internal/

Package admin0 exposes the mock's control-plane endpoints under /admin0/*.

Package authapi mounts hand-coded Auth0 Authentication API endpoints onto chi.

Package bearer provides middleware that validates an Authorization: Bearer JWT against a jwks.KeySet and attaches the claims to the request context.

Package claims owns a per-process map of custom JWT claims that get merged into every access token minted by the authapi package.

Package clock provides a pluggable Now() time source so the mock's protocol-time outputs (JWT iat/exp, code/OTP TTLs, bearer validation) can be frozen or skewed at runtime via /admin0/clock for deterministic tests.

Package config loads runtime settings from environment variables.

Package events owns the in-process Server-Sent Events hub for the mock's GET /events endpoint.

Package httperr writes JSON error responses in either Auth0 Management API shape or Auth0 Authentication API shape.

Package jwks owns the in-process RS256 signing key, JWT minting, JWT verification, and JWKS publication.

Package logger constructs the project's zerolog.Logger.

Package matches owns the in-memory store of registered mock expectations.

Package mfa implements the in-memory state for Auth0's MFA challenge dance.

Package mgmtapi mounts the spec-driven Management API surface onto chi: one generic, bearer-protected handler per Auth0 Management API operation.

Package middleware contains shared net/http middleware.

Package permissions owns a per-audience map of permission strings.

Package pkce implements the in-memory store of PKCE challenges that link a /authorize redirect to its later /oauth/token exchange.

Package router builds the http.Handler that fronts the mock service.

Package server hosts the HTTP and (later) HTTPS listeners.

Package spec wraps the embedded Auth0 Management API skeleton.

Package tlscert produces a *tls.Config from either user-supplied cert/key files or an auto-generated self-signed cert covering configured hostnames.

Package version exposes build-time metadata baked into the binary at link time via `-ldflags="-X ..."`.