oidc

type Config struct {
	KeyStore KeyStore
	// IssuerURL is the "iss" claim every minted token carries, and the
	// URL a verifier (AWS, GCP, Vault) is told to fetch this instance's
	// JWKS from. Must be a real, reachable HTTPS URL for federation to
	// actually work; Manager itself does not validate that, since it has
	// no way to confirm reachability from inside the process that mints
	// the tokens.
	IssuerURL string
	TTL       time.Duration
	// KeyRetireGrace is the default RotateKey uses when its own
	// retireAfter is zero. DefaultKeyRetireGrace when this is also zero.
	KeyRetireGrace time.Duration
	Now            func() time.Time
}

type JWK struct {
	Kty string `json:"kty"`
	Crv string `json:"crv"`
	X   string `json:"x"`
	Y   string `json:"y"`
	Kid string `json:"kid"`
	Use string `json:"use"`
	Alg string `json:"alg"`
}

type JWKS struct {
	Keys []JWK `json:"keys"`
}

type Key struct {
	// contains filtered or unexported fields
}

type KeyStore interface {
	Exists(ctx context.Context, serviceName, envKey string) (bool, error)
	SetValue(ctx context.Context, serviceName, envKey, plaintext string) error
	Resolve(ctx context.Context, serviceName, envKey string) (string, error)
}

type Manager struct {
	// contains filtered or unexported fields
}

type RotationResult struct {
	OldKID   string
	NewKID   string
	RetireAt time.Time
	// RetiringCount is how many keys are now published in the JWKS
	// purely for verification (no longer used to sign anything new).
	RetiringCount int
}

type TokenRequest struct {
	// Audience is the OIDC "aud" claim: the cloud provider's expected
	// value (e.g. "sts.amazonaws.com" for AWS, a GCP workload identity
	// pool audience URL, or a Vault role's bound_audiences entry).
	Audience string
	// Subject is the OIDC "sub" claim, the identity a trust policy
	// matches against. The caller builds it (pipeline jobs use
	// "repo:<app>:ref:<ref>:job:<job_key>"): this package stays
	// pipeline-agnostic, the same "translation is the caller's job"
	// reasoning internal/docker.ContainerSpec's own doc comments give.
	Subject string
	Repo    string
	Ref     string
	// PipelineID identifies the pipeline definition this run came from.
	PipelineID string
}