oidc

type BaseProvider struct {
	// contains filtered or unexported fields
}

type Claims struct {
	// Standard OIDC claims
	Subject   string    `json:"sub"`           // Subject identifier (user/service ID)
	Issuer    string    `json:"iss"`           // Token issuer URL
	Audience  []string  `json:"aud"`           // Intended audience(s)
	ExpiresAt time.Time `json:"exp"`           // Token expiration time
	IssuedAt  time.Time `json:"iat"`           // Token issuance time
	NotBefore time.Time `json:"nbf,omitempty"` // Token validity start time

	// Provider-specific claims (stored as map for flexibility)
	// Examples:
	//   GitHub Actions: "repository", "ref", "workflow", "actor", "sha"
	//   GitLab CI: "project_path", "pipeline_source", "ref", "runner_id"
	//   AWS: "arn", "account", "assumed_role", "session_name"
	Extra map[string]interface{} `json:"extra"`
}

type CloudflareAccessClaims struct {
	// Email is the authenticated user's email address.
	Email string `json:"email"`

	// Sub is the subject identifier (user ID within CF Access).
	Sub string `json:"sub"`

	// IdentityNonce is a unique nonce per authentication session.
	IdentityNonce string `json:"identity_nonce"`
}

type CloudflareAccessConfig struct {
	ProviderConfig

	// TeamDomain is the Cloudflare Access team name (e.g., "myteam").
	// Used to construct the issuer URL: https://<TeamDomain>.cloudflareaccess.com
	TeamDomain string `json:"team_domain" yaml:"team_domain"`

	// AllowedEmails restricts which email addresses can get bridge certificates.
	// Empty list = allow all authenticated emails.
	AllowedEmails []string `json:"allowed_emails" yaml:"allowed_emails"`

	// CapabilityDomain is the domain used in capability URIs.
	// Default: uses the TeamDomain value.
	// Example: "rosary.bot" → urn:signet:cap:mcp:rosary.bot/<email>
	CapabilityDomain string `json:"capability_domain,omitempty" yaml:"capability_domain,omitempty"`
}

type CloudflareAccessProvider struct {
	*BaseProvider
	// contains filtered or unexported fields
}

type GitHubActionsClaims struct {
	// Repository is the owner/repo (e.g., "agentic-research/signet")
	Repository string `json:"repository"`

	// Ref is the git ref that triggered the workflow (e.g., "refs/heads/main")
	Ref string `json:"ref"`

	// SHA is the commit SHA that triggered the workflow
	SHA string `json:"sha"`

	// Workflow is the workflow file path (e.g., ".github/workflows/release.yml")
	Workflow string `json:"workflow"`

	// Actor is the GitHub username that triggered the workflow
	Actor string `json:"actor"`

	// JobWorkflowRef is the full ref including workflow file
	// Format: "owner/repo/.github/workflows/file.yml@refs/heads/main"
	JobWorkflowRef string `json:"job_workflow_ref"`

	// RepositoryOwner is the repository owner (e.g., "agentic-research")
	RepositoryOwner string `json:"repository_owner"`

	// RepositoryOwnerID is the owner's numeric GitHub ID
	RepositoryOwnerID string `json:"repository_owner_id"`

	// RunID is the unique workflow run ID
	RunID string `json:"run_id"`

	// RunNumber is the workflow run number
	RunNumber string `json:"run_number"`

	// RunAttempt is the attempt number for this run (for re-runs)
	RunAttempt string `json:"run_attempt"`

	// JTI is the unique token identifier for replay prevention.
	// If not present in the raw JWT, synthesized from run_id + run_attempt.
	JTI string `json:"jti"`
}

type GitHubActionsConfig struct {
	ProviderConfig

	// AllowedRepositories restricts which repositories can get bridge certificates.
	// Empty list = allow all repositories. Useful for self-hosted authority servers
	// that only serve specific organizations/repositories.
	// Format: "owner/repo" (e.g., "agentic-research/signet")
	AllowedRepositories []string `json:"allowed_repositories" yaml:"allowed_repositories"`

	// AllowedWorkflows restricts which workflow files can get bridge certificates.
	// Empty list = allow all workflows.
	// Format: relative path (e.g., ".github/workflows/release.yml")
	AllowedWorkflows []string `json:"allowed_workflows" yaml:"allowed_workflows"`

	// RequireRefProtection requires the ref to be a protected branch or tag.
	// Prevents bridge certificates from being issued for PRs from forks.
	// When enabled, only refs matching refs/heads/* and refs/tags/* are allowed;
	// refs matching refs/pull/* are explicitly denied.
	RequireRefProtection bool `json:"require_ref_protection" yaml:"require_ref_protection"`

	// ProtectedBranches restricts which branches are allowed when RequireRefProtection is enabled.
	// If non-empty, only branches whose name (without the refs/heads/ prefix) appears in this
	// list are permitted. Tags (refs/tags/*) are always allowed regardless of this setting.
	// If empty, all refs/heads/* and refs/tags/* refs are allowed.
	// Example: ["main", "master"]
	ProtectedBranches []string `json:"protected_branches,omitempty" yaml:"protected_branches,omitempty"`
}

type GitHubActionsProvider struct {
	*BaseProvider
	// contains filtered or unexported fields
}

type Provider interface {
	// Name returns the provider's unique identifier (e.g., "github-actions", "gitlab-ci")
	Name() string

	// Verify validates an OIDC token from this provider and returns standard claims.
	// Returns an error if the token is invalid, expired, or from wrong issuer.
	Verify(ctx context.Context, rawToken string) (*Claims, error)

	// MapCapabilities converts provider-specific claims into Signet capability URIs.
	// For example, GitHub's "repository" claim → "urn:signet:cap:write:repo:github.com/{repo}"
	MapCapabilities(claims *Claims) ([]string, error)

	// ValidateConfig checks if the provider's configuration is valid.
	// Called during initialization to fail fast on misconfiguration.
	ValidateConfig() error
}

type ProviderConfig struct {
	// Name uniquely identifies this provider (e.g., "github-actions")
	Name string `json:"name" yaml:"name"`

	// IssuerURL is the OIDC discovery endpoint (e.g., "https://token.actions.githubusercontent.com")
	IssuerURL string `json:"issuer_url" yaml:"issuer_url"`

	// Audience is the expected "aud" claim value (typically the authority's URL)
	Audience string `json:"audience" yaml:"audience"`

	// CertificateValidity is the duration for bridge certificates issued for this provider.
	// Default: 5 minutes (per 004-bridge-certs.md design)
	CertificateValidity time.Duration `json:"certificate_validity" yaml:"certificate_validity"`

	// Enabled controls whether this provider is active.
	// Useful for disabling providers without removing config.
	Enabled bool `json:"enabled" yaml:"enabled"`
}

type ProviderConfigEntry struct {
	// Type specifies the provider implementation (e.g., "github-actions", "gitlab-ci")
	Type string `json:"type" yaml:"type"`

	// Config contains the provider-specific configuration.
	// The structure depends on the Type field.
	Config json.RawMessage `json:"config" yaml:"config"`
}

type ProvidersConfig struct {
	// Providers is a list of provider configurations.
	// Each provider has a "type" field that determines which implementation to use.
	Providers []ProviderConfigEntry `json:"providers" yaml:"providers"`
}

type Registry struct {
	// contains filtered or unexported fields
}