mtls

type ClientCertInfo struct {
	Username   string
	CertIssuer string
	ValidUntil time.Time
	Groups     []string
}

type ClientIdentity struct {
	LoaderName string
	Cert       tls.Certificate
}

type CredentialsLoader interface {
	// LoadClientCA returns a CertPool which should be used by a server to
	// validate client certificates.
	// NOTE: The pool returned here will be the only pool used to validate certificates.
	//       Inclusion of system certificates should be done by copying from x509.SystemCertPool(),
	//       with any custom certificates appended.
	LoadClientCA(context.Context) (*x509.CertPool, error)

	// LoadRootCA returns a CertPool which should be used by clients to
	// validate server certificates.
	// NOTE: The pool returned here will be the only pool used to validate certificates.
	//       Inclusion of system certificates should be done by copying from x509.SystemCertPool(),
	//       with any custom certificates appended.
	LoadRootCA(context.Context) (*x509.CertPool, error)

	// LoadClientCertificates returns the certificate that should be presented
	// by the client when connecting to a server.
	LoadClientCertificate(context.Context) (tls.Certificate, error)

	// LoadServerCertificate returns the certificate that should be presented
	// by the server to incoming clients.
	LoadServerCertificate(context.Context) (tls.Certificate, error)

	// CertRefreshed indicates if internally any of the cert data has
	// been refreshed and should be reloaded. This will depend on the
	// implementation to support but allows for dynamic refresh of certificates
	// without a server restart.
	CertsRefreshed() bool

	// GetClientCertInfo extracts client certificate information from the client certificate
	// and other sources, depending on the Certificate Loader type.
	GetClientCertInfo(context.Context, string) (*ClientCertInfo, error)
}

type MultiIdentityCredentials struct {
	// contains filtered or unexported fields
}

type WrappedTransportCredentials struct {
	// contains filtered or unexported fields
}