bearer

type BearerTokenCreatedEventPayload struct {
	// RawToken is the base unsigned token identifier.
	RawToken string

	// SignedToken is the resulting HMAC-SHA256 signed token in base64url format.
	SignedToken string

	// UserID identifies the owner user ID (if available).
	UserID string
}

type BearerVerifyAfterEventPayload struct {
	// Token is the processed token string.
	Token string

	// Valid indicates whether the signature and format were valid.
	Valid bool

	// Session contains the retrieved session entity if resolved via repository (optional).
	Session *entity.Session
}

type BearerVerifyBeforeEventPayload struct {
	// RawToken is the incoming token string before signature verification.
	RawToken string

	// Params contains the mutable verification parameters (including Extra metadata).
	Params *VerifyParams
}

type Config struct {
	// Secret defines the cryptographic secret key used for signing and verifying tokens via HMAC-SHA256.
	Secret string

	// RequireSignature specifies whether incoming tokens must strictly arrive pre-signed.
	// When false (default), raw unsigned tokens are signed automatically using the configured Secret.
	RequireSignature bool

	// TokenHeader specifies the HTTP header name from which to extract the bearer token (default: "Authorization").
	TokenHeader string

	// AuthTokenHeader specifies the HTTP response header name used to expose the token (default: "set-auth-token").
	AuthTokenHeader string

	// ExposeHeaders specifies whether to configure CORS Access-Control-Expose-Headers for the response header (default: true).
	ExposeHeaders bool
}

type CreateTokenParams struct {
	// Token is the base session token or unique string identifier to sign (required).
	Token string `json:"token"`

	// Secret optionally overrides the default secret key configured on the plugin.
	Secret string `json:"secret,omitempty"`

	// UserID optionally associates an owner user ID with the created token.
	UserID string `json:"user_id,omitempty"`

	plugin.ExtraContainer
}

type CreateTokenResult struct {
	// RawToken is the base unsigned token string.
	RawToken string `json:"raw_token"`

	// SignedToken is the HMAC-SHA256 signed token.
	SignedToken string `json:"signed_token"`

	// HeaderValue is the formatted Authorization header string ("Bearer <signed_token>").
	HeaderValue string `json:"header_value"`

	// AuthTokenHeader is the response header name (default: "set-auth-token").
	AuthTokenHeader string `json:"auth_token_header"`
}

type Option func(*Config)

type Plugin struct {
	// contains filtered or unexported fields
}

type Repository interface {
	repository.SessionRepository
}

type ResolveSessionParams struct {
	// Header is the full HTTP Authorization header value (e.g. "Bearer <token>.<sig>").
	Header string `json:"header,omitempty"`

	// Token is the direct token string if already extracted.
	Token string `json:"token,omitempty"`

	// Secret optionally overrides the secret key.
	Secret string `json:"secret,omitempty"`

	plugin.ExtraContainer
}

type ResolveSessionResult struct {
	// Session is the active, non-expired session entity retrieved from storage.
	Session *entity.Session `json:"session"`

	// RawToken is the verified raw token string used for querying the session.
	RawToken string `json:"raw_token"`

	// SignedToken is the verified signed token string.
	SignedToken string `json:"signed_token"`
}

type VerifyParams struct {
	// Token is the raw or signed token string or extracted authorization header (required).
	Token string `json:"token"`

	// Secret optionally overrides the default secret key configured on the plugin.
	Secret string `json:"secret,omitempty"`

	plugin.ExtraContainer
}

type VerifyResult struct {
	// RawToken is the extracted unsigned token identifier.
	RawToken string `json:"raw_token"`

	// SignedToken is the complete signed token representation.
	SignedToken string `json:"signed_token"`

	// Valid indicates whether the cryptographic signature was valid.
	Valid bool `json:"valid"`
}