// Bitbucket Data Center MCP server — generated by mcpify. Do not hand-edit.

use std::collections::HashMap;

use async_trait::async_trait;

/// Fields vary by scheme (e.g. `authorization_header` for Basic/PAT/OAuth2,
/// `consumer_key`/`private_key` for OAuth1, `api_key` for API-key auth) —
/// kept as a flexible string map rather than a per-scheme type, since
/// exactly one strategy is active per deployment (REQ-1.2.3) and callers
/// already know which shape to expect from the strategy they're using.
pub type Credentials = HashMap<String, String>;
pub type AuthConfig = HashMap<String, String>;

/// One implementation per auth scheme discovered in the OpenAPI spec
/// (REQ-1.2.2). `refresh_token`'s default errors out, since not every
/// scheme has a refresh flow (only OAuth2 does in practice) — overridden by
/// the strategies that do.
#[async_trait]
pub trait AuthStrategy: Send + Sync {
    async fn authenticate(&self, config: &AuthConfig) -> anyhow::Result<Credentials>;

    async fn refresh_token(&self, _credentials: &Credentials) -> anyhow::Result<Credentials> {
        anyhow::bail!("this auth strategy does not support token refresh")
    }

    fn validate_credentials(&self, credentials: &Credentials) -> bool;
}
