core

type Authentication interface {
	Principal
	// GetAuthorities() returns the authorities this principal has been granted.
	GetAuthorities() []GrantedAuthority

	// GetCredentials() returns the credentials that prove the principal is correct.
	GetCredentials() any

	// GetPrincipal() The identity of the principal being authenticated.
	GetPrincipal() any

	// IsAuthenticated() returns whether that principal has been authenticated.
	IsAuthenticated() bool
}

type AuthenticationException interface {
	Exception

	// AuthenticationRequest() returns the [Authentication] causing this Exception
	AuthenticationRequest() Authentication
}

type AuthenticationManager interface {
	Manager

	// Authenticate() will return an authenticated [Authenication] or an AuthenticationException.
	// It will delegate this to a configured [AuthenticationProvider] supporting this [Authentication]
	Authenticate(Authentication) (Authentication, AuthenticationException)
}

type AuthenticationProvider interface {
	// Authenticate() will return an authenticated [Authenication] or an AuthenticationException
	Authenticate(Authentication) (Authentication, AuthenticationException)

	// Supports() should return whether this [AuthenticationProvider] supports this [Authentication]
	Supports(Authentication) bool
}

type Authority string

type CredentialsContainer interface {
	// EraseCredentials() will proceed on erasing the credentials.
	EraseCredentials()
}

type DefaultSecurityFilterAction = Enum[DefaultSecurityFilterActionEnum]

type DefaultSecurityFilterActionEnum struct {
	NEXT,
	ERROR,
	REDIRECT,
	RENDER DefaultSecurityFilterAction
}

type DefaultSecurityFilterChainException struct {
	*DefaultError
	// contains filtered or unexported fields
}

type GrantedAuthority interface {
	// Authority() returns the authority as a string.
	Authority() string
}

type Manager interface {
	// contains filtered or unexported methods
}

type PasswordEncoder interface {
	// Encode() will encode a password or generate and error.
	Encode(password []byte) ([]byte, error)

	// Matches() will check if a submittes password match.
	Matches(password, encoded []byte) bool
}

type PostAuthorisationFilter interface {
	SecurityEventFilter
	// contains filtered or unexported methods
}

type PreAuthenticationFilter interface {
	SecurityEventFilter
	// contains filtered or unexported methods
}

type Principal interface {
	GetName() string
}

type RememberMeService interface {
	AutoLogin(handler SecurityHandler) (Authentication, Error)
	LoginSuccess(handler SecurityHandler, successfulAuthentication Authentication)
	LoginFail(handler SecurityHandler)
	Logout(handler SecurityHandler)
}

type SecurityAppHandler interface {
	// Implements [SecurityRouter]
	SecurityRouter

	// EnableCsrf() should implement what it is needed to enable CSRF for that
	// web framework connector. Before doing so it should check the result of the skip
	// function to know if it should not be done.
	EnableCsrf(skip func(handler SecurityHandler) bool)

	// EnableSession() should implement what is needed to enable Session handling for that
	// web framework connector. Before doing so it should check the result of the skip
	// function to know if it should not be done.
	EnableSession(skip func(handler SecurityHandler) bool)

	// HasSession() should returns if for that request, session has been enabled.
	HasSession(handler SecurityHandler) bool

	// PostAuthorizationFilter() is a callback
	PostAuthorizationFilter(handler SecurityHandler)
}

type SecurityContext interface {
	// GetAuthentication() returns the current [Authentication] associated with the current thread.
	//
	// It can be an Anonymous user, in which case [Authentication.IsAuthenticated] will return false.
	GetAuthentication() Authentication

	// SetAuthentication() will change the current authentication object.
	//
	// It's the responsibility of a [SecurityFilter] to either save the current [Authentication] in
	// either or both the session or in the [SecurityContext].
	SetAuthentication(authentication Authentication)

	// SetHTTPPolicyDebugValue() sets a string containing debug informations about the current
	// policy applied to the current thread.
	SetHTTPPolicyDebugValue(debug string)

	// GetHTTPPolicyDebugValue() let's retrieve the value set in SetHTTPPolicyDebugValue.
	GetHTTPPolicyDebugValue() string
}

type SecurityContextHolder interface {
	// ClearContext() is called when initializing the current authntication process.
	ClearContext()

	// SetContext() lets erase the current [SecurityContext]
	SetContext(context SecurityContext)

	// GetContext() lets you retrieve the current [SecurityContext]
	GetContext() SecurityContext
}

type SecurityEndpointRegistration interface {
	// RegisterSecurityEndpoint() let you add endpoints.
	RegisterSecurityEndpoint(router SecurityRouter)
}

type SecurityEventFilter interface {
	EventFilter
	// contains filtered or unexported methods
}

type SecurityFilter interface {
	// Authenticate() should authenticate an user, using Session or the AuthenticationManager.
	//
	// It should return a [SecurityFilterChainException] indicating what should be done next.
	Authenticate(handler SecurityHandler) SecurityFilterChainException

	// AuthenticationRequired() should return a [SecurityFilterChainException] to indicate what
	// the [SecurityFilterChain] should do if no authentication has been successful and
	// the user try to access a restricted path.
	AuthenticationRequired(handler SecurityHandler) SecurityFilterChainException
}

type SecurityFilterChain interface {
	Initialize(serverName string, app SecurityAppHandler)
}

type SecurityFilterChainException interface {
	// Exception is an alias for Error
	Exception

	// Action() returns thez action to execute, useful if you exception can handler multiple cases.
	Action() string

	// Handle() will process this [SecurityFilterChainException] though a [SecurityHandler] and return any error
	// that handler will return.
	//
	// it's the web framework responsibility to return error it can manage through its implementation of
	// [SecurityHandler].
	Handle(handler SecurityHandler) error
}

type SecurityHandler interface {
	// Cookie() returns the named Cookie or an error if not found.
	Cookie(name string) (*http.Cookie, error)

	// SetCookie() sets a cookie
	SetCookie(cookie *http.Cookie)

	// FormValue() returns a named form submitted value
	FormValue(name string) string

	// Header() returns the named HTTP Header or blank
	Header(name string) string

	// SetHeader() set then named Header to value
	SetHeader(name, value string)

	// Method() returns the Request HTTP Method
	Method() string

	// Path() returns the Request Path
	Path() string

	// SessionReset() empty the current session
	SessionReset()

	// SessionRefresh() regenerate the session ID, keeping the data.
	// Used after a login, to protect against session fixing.
	SessionRefresh()

	// SessionValue() return a session value
	SessionValue(key string) any

	// SetSessionValue() sets a session value
	SetSessionValue(key string, obj any)

	// URL() returns the request URL
	URL() *url.URL

	// BindBody() bind the current Form submitted to an object
	BindBody(obj any) error

	// Redirect() set the Location header and redirect code
	Redirect(to string, code int) error

	// RenderView() render the view with data
	RenderView(view string, data map[string]any) error

	// Error() handles creating an HTTP error message
	//
	// Implementations may have a specific method for creating them.
	Error(code int, message string) error

	// Write() write the body
	Write(p []byte) (n int, err error)

	// Enable the next handler
	Next() error
}

type SecurityRouter interface {
	// Group() returns a new SecurityRouter for the given path
	Group(path string) SecurityRouter

	// Use() register a new handler
	Use(handler func(SecurityHandler) error)

	// Get() add a GET HTTP handler for the given path
	Get(path string, handler func(SecurityHandler) error)

	// Post() add a POST HTTP handler for the given path
	Post(path string, handler func(SecurityHandler) error)
}

type SessionAwareFilter interface {
	// contains filtered or unexported methods
}

type UserDetails interface {
	// GetUsername() returns the username used to authenticate the user.
	GetUsername() string

	// GetPassword() returns the password used to authenticate the user.
	GetPassword() string

	// GetAuthorities() returns the authorities granted to the user.
	GetAuthorities() []GrantedAuthority

	// IsExpired() indicates whether the user's account has expired.
	IsExpired() bool

	// IsCredentialExpired() indicates whether the user's credentials (password) has expired.
	IsCredentialExpired() bool

	// IsDisabled() indicates whether the user's credentials (password) has expired.
	IsDisabled() bool

	// IsLocked() indicates whether the user is enabled or disabled.
	IsLocked() bool
}

type UserDetailsService interface {
	// LoadUserByUsername() should return a [UserDetails] given it's username or nil.
	LoadUserByUsername(username string) UserDetails
}