namespace DodoSSH.Client.Auth; /// /// Everything needed to talk to one identity provider. /// /// /// Populated from the DodoSSH server's /.well-known/dodossh-configuration, which is the whole /// onboarding story: the user types one server URL and the client discovers the authority, the client /// id and the scopes from it. /// public sealed record OidcClientOptions { /// The provider's issuer URL. public required Uri Authority { get; init; } /// The public client identifier registered for the desktop app. public required string ClientId { get; init; } /// /// Scopes requested at sign-in. /// /// /// offline_access is what yields a refresh token, and without one the user re-authenticates /// through the browser every time the access token expires. /// public IReadOnlyList Scopes { get; init; } = ["openid", "profile", "email", "offline_access"]; /// Path the loopback listener answers the redirect on. public string RedirectPath { get; init; } = "/callback"; /// /// How the authorization response is received. Loopback unless a head substitutes one. /// /// /// /// A factory rather than an instance, because a callback owns a socket or a system registration and /// must not outlive one sign-in. It takes the redirect path so the default keeps behaving exactly as /// it did when it was constructed inline. /// /// /// The Android head replaces this: a loopback redirect on a shared device is the attack RFC 8252 ยง8.3 /// names, since any other application can bind the port. See . /// /// public Func CallbackFactory { get; init; } = path => new LoopbackCallbackListener(path); /// Whether provider metadata must be served over HTTPS. Only false for local development. public bool RequireHttpsMetadata { get; init; } = true; /// How long to wait for the user to finish in the browser. /// /// Generous, because the user may have to find a password manager, complete a second factor, or /// approve a push notification on another device. /// public TimeSpan BrowserTimeout { get; init; } = TimeSpan.FromMinutes(5); /// Page shown in the browser once the callback is captured. public string CompletionHtml { get; init; } = """ DodoSSH

Signed in

You can close this tab and return to DodoSSH.

"""; }