pub(open) trait ApiKeyStore {
  async fn read(Self, provider_id : String) -> ApiKeyCredential? raise OAuthError
  async fn write(Self, provider_id : String, credential : ApiKeyCredential) -> Unit raise OAuthError
  async fn delete(Self, provider_id : String) -> Unit raise OAuthError
}

pub(open) trait AuthInteraction {
  fn notify(Self, message : AuthMessage) -> Unit
  fn is_cancelled(Self) -> Bool
}

pub(open) trait AuthPromptInteraction {
  async fn prompt(Self, request : AuthPromptRequest) -> String raise OAuthError
}

pub(open) trait CallbackServer {
  async fn start(self : Self, port : Int) -> Unit raise OAuthError
  async fn wait_callback(self : Self) -> (String, String) raise OAuthError
  fn stop(self : Self) -> Unit
}

pub(open) trait CredentialStore {
  async fn read(Self, provider_id : String) -> Credential? raise OAuthError
  async fn write(Self, provider_id : String, credential : Credential) -> Unit raise OAuthError
  async fn delete(Self, provider_id : String) -> Unit raise OAuthError
}

pub(open) trait OAuthHttpTransport {
  async fn post(Self, request : OAuthHttpRequest) -> OAuthHttpResponse raise OAuthError
  async fn get(Self, url : String, headers : Map[String, String]) -> OAuthHttpResponse raise OAuthError = _
}

pub(open) trait OAuthProvider {
  fn provider_id(Self) -> String
  async fn login(Self, interaction : &AuthInteraction) -> Credential raise OAuthError
  async fn refresh(Self, credential : Credential) -> Credential raise OAuthError
  fn to_auth(Self, credential : Credential) -> AuthHeader
}

pub(open) trait ProviderCredentialStore {
  async fn read(Self, provider_id : String) -> ProviderCredential? raise OAuthError
  async fn write(Self, provider_id : String, credential : ProviderCredential) -> Unit raise OAuthError
  async fn delete(Self, provider_id : String) -> Unit raise OAuthError
}

pub(all) suberror OAuthError {
  AuthPending
  SlowDown
  AccessDenied
  ExpiredToken
  InvalidGrant
  HttpError(String)
  ParseError(String)
  Cancelled
} derive(Eq, 
@moonbitlang/core/debug.Debug
Debug)

pub(all) struct ApiKeyCredential {
  secret : String
  metadata : Map[String, String]
}

pub(all) enum AuthHeader {
  Bearer(String)
  Header(Map[String, String])
} derive(Eq, 
@moonbitlang/core/debug.Debug
Debug)

pub(all) enum AuthMessage {
  AuthUrl(String)
  DeviceCode(String, String)
  Progress(String)
}

pub(all) struct AuthPromptOption {
  id : String
  label : String
  description : String?
}

pub(all) enum AuthPromptRequest {
  Secret(message~ : String)
  Select(message~ : String, options~ : Array[AuthPromptOption])
}

pub(all) struct Credential {
  access_token : String
  refresh_token : String
  expires_at : Int
  token_type : String
  metadata : Map[String, String]
}

pub(all) struct DefaultOAuthHttpTransport {
}

pub(all) struct DeviceAuthResponse {
  device_code : String
  user_code : String
  verification_uri : String
  verification_uri_complete : String?
  expires_in : Int
  interval : Int
}

pub(all) struct DeviceFlowConfig {
  client_id : String
  device_auth_endpoint : String
  token_endpoint : String
  scope : String
  default_headers : Map[String, String]
}

pub(all) struct InMemoryApiKeyStore {
  credentials : Map[String, ApiKeyCredential]
}

pub(all) struct InMemoryCredentialStore {
  credentials : Map[String, Credential]
}

pub(all) struct InMemoryProviderCredentialStore {
  credentials : Map[String, ProviderCredential]
}

pub(all) struct NativeCallbackServer {
  code : String
  server : 
@moonbitlang/async/http.Server
Server?
}

pub(all) struct NoopAuthInteraction {
}

pub(all) struct NoopAuthPromptInteraction {
}

pub(all) struct OAuthHttpRequest {
  url : String
  body : String
  headers : Map[String, String]
}

pub(all) struct OAuthHttpResponse {
  status : Int
  body : String
}

pub(all) struct PkceFlowConfig {
  client_id : String
  authorize_url : String
  token_url : String
  redirect_uri : String
  callback_port : Int
  scope : String
  extra_authorize_params : Array[(String, String)]
  fallback_port : Int?
}

pub(all) struct PkcePair {
  code_verifier : String
  code_challenge : String
  code_challenge_method : String
}

pub(all) enum ProviderCredential {
  OAuth(Credential)
  ApiKey(ApiKeyCredential)
}

pub(all) struct ResourceMetadata {
  authorization_servers : Array[String]
}

pub(all) struct ServerMetadata {
  authorization_endpoint : String
  token_endpoint : String
  device_authorization_endpoint : String?
  registration_endpoint : String?
  scopes_supported : Array[String]
}

fn create_callback_server() -> NativeCallbackServer

async fn fetch_resource_metadata(uri : String, transport : &OAuthHttpTransport) -> ResourceMetadata raise OAuthError

async fn fetch_server_metadata(metadata_url : String, transport : &OAuthHttpTransport) -> ServerMetadata raise OAuthError

fn generate_pkce() -> PkcePair

fn oauth_form_url_encode(value : String) -> String

async fn register_client(registration_endpoint : String, client_name : String, transport : &OAuthHttpTransport) -> String raise OAuthError

async fn run_device_flow(config : DeviceFlowConfig, interaction : &AuthInteraction) -> Credential raise OAuthError

async fn run_device_flow_with_transport(config : DeviceFlowConfig, interaction : &AuthInteraction, transport : &OAuthHttpTransport) -> Credential raise OAuthError

async fn run_pkce_browser_flow(config : PkceFlowConfig, interaction : &AuthInteraction, server : &CallbackServer, transport : &OAuthHttpTransport, parse_credential? : (Json) -> Credential raise OAuthError, prompt? : &AuthPromptInteraction) -> Credential raise OAuthError

async fn run_refresh_flow(token_endpoint~ : String, client_id~ : String, refresh_token~ : String, transport~ : &OAuthHttpTransport) -> Credential raise OAuthError