auth

type MockOIDC struct {
	Server *httptest.Server
	// contains filtered or unexported fields
}

type MockOIDCOption func(*MockOIDC)

type ModeConfig struct {
	// Mode selects which registered factory to use (e.g. "off", "mock"). The
	// set of valid values depends on the build tags the binary was compiled
	// with: a default build registers "off" and "mock"; tagged builds may
	// register additional IdP-specific modes.
	Mode string
	// VCAPServices is the raw VCAP_SERVICES JSON, used by IdP modes that
	// expect their credentials in a Cloud Foundry service binding.
	VCAPServices string
	// XSAppName is an IdP-specific application identifier consumed by modes
	// that need it. Ignored by the generic modes.
	XSAppName string
}

type ModeFactory func(cfg ModeConfig) (Validator, func(), error)

type OIDCConfig struct {
	// IssuerURL is the expected "iss" claim. Tokens whose iss does not equal
	// this value (or, for compatibility with multi-tenant IdPs, sit immediately
	// under it via "<IssuerURL>/...") are rejected.
	IssuerURL string
	// Audience is the expected "aud" claim. Tokens whose aud claim does not
	// contain this value are rejected.
	Audience string
	// JWKSEndpoint is the URL serving the issuer's JSON Web Key Set used to
	// verify token signatures. Required: this generic validator does not
	// auto-discover via /.well-known/openid-configuration.
	JWKSEndpoint string
}

type OIDCValidator struct {
	// contains filtered or unexported fields
}

type Principal struct {
	Subject    string   // sub
	Email      string   // email (may be empty depending on IdP)
	UserName   string   // user_name (or preferred_username)
	GivenName  string   // given_name
	FamilyName string   // family_name
	Origin     string   // origin (IdP key)
	Tenant     string   // tenant identifier (claim shape varies per IdP)
	Scopes     []string // local scope names (IdP-specific prefixes stripped)
}

type Validator interface {
	Validate(ctx context.Context, rawToken string) (*Principal, error)
}