auth

type AuthnProvider interface {
	Authenticate(ctx context.Context, reqHeaders func(name string) string, query url.Values) (Session, error)
}

type Authorizer struct {
	Authz AuthzProvider
}

type AuthzProvider interface {
	// Check verifies if the session can perform the action on the resource.
	// Used for single-resource operations (get, update, delete).
	Check(ctx context.Context, s Session, verb PermissionAction, resource Resource) error
	// IsRegistryAdmin checks if the session has global permissions (i.e. "*") for the registry
	// Also used by internal operations and database queries that need to bypass filtering.
	IsRegistryAdmin(ctx context.Context, s Session) bool
}

type JWTClaims struct {
	jwt.RegisteredClaims
	// Authentication method used to obtain this token
	AuthMethod        Method       `json:"auth_method"`
	AuthMethodSubject string       `json:"auth_method_sub"`
	Permissions       []Permission `json:"permissions"`
}

type JWTManager struct {
	// contains filtered or unexported fields
}

type Method string

type Permission struct {
	Action          PermissionAction `json:"action"`   // The action type (e.g. publish, edit, delete, etc.)
	ResourcePattern string           `json:"resource"` // e.g., "io.github.username/*"
}

type PermissionAction string

type PermissionArtifactType string

type Principal struct {
	User User
}

type PublicAuthzProvider struct {
	// contains filtered or unexported fields
}

type Resource struct {
	Name string
	Type PermissionArtifactType
}

type Session interface {
	Principal() Principal
}

type SystemSession struct{}

type TokenResponse struct {
	RegistryToken string `json:"registry_token"`
	ExpiresAt     int    `json:"expires_at"`
}

type User struct {
	Permissions []Permission
}