oidc

type AWSKMSClient interface {
	Sign(ctx context.Context, params *kms.SignInput, optFns ...func(*kms.Options)) (*kms.SignOutput, error)
	GetPublicKey(ctx context.Context, params *kms.GetPublicKeyInput, optFns ...func(*kms.Options)) (*kms.GetPublicKeyOutput, error)
}

type AWSKMSSigner struct {
	// contains filtered or unexported fields
}

type AzureKeyVaultClient interface {
	Sign(ctx context.Context, name, version string, parameters azkeys.SignParameters, options *azkeys.SignOptions) (azkeys.SignResponse, error)
	GetKey(ctx context.Context, name, version string, options *azkeys.GetKeyOptions) (azkeys.GetKeyResponse, error)
}

type AzureKeyVaultSigner struct {
	// contains filtered or unexported fields
}

type Discovery struct {
	Issuer                           string   `json:"issuer"`
	JWKSURI                          string   `json:"jwks_uri"`
	ResponseTypesSupported           []string `json:"response_types_supported"`
	SubjectTypesSupported            []string `json:"subject_types_supported"`
	IDTokenSigningAlgValuesSupported []string `json:"id_token_signing_alg_values_supported"`
}

type GCPKMSClient interface {
	AsymmetricSign(ctx context.Context, req *kmspb.AsymmetricSignRequest, opts ...interface{}) (*kmspb.AsymmetricSignResponse, error)
	GetPublicKey(ctx context.Context, req *kmspb.GetPublicKeyRequest, opts ...interface{}) (*kmspb.PublicKey, error)
}

type GCPKMSSigner struct {
	// contains filtered or unexported fields
}

type JWK struct {
	Kty string   `json:"kty"`           // "EC" for ECDSA keys
	Use string   `json:"use"`           // always "sig"
	Alg string   `json:"alg"`           // always "ES256"
	Kid string   `json:"kid"`           // stable key id
	Crv string   `json:"crv"`           // "P-256"
	X   string   `json:"x"`             // base64url x-coordinate
	Y   string   `json:"y"`             // base64url y-coordinate
	X5c []string `json:"x5c,omitempty"` // certificate chain (unused)
}

type JWKS struct {
	Keys []JWK `json:"keys"`
}

type LambdaFunctionURLClient interface {
	GetFunctionUrlConfig(ctx context.Context, params *lambda.GetFunctionUrlConfigInput, optFns ...func(*lambda.Options)) (*lambda.GetFunctionUrlConfigOutput, error)
}

type LocalSigner struct {
	// contains filtered or unexported fields
}

type Signer interface {
	// Sign returns the raw fixed-length ECDSA signature over digest in the
	// RFC 7518 section 3.4 JWS form: the R || S concatenation, each
	// component left-padded to 32 bytes (64 bytes total for P-256). The
	// caller is responsible for hashing the input. Backends whose KMS
	// returns DER/ASN.1 (AWS, GCP, and the in-process LocalSigner) MUST
	// convert via derToRawECDSASignature before returning; Azure Key Vault
	// already returns this raw form and passes it through unchanged. This
	// lets Mint base64url-encode the result directly into the JWS without
	// any per-backend special-casing.
	Sign(ctx context.Context, digest []byte) ([]byte, error)

	// PublicKey returns the public key corresponding to the signer.
	// Cached after the first call per implementation. Returns
	// *ecdsa.PublicKey for ES256 signers.
	PublicKey(ctx context.Context) (crypto.PublicKey, error)

	// KeyID returns a stable identifier used as the JWT `kid` header
	// and as the JWK `kid`. Derived from the public key so Azure AD's
	// JWKS cache keys on a value that changes when the key rotates.
	KeyID(ctx context.Context) (string, error)
}