flame

type Application struct {
	coal.Base   `json:"-" bson:",inline" coal:"applications"`
	Name        string `json:"name" bson:"name"`
	Key         string `json:"key" bson:"key" coal:"flame-client-id"`
	Secret      string `json:"secret,omitempty" bson:"-"`
	SecretHash  []byte `json:"-" bson:"secret"`
	RedirectURL string `json:"redirect-url" bson:"redirect_url"`
}

type AuthInfo struct {
	Client        Client
	ResourceOwner ResourceOwner
	AccessToken   GenericToken
}

type Authenticator struct {

	// The function gets invoked by the authenticator with critical errors.
	Reporter func(error)
	// contains filtered or unexported fields
}

type Client interface {
	coal.Model

	// ValidRedirectURL should return whether the specified redirect url can be
	// used by this client.
	//
	// Note: In order to increases security the callback should only allow
	// pre-registered redirect urls.
	ValidRedirectURL(string) bool

	// ValidSecret should determine whether the specified plain text secret
	// matches the stored hashed secret.
	ValidSecret(string) bool
}

type GenericToken interface {
	coal.Model

	// GetTokenData should collect and return the tokens data.
	GetTokenData() (typ TokenType, scope []string, expiresAt time.Time, client coal.ID, resourceOwner *coal.ID)

	// SetTokenData should set the specified token data.
	SetTokenData(typ TokenType, scope []string, expiresAt time.Time, client Client, resourceOwner ResourceOwner)
}

type JWTClaims struct {
	jwt.StandardClaims

	// Data contains user defined key value pairs.
	Data map[string]interface{} `json:"dat,omitempty"`
}

type Policy struct {
	// The secret should be at least 16 characters long.
	Secret string

	// The available grants.
	PasswordGrant          bool
	ClientCredentialsGrant bool
	ImplicitGrant          bool

	// The token model.
	Token GenericToken

	// The client models.
	Clients []Client

	// ClientFilter should return a filter that should be applied when looking
	// up a client. This callback can be used to select clients based on other
	// request parameters. It can return ErrInvalidFilter to cancel the
	// authentication request.
	ClientFilter func(Client, *http.Request) (bson.M, error)

	// ResourceOwners should return a list of resource owner models that are
	// tried in order to resolve grant requests.
	ResourceOwners func(Client) []ResourceOwner

	// ResourceOwnerFilter should return a filter that should be applied when
	// looking up a resource owner. This callback can be used to select resource
	// owners based on other request parameters. It can return ErrInvalidFilter
	// to cancel the authentication request.
	ResourceOwnerFilter func(ResourceOwner, *http.Request) (bson.M, error)

	// GrantStrategy is invoked by the authenticator with the grant type, the
	// requested scope, the client and the resource owner before issuing an
	// access token. The callback should return no error and the scope that
	// should be granted. It can return ErrGrantRejected or ErrInvalidScope to
	// cancel the grant request.
	//
	// Note: ResourceOwner is not set for a client credentials grant.
	GrantStrategy func(oauth2.Scope, Client, ResourceOwner) (oauth2.Scope, error)

	// TokenData should return a map of data that should be included in the JWT
	// tokens under the "dat" field.
	TokenData func(Client, ResourceOwner, GenericToken) map[string]interface{}

	// The token used lifespans.
	AccessTokenLifespan  time.Duration
	RefreshTokenLifespan time.Duration
}

type ResourceOwner interface {
	coal.Model

	// ValidSecret should determine whether the specified plain text password
	// matches the stored hashed password.
	ValidPassword(string) bool
}

type Token struct {
	coal.Base   `json:"-" bson:",inline" coal:"tokens:tokens"`
	Type        TokenType `json:"type"`
	ExpiresAt   time.Time `json:"expires-at" bson:"expires_at"`
	Scope       []string  `json:"scope" bson:"scope"`
	Application coal.ID   `json:"-" bson:"application_id" coal:"application:applications"`
	User        *coal.ID  `json:"-" bson:"user_id" coal:"user:users"`
}

type TokenType string

type User struct {
	coal.Base    `json:"-" bson:",inline" coal:"users"`
	Name         string `json:"name" bson:"name"`
	Email        string `json:"email" bson:"email" coal:"flame-resource-owner-id"`
	Password     string `json:"password,omitempty" bson:"-"`
	PasswordHash []byte `json:"-" bson:"password"`
}