package authproxy

// stateClaims rides through Google's OAuth flow as the `state` parameter.
// It remembers which app host the user was visiting and where to send them
// after sign-in.
type stateClaims struct {
	Host string `json:"h"` // app host the user was visiting
	// App is the dokku app that host belongs to. It rides through the flow
	// because the callback runs on the auth host, which may be a different
	// app than the one being signed in to — and it is that destination app's
	// access lists that decide.
	App   string `json:"a"`
	RD    string `json:"r"` // relative path to return to
	Proto string `json:"p"` // http or https
	Nonce string `json:"n"`
	Exp   int64  `json:"e"` // unix seconds
}

// handoffClaims is the short-lived token the callback (on the auth host)
// hands to the destination app host so it can mint a session cookie on its
// own domain.
type handoffClaims struct {
	Email string `json:"em"`
	User  string `json:"u"` // Google account id (sub)
	Name  string `json:"na"`
	Host  string `json:"h"`
	RD    string `json:"r"`
	Proto string `json:"p"`
	Nonce string `json:"n"`
	Exp   int64  `json:"e"`
}

// sessionClaims is the content of the session cookie. Cookies are host-only
// (no Domain attribute) and additionally pinned to the host they were minted
// for.
type sessionClaims struct {
	Email string `json:"em"`
	User  string `json:"u"`
	Name  string `json:"na"`
	Host  string `json:"h"`
	Exp   int64  `json:"e"`
}