accessserver

type AuthTokenRecord struct {
	JTI      string    `json:"jti"`
	Resource string    `json:"aud"`
	Exp      time.Time `json:"exp"`
	// PS is the person server that requested it.
	PS string `json:"ps"`
	// PresentedIssuer and PresentedJTI name the presented token: a person
	// token from the PS, or an auth token from this AS on a step-up.
	PresentedIssuer string `json:"presented_iss"`
	PresentedJTI    string `json:"presented_jti"`
	// Agent is the agent token's sub (the parent, for a sub-agent grant).
	Agent       string `json:"agent"`
	Subject     string `json:"sub"`
	Scope       string `json:"scope,omitempty"`
	MissionS256 string `json:"mission_s256,omitempty"`
}

type AuthorizationRequest struct {
	// PS is the person server that signed the request.
	PS string
	// Agent is the agent token (the parent's, for a sub-agent grant), and
	// Subagent the sub-agent the token will bind. Agent tokens may carry
	// posture claims bearing on policy (§9.1.1).
	Agent    *aauth.AgentClaims
	Subagent *aauth.AgentClaims
	// Resource is the verified resource token: the resource, the person
	// (ps, sub), the requested scope, account, and mission.
	Resource *aauth.ResourceClaims
	// Presented is the verified presented token.
	Presented aauth.PresentedToken
	// Upstream is the verified upstream token of a call chaining request.
	Upstream aauth.PresentedToken
	// Claims are the identity claims the PS supplied after a
	// requirement=claims (§9.2), nil before.
	Claims map[string]any
	// Transcript holds the PS's answers to earlier clarifications.
	Transcript []Exchange
}

type Authorizer interface {
	Authorize(ctx context.Context, r *AuthorizationRequest) (Decision, error)
}

type AuthorizerFunc func(ctx context.Context, r *AuthorizationRequest) (Decision, error)

type Client struct {
	// Signer signs as the PS (DWK aauth-person.json). Required.
	Signer aauth.ServerSigner
	// HTTPClient makes requests; nil uses [aauth.DiscoveryClient], which
	// reaches only public https destinations: the access server is named
	// by a resource token. A client supplied here SHOULD apply the same
	// egress admission.
	HTTPClient *http.Client
	// PreferWaitSeconds, when positive, is sent as Prefer: wait=N.
	PreferWaitSeconds int
	// contains filtered or unexported fields
}

type Config struct {
	// Issuer is the AS's server identifier: the iss of the auth tokens it
	// issues, and the aud of the resource tokens it redeems.
	Issuer string
	// Key signs auth tokens and the AS's own requests; KeyID is its kid
	// (default: the RFC 7638 thumbprint). PublishedKeys are extra keys to
	// publish, for rotation.
	Key           crypto.Signer
	KeyID         string
	PublishedKeys []aauth.JWK
	// Store persists issued tokens, revocations, and pending requests.
	Store Store
	// Authorizer decides token requests.
	Authorizer Authorizer
	// Resources, when set, reports whether the AS serves the resource
	// (the resource token's iss); others are invalid_resource_token.
	Resources func(resource string) bool
	// TrustPS, when set, decides whether a verified PS may request tokens
	// at all; refused ones are answered 403 denied. Nil admits every PS
	// whose signature verifies — trust then emerges from the Authorizer
	// (claims, interaction; §9.3.1).
	TrustPS func(ctx context.Context, ps string) bool
	// InteractionURL is the AS's user-facing interaction page, for
	// requirement=interaction decisions; it calls [Server.ConsumeCode].
	InteractionURL string
	// Paths overrides endpoint paths.
	Paths Paths
	// Metadata supplies display members of the metadata document.
	Metadata aauth.ServerMetadata
	// ServerResolver resolves PS keys (jwks_uri scheme); TokenResolver
	// resolves resource token and person token keys; AgentResolver
	// resolves agent token keys. Each defaults to JWKS discovery through
	// HTTPClient. Tokens this AS issued are verified against its own keys.
	ServerResolver aauth.KeyResolver
	TokenResolver  aauth.KeyResolver
	AgentResolver  aauth.KeyResolver
	// HTTPClient makes outbound requests (discovery, revocation); nil uses
	// aauth.DiscoveryClient, which reaches only public https destinations.
	// Supply a client to reach others, such as local servers in
	// development.
	HTTPClient *http.Client
	// Revoker delivers the AS's revocations to resources; nil discovers
	// each resource's revocation endpoint and signs as the AS.
	Revoker Revoker
	// AcceptRevocation, when set, decides whether a verified PS or
	// resource may revoke here; refused callers get unsupported_iss.
	AcceptRevocation func(ctx context.Context, caller aauth.ServerCaller) bool
	// AuthTokenTTL is the default auth token lifetime (at most one hour).
	AuthTokenTTL time.Duration
	// SignatureWindow, PendingTTL (default ten minutes), MaxWait (default
	// 30 seconds), and MaxClarificationRounds (default five) tune requests
	// and deferred responses.
	SignatureWindow        time.Duration
	PendingTTL             time.Duration
	MaxWait                time.Duration
	MaxClarificationRounds int
	// Limiter, when set, limits polls per pending request ("poll:",
	// answered slow_down) and revocations per issuer ("revoke:", answered
	// rate_limited with Retry-After).
	Limiter aauth.Limiter
	// Notify is called after a pending request is created or changes.
	Notify func(ctx context.Context, p *Pending)
	// Logger receives operational errors; nil discards them.
	Logger *slog.Logger
	// Now returns the current time; nil means time.Now.
	Now func() time.Time
	// InsecureSkipIdentifierCheck accepts identifiers that are not server
	// identifiers, for development and tests. Never set it in production.
	InsecureSkipIdentifierCheck bool
}

type Decision struct {
	Outcome Outcome
	// Scope is the granted scope (Allowed); empty grants the resource
	// token's scope. It may not be broader than the request.
	Scope string
	// TTL caps the auth token's lifetime (at most one hour).
	TTL time.Duration
	// Requirement qualifies a Deferred decision:
	// aauth.RequirementClaims with RequiredClaims (§9.2),
	// aauth.RequirementInteraction (the person goes to InteractionURL),
	// aauth.RequirementClarification with Question, or
	// aauth.RequirementApproval (the default).
	Requirement    string
	RequiredClaims []string
	Question       *Question
	RetryAfter     int
	// Code and Reason qualify a Denied decision; Code defaults to denied.
	Code   string
	Reason string
}

type Exchange struct {
	Time     time.Time `json:"time"`
	Question string    `json:"question"`
	Answer   string    `json:"answer,omitempty"`
	Updated  bool      `json:"updated,omitempty"`
}

type MemoryStore struct {
	// contains filtered or unexported fields
}

type Outcome int

type Paths struct {
	JWKS       string
	Token      string
	Revocation string
	// Pending is the prefix of pending URLs.
	Pending string
}

type Pending struct {
	ID    string `json:"id"`
	PS    string `json:"ps"`
	State State  `json:"state"`
	// Agent, Resource, and Scope describe the request for display.
	Agent    string `json:"agent"`
	Resource string `json:"resource"`
	Scope    string `json:"scope,omitempty"`
	// Requirement is the 202's AAuth-Requirement; RequiredClaims go with
	// claims, InteractionURL and Code with interaction.
	Requirement    string   `json:"requirement"`
	RequiredClaims []string `json:"required_claims,omitempty"`
	InteractionURL string   `json:"interaction_url,omitempty"`
	Code           string   `json:"code,omitempty"`
	CodeCanonical  string   `json:"code_canonical,omitempty"`
	CodeConsumed   bool     `json:"code_consumed,omitempty"`
	RetryAfter     int      `json:"retry_after,omitempty"`
	// Claims are the identity claims the PS supplied (§9.2).
	Claims map[string]any `json:"claims,omitempty"`
	// Question awaits the PS's answer; Transcript holds earlier rounds.
	Question   *Question  `json:"question,omitempty"`
	QuestionAt time.Time  `json:"question_at,omitzero"`
	Rounds     int        `json:"rounds,omitempty"`
	Transcript []Exchange `json:"transcript,omitempty"`

	ResourceTokenIssuer string `json:"resource_token_iss"`
	ResourceTokenJTI    string `json:"resource_token_jti"`
	// Request is the original request body, verified again as of
	// ReceivedAt when the request completes.
	Request    json.RawMessage `json:"request"`
	ReceivedAt time.Time       `json:"received_at"`
	CreatedAt  time.Time       `json:"created_at"`
	ExpiresAt  time.Time       `json:"expires_at"`
	Result     *Result         `json:"result,omitempty"`
	Version    int64           `json:"version"`
}

type Question struct {
	Text    string   `json:"clarification"`
	Options []string `json:"options,omitempty"`
	Timeout int      `json:"timeout,omitempty"`
}

type Result struct {
	Status      int    `json:"status"`
	ContentType string `json:"content_type,omitempty"`
	Body        []byte `json:"body,omitempty"`
}

type Revoker interface {
	Revoke(ctx context.Context, recipient, dwk string, req aauth.RevocationRequest) (*aauth.RevocationResponse, error)
}

type Server struct {
	// contains filtered or unexported fields
}

type State string

type Store interface {
	// RecordAuthToken records an issued auth token, unless the presented
	// token (r.PresentedIssuer, r.PresentedJTI) has been revoked: then it
	// records nothing and returns ErrRevoked. The check and the insert
	// MUST be atomic with respect to Revoke, so that a revocation stored
	// before the insert is seen here and one stored after it finds r
	// through AuthTokensIssuedAgainst. Otherwise an issuance racing a
	// revocation escapes the cascade (§11.12.4).
	RecordAuthToken(ctx context.Context, r AuthTokenRecord) error
	// AuthTokensIssuedAgainst returns the auth tokens issued against the
	// presented token (iss, jti).
	AuthTokensIssuedAgainst(ctx context.Context, iss, jti string) ([]AuthTokenRecord, error)
	// Revoke records the revocation of (iss, jti) until exp; IsRevoked
	// reports it.
	Revoke(ctx context.Context, iss, jti string, exp time.Time) error
	IsRevoked(ctx context.Context, iss, jti string) (bool, error)

	// CreatePending stores a new pending request (Version 1).
	CreatePending(ctx context.Context, p *Pending) error
	// Pending returns pending request id, or ErrNotFound.
	Pending(ctx context.Context, id string) (*Pending, error)
	// PendingByCode returns the pending request with the canonical
	// interaction code, or ErrNotFound.
	PendingByCode(ctx context.Context, code string) (*Pending, error)
	// UpdatePending replaces p if its Version matches (ErrConflict
	// otherwise) and increments it.
	UpdatePending(ctx context.Context, p *Pending) error
	// PendingForResourceToken returns the open pending requests started
	// for the resource token (iss, jti).
	PendingForResourceToken(ctx context.Context, iss, jti string) ([]*Pending, error)
}

type TokenRequest struct {
	ResourceToken  string `json:"resource_token"`
	AgentToken     string `json:"agent_token"`
	PresentedToken string `json:"presented_token"`
	SubagentToken  string `json:"subagent_token,omitempty"`
	UpstreamToken  string `json:"upstream_token,omitempty"`
}