jwt

type AccessPolicy struct {
	// TenantID is a unique identifier of tenant for which access is granted (if resource is not specified)
	// or which the resource is owned by (if resource is specified).
	TenantID string `json:"tid,omitempty"`

	// TenantUUID is a UUID of tenant for which access is granted (if the resource is not specified)
	// or which the resource is owned by (if the resource is specified).
	TenantUUID string `json:"tuid,omitempty"`

	// ResourceServerID is a unique resource server instance or cluster ID.
	ResourceServerID string `json:"rs,omitempty"`

	// ResourceNamespace is a namespace to which resource belongs within resource server.
	// E.g.: account-server, storage-manager, task-manager, alert-manager, etc.
	ResourceNamespace string `json:"rn,omitempty"`

	// ResourcePath is a unique identifier of or path to a single resource or resource collection
	// in the scope of the resource server and namespace.
	ResourcePath string `json:"rp,omitempty"`

	// Role determines what actions are allowed to be performed on the specified tenant or resource.
	Role string `json:"role,omitempty"`
}

type AudienceMissingError struct {
	Claims Claims
}

type AudienceNotExpectedError struct {
	Claims   Claims
	Audience jwtgo.ClaimStrings
}

type CachingKeysProvider interface {
	KeysProvider
	InvalidateCacheIfNeeded(ctx context.Context, issuer string) error
}

type CachingParser struct {
	*Parser
	ClaimsCache ClaimsCache
	// contains filtered or unexported fields
}

type CachingParserOpts struct {
	ParserOpts
	CacheMaxEntries              int
	CachePrometheusInstanceLabel string
}

type Claims interface {
	jwtgo.Claims

	// GetID returns the JTI field of the claims.
	GetID() string

	// GetScope returns the scope of the claims as a slice of access policies.
	GetScope() Scope

	// Clone returns a deep copy of the claims.
	Clone() Claims

	// ApplyScopeFilter filters (in-place) the scope of the claims by the specified filter.
	ApplyScopeFilter(filter ScopeFilter)
}

type ClaimsCache interface {
	Get(key [sha256.Size]byte) (Claims, bool)
	Add(key [sha256.Size]byte, claims Claims)
	Purge()
	Len() int
}

type DefaultClaims struct {
	jwtgo.RegisteredClaims
	Scope Scope `json:"scope,omitempty"`
}

type IssuerMissingError struct {
	Claims Claims
}

type IssuerUntrustedError struct {
	Claims Claims
	Issuer string
}

type KeysProvider interface {
	GetRSAPublicKey(ctx context.Context, issuer, keyID string) (interface{}, error)
}

type Parser struct {
	// contains filtered or unexported fields
}

type ParserOpts struct {
	// SkipClaimsValidation is a flag that indicates whether claims validation (e.g. checking expiration time) should be skipped.
	// It doesn't affect signature verification.
	SkipClaimsValidation bool

	// RequireAudience is a flag that indicates whether audience should be required.
	RequireAudience bool

	// ExpectedAudience is a list of expected audience patterns.
	// If it's set, then only tokens with audience that matches at least one of the patterns will be accepted.
	ExpectedAudience []string

	// TrustedIssuerNotFoundFallback is a function called when given issuer is not found in the list of trusted ones.
	TrustedIssuerNotFoundFallback TrustedIssNotFoundFallback

	// LoggerProvider is a function that provides a logger for the Parser.
	LoggerProvider func(ctx context.Context) log.FieldLogger

	// ClaimsTemplate is a template for claims object that will be used for unmarshalling JWT.
	// By default, DefaultClaims is used.
	ClaimsTemplate Claims

	// ScopeFilter is a filter that will be applied to access policies in JWT scope after parsing.
	// If it's set, then only access policies in scope that match at least one of the filtering policies will be returned.
	// It's useful when the CachingParser is used, and we want to store only some of the access policies in the cache to reduce memory usage.
	ScopeFilter ScopeFilter
}

type Scope []AccessPolicy

type ScopeFilter []ScopeFilterAccessPolicy

type ScopeFilterAccessPolicy struct {
	ResourceNamespace string
}

type SignAlgUnknownError struct {
	Alg string
}

type TrustedIssNotFoundFallback func(ctx context.Context, p *Parser, iss string) (issURL string, issFound bool)