auth

type APIKeyFinder interface {
	FindByAPIKey(ctx context.Context, rawKey string) (*domain.Auth, error)
}

type AuthContext struct {
	Method      Method
	GatewayID   ids.GatewayID
	GatewaySlug string
	ConsumerID  ids.ConsumerID
	AuthID      ids.AuthID
	Subject     string
	Claims      map[string]any
	Scopes      []string
	RoleIDs     []ids.RoleID
}

type ClientCertificateExtractor interface {
	FromXFCC(header string) (*x509.Certificate, error)
}

type CreateInput struct {
	GatewayID ids.GatewayID
	Name      string
	Type      domain.Type
	Enabled   bool
	Config    domain.Config
}

type Creator interface {
	Create(ctx context.Context, in CreateInput) (*domain.Auth, error)
}

type CredentialFinder interface {
	OAuth2Auths(ctx context.Context) ([]*domain.Auth, error)
	OAuth2AuthsForGateway(ctx context.Context, gatewayID ids.GatewayID) ([]*domain.Auth, error)
	MTLSAuths(ctx context.Context) ([]*domain.Auth, error)
	// DefaultOAuth2ForGateway returns the built-in NeuralTrust identity
	// provider scoped to the given gateway (a copy carrying that GatewayID), or
	// nil when the default IdP is not configured. It is used as the fallback
	// when an MCP consumer has no oauth2 identity provider of its own.
	DefaultOAuth2ForGateway(gatewayID ids.GatewayID) *domain.Auth
}

type DefaultIdPConfig struct {
	Issuer       string
	AuthorizeURL string
	TokenURL     string
	JWKSURL      string
	ClientID     string
	ClientSecret string
	Audiences    []string
	Scopes       []string
}

type Deleter interface {
	Delete(ctx context.Context, gatewayID ids.GatewayID, id ids.AuthID) error
}

type Finder interface {
	FindByID(ctx context.Context, gatewayID ids.GatewayID, id ids.AuthID) (*domain.Auth, error)
	List(ctx context.Context, filter domain.ListFilter) ([]*domain.Auth, int, error)
}

type IntrospectionValidator interface {
	Validate(ctx context.Context, raw string, cfg *authdomain.OAuth2Config) (*identity.Principal, error)
}

type JWTValidator interface {
	Validate(ctx context.Context, raw string, cfg *authdomain.OAuth2Config) (*identity.Principal, error)
}

type MTLSValidator interface {
	Validate(cert *x509.Certificate, cfg *authdomain.MTLSConfig) (*identity.Principal, error)
}

type Method string

type OAuth2Verifier interface {
	Verify(ctx context.Context, token string, cfg domain.OAuth2Config) (*VerifiedClaims, error)
}

type OIDCFinder interface {
	FindOIDCAuth(ctx context.Context, auths []*domain.Auth, token string) (*domain.Auth, error)
}

type OIDCVerifier interface {
	Peek(token string) (TokenHints, error)
	Verify(ctx context.Context, token string, cfg domain.OIDCConfig) (*VerifiedClaims, error)
}

type SessionTokenVerifier interface {
	Verify(ctx context.Context, raw string) (*identity.Principal, error)
	Issuer() string
}

type TokenHints struct {
	Issuer    string
	Audiences []string
	KeyID     string
	Algorithm string
}

type UpdateInput struct {
	ID        ids.AuthID
	GatewayID ids.GatewayID
	Name      *string
	Type      *domain.Type
	Enabled   *bool
	Config    *domain.Config
}

type Updater interface {
	Update(ctx context.Context, in UpdateInput) (*domain.Auth, error)
}

type VerifiedClaims struct {
	Subject string
	Claims  map[string]any
	Scopes  []string
}