auth

type AuthService struct {
	Config              *Config
	DB                  *gorm.DB
	Service             services.ServiceInterface
	TokenStore          map[string]*models.User
	MailService         *notifications.MailService // Exported for testing
	NotificationService *services.NotificationService
	// contains filtered or unexported fields
}

type Authenticator interface {
	Authenticate(r *http.Request) (*services.HostIdentity, error)
}

type Config struct {
	DB           *gorm.DB
	Service      services.ServiceInterface
	CookieName   string
	CookieSecure bool

	CookieDomain string
	// CookiePath scopes the session cookie; empty means "/". Set it to the
	// base path when Studio is served under one.
	CookiePath       string
	ResetTokenExpiry time.Duration
	SessionDuration  time.Duration
	FrontendURL      string

	CookieHTTPOnly         bool
	CookieSameSite         http.SameSite
	RegistrationAllowed    bool
	AdminEmail             string
	TestMode               bool
	AllowedRegisterDomains []string
	TIBAPISecret           string
	TIBEnabled             bool
	OCIConfig              interface{} // Holds OCI configuration for plugin security

	// AllowSSOUserAPIKeys permits issuing API keys to SSO-provisioned
	// users; SSOAPIKeyLiveness rejects such a key once the user has gone
	// that long without an SSO login (0 = no limit). See config.Config.
	AllowSSOUserAPIKeys bool
	SSOAPIKeyLiveness   time.Duration
	// APIKeyTouchInterval throttles the api_key_last_used_at stamp (zero
	// means the default); SyncAPIKeyTouch stamps on every request, on the
	// request goroutine, which is what tests on a shared SQLite DB need.
	APIKeyTouchInterval time.Duration
	SyncAPIKeyTouch     bool

	// HostAuth authenticates requests for a host application Studio is
	// embedded in. When set it is asked first on every request, and the
	// identity it returns is turned into a Studio user by
	// ProvisionHostUser. Studio's own password login, registration and SSO
	// are then switched off (see LocalAccountsEnabled).
	HostAuth          Authenticator
	ProvisionHostUser func(services.HostIdentity) (*models.User, error)
	// HostLoginURL and HostLogoutURL are where the console sends a user to
	// sign in or out when the host authenticates. The console fills in a
	// "{return_to}" placeholder in HostLoginURL (see studio.Options.LoginURL).
	HostLoginURL  string
	HostLogoutURL string

	// CSRF, when set, replaces Studio's own CSRF protection for
	// cookie-authenticated requests: a host application can apply its own.
	// It must call the handler it wraps only for requests that pass.
	// CSRFTokenHeader and CSRFTokenURL tell the console which header carries
	// the token and where to fetch it (defaults: X-CSRF-Token and Studio's
	// /csrf-token).
	CSRF            func(http.Handler) http.Handler
	CSRFTokenHeader string
	CSRFTokenURL    string

	// Chromeless tells the console to leave out its own top bar and
	// navigation drawers, because the host application draws them.
	Chromeless bool
}