api

type APIOptions struct {
	Auth    func(*http.Request) error
	AuthJWT func(*http.Request) error
	// AuthMTLS is invoked for routes whose config declared auth: "mtls"
	// AFTER the basic securex.VerifyMTLS gate has accepted the request.
	// Use this hook to enforce deployment-specific issuer-label policy
	// (PIV/CAC/custom) using policy.SupportedIssuers. Returning a non-nil
	// error rejects the request with 401.
	AuthMTLS func(*http.Request, securex.MTLSPolicy) error
	// MTLSRuntimes holds the boot-constructed CRL/OCSP revocation checkers
	// and CAC/PIV certificate-policy verifier for every mtls route whose
	// config declares crl/ocsp/cac_piv/principal_mapping (L-51), keyed by
	// "METHOD /path". server_lib.go.tmpl's Serve constructs this map ONCE
	// at boot (mtlsx.CRLChecker/OCSPChecker hold response caches and make
	// network calls, so they must never be rebuilt per request) and passes
	// it straight through here. A nil map, or a route missing from it, is
	// the zero securex.MTLSRuntime{} -- "no CRL/OCSP/CAC-PIV enforcement
	// for this route" -- which is exactly pre-L-51 behavior, so this field
	// is fully backward compatible with hand-built APIOptions literals
	// (tests, custom entrypoints) that never set it.
	MTLSRuntimes map[string]securex.MTLSRuntime
	// AuthWebhook resolves a per-route HMAC secret keyed on the
	// WebhookPolicy.Name supplied at codegen. Returning (nil, err)
	// rejects the request with a generic 401 envelope before any
	// signature check. The generator wires server.go.tmpl to populate
	// this from rc.Security.Webhooks; consumers that supply their own
	// resolver (e.g. a Vault-backed lookup) pass it via
	// APIOptions{AuthWebhook: myFunc}.
	AuthWebhook func(name string) ([]byte, error)
	// CookieName is the name of the HttpOnly cookie carrying the session JWT
	// for routes with auth: "cookie". Empty falls back to "session" at
	// request time. Wired by server_lib from security.auth.cookie_name.
	CookieName string
	// CSRF, when non-nil, enforces signed double-submit CSRF tokens on
	// cookie-authenticated state-changing requests and powers the issuance
	// endpoint. Wired by server_lib from security.csrf.
	CSRF           *csrfx.Signer
	CSRFCookieName string
	CSRFHeaderName string
	// CSRFSessionID extracts the session identifier a token is bound to
	// (default: verified claims Subject).
	CSRFSessionID func(*http.Request) string
	GlobalRate    float64
	GlobalBurst   float64
}

type CatchAllServerInterface interface {
	HandleRoute(w http.ResponseWriter, r *http.Request, route RouteInfo, req any) (any, error)
}

type OAuth2Error struct {
	Code        string
	Description string
	URI         string
	Status      int
	Err         error
}

type RouteInfo struct {
	Method             string
	Path               string
	MuxPattern         string
	MethodName         string
	BodyMode           string
	Auth               string
	Surface            string
	Sensitivity        string
	Profile            string
	RequestType        string
	ResponseType       string
	RequestSchema      string
	ResponseSchema     string
	HasTypedRequest    bool
	HasTypedResponse   bool
	PathParams         []string
	RequiredRoles      []string
	RequiredScopes     []string
	RequiredAttributes map[string]string
	// APPSEC-Gen-F-006: surface the per-route WebAuthn ceremony policy
	// (ceremony, phase, attestation, user_verification, discoverable)
	// so catch-all handlers can read it without re-parsing the config.
	Webauthn *WebauthnInfo
	// APPSEC-15 (Plan 02 follow-up): per-route mTLS CA bundle path so
	// catch-all handlers can construct their own per-route
	// mtlsx.Verifier. Empty when the operation declares no mtls block
	// or no ca_bundle_path. Server-construction-time wiring still
	// goes through api.WithMTLS for the listener.
	MTLSCABundlePath string
}

type ServerInterface interface {
	Health(w http.ResponseWriter, r *http.Request, req *map[string]any) (*types.HealthResp, error)
}

type StatusError struct {
	Code    int
	Message string
	Err     error
}

type UnimplementedServer struct{}

type WebauthnInfo struct {
	Ceremony                string
	Phase                   string
	Attestation             string
	AuthenticatorAttachment string
	UserVerification        string
	Discoverable            bool
}