

func ParseApplePrivateKey(pemBytes []byte) (*ecdsa.PrivateKey, error)

type AppleConfig struct {
	// TeamID, KeyID and PrivateKey sign client secrets: the Team ID, and the
	// ID and .p8 key of a Sign in with Apple key.
	TeamID     string
	KeyID      string
	PrivateKey *ecdsa.PrivateKey
	// ServicesID is the web client; empty for native apps only.
	ServicesID string
	// BundleIDs are the iOS apps ID tokens may be issued for.
	BundleIDs  []string
	Endpoints  Endpoints
	HTTPClient *http.Client
	Now        func() time.Time
}

type Endpoints struct {
	AuthURL   string
	TokenURL  string
	KeysURL   string
	RevokeURL string
	// Issuers are the accepted "iss" values of ID tokens.
	Issuers []string
}

func AppleEndpoints() Endpoints

func GoogleEndpoints() Endpoints

type GoogleConfig struct {
	// ClientID and ClientSecret are the Web application client. Android apps
	// use ClientID too.
	ClientID     string
	ClientSecret string
	// NativeClientIDs are the iOS and Android client IDs ID tokens may be
	// issued for.
	NativeClientIDs []string
	Endpoints       Endpoints
	HTTPClient      *http.Client
	Now             func() time.Time
}

type Identity struct {
	// Provider is Google or Apple.
	Provider string
	// Subject identifies the person at the provider; it never changes.
	Subject string
	Email   string
	// EmailVerified reports that the provider checked the person owns Email.
	EmailVerified bool
	// PrivateEmail reports an Apple relay address.
	PrivateEmail bool
	// Name is the person's name, when the provider sends it.
	Name string
	// Audience is the client ID the token was issued for.
	Audience string
}

type Notification struct {
	// Type is one of the Notification constants.
	Type    string
	Subject string
	Email   string
	// PrivateEmail reports an Apple relay address.
	PrivateEmail bool
	At           time.Time
}

type Provider struct {
	// contains filtered or unexported fields
}

func NewApple(c AppleConfig) (*Provider, error)

func NewGoogle(c GoogleConfig) (*Provider, error)

func (p *Provider) AppleNotification(ctx context.Context, payload string) (Notification, error)

func (p *Provider) AuthCodeURL(redirectURL, state, nonce, verifier string) string

func (p *Provider) Exchange(ctx context.Context, redirectURL, code, verifier, nonce string) (Token, error)

func (p *Provider) ExchangeNativeCode(ctx context.Context, code, clientID string) (string, error)

func (p *Provider) Name() string

func (p *Provider) NativeClients() []string

func (p *Provider) Revoke(ctx context.Context, refreshToken, clientID string) error

func (p *Provider) VerifyIDToken(ctx context.Context, rawIDToken, nonce string) (Identity, error)

func (p *Provider) Web() bool

type Token struct {
	Identity Identity
	// RefreshToken is set when the provider returns one (Apple); store it
	// encrypted to revoke it later.
	RefreshToken string
}