"""{{ display_name }} MCP server — generated by mcpify. Do not hand-edit.

One implementation per auth scheme discovered in the OpenAPI spec
(REQ-1.2.2). Fields vary by scheme (e.g. `authorization_header` for
Basic/PAT/OAuth2, `consumer_key`/`private_key` for OAuth1, `api_key` for
API-key auth) — kept as a flexible string dict rather than a per-scheme
type, since exactly one strategy is active per deployment (REQ-1.2.3) and
callers already know which shape to expect from the strategy they're
using.
"""

from __future__ import annotations

from abc import ABC, abstractmethod

from .errors import AuthError

Credentials = dict[str, str]
AuthConfig = dict[str, str]


class AuthStrategy(ABC):
    @abstractmethod
    async def authenticate(self, config: AuthConfig) -> Credentials: ...

    async def refresh_token(self, _credentials: Credentials) -> Credentials:
        """Not every scheme has a refresh flow (only OAuth2 does in
        practice) — overridden by the strategies that do.
        """
        raise AuthError("this auth strategy does not support token refresh")

    @abstractmethod
    def validate_credentials(self, credentials: Credentials) -> bool: ...
