iam

type AWSConfig struct {
	AccountID string `json:"account_id"`
	Region    string `json:"region"`
}

type AWSIAMProvider struct{}

type ExternalIdentity struct {
	Provider   string            `json:"provider"`
	Identifier string            `json:"identifier"`
	Attributes map[string]string `json:"attributes,omitempty"`
}

type IAMProvider interface {
	// Type returns the provider type identifier.
	Type() store.IAMProviderType
	// ValidateConfig checks that the provider configuration is valid.
	ValidateConfig(config json.RawMessage) error
	// ResolveIdentities extracts external identities from the given credentials/token.
	ResolveIdentities(ctx context.Context, config json.RawMessage, credentials map[string]string) ([]ExternalIdentity, error)
	// TestConnection tests that the provider configuration can connect.
	TestConnection(ctx context.Context, config json.RawMessage) error
}

type IAMResolver struct {
	// contains filtered or unexported fields
}

type KubernetesConfig struct {
	ClusterName string `json:"cluster_name"`
	Namespace   string `json:"namespace"`
}

type KubernetesProvider struct{}

type OIDCConfig struct {
	Issuer   string `json:"issuer"`
	ClientID string `json:"client_id"`
	ClaimKey string `json:"claim_key"` // Which claim to use as the external identifier (e.g. "sub", "email")
}

type OIDCProvider struct{}