authn

type Application ¶

type Application struct {
	ID             string
	ExternalID     string
	OrgID          string
	Name           string
	DisplayName    string
	ClientID       string
	ClientSecret   string
	RedirectURIs   []string
	GrantTypes     []string
	Scopes         []string
	Providers      []string
	EnablePassword bool
	EnableSignup   bool
	Attributes     AttributeSet
}

Application represents a login client/application in the identity provider.

type ApplicationAdmin ¶

type ApplicationAdmin interface {
	CreateApplication(ctx context.Context, req CreateApplicationRequest) (Application, error)
	GetApplication(ctx context.Context, orgID, appID string) (Application, error)
	UpdateApplication(ctx context.Context, req UpdateApplicationRequest) (Application, error)
	DeleteApplication(ctx context.Context, req DeleteApplicationRequest) error
}

ApplicationAdmin manages identity-provider applications / OAuth clients.

type AssignUserToGroupRequest ¶

type AssignUserToGroupRequest struct {
	OrgID    string
	GroupID  string
	UserID   string
	Metadata map[string]string
}

type AttributeSet ¶

type AttributeSet map[string]any

AttributeSet carries provider-specific claims or admin metadata. Values should be JSON-serializable when they are persisted or sent to remote systems.

type AuthCodeExchangeRequest ¶

type AuthCodeExchangeRequest struct {
	Code         string
	State        string
	RedirectURI  string
	CodeVerifier string
	OrgID        string
	AppID        string
	Metadata     map[string]string
}

AuthCodeExchangeRequest is the provider-neutral shape for OAuth code exchange.

type Authenticator ¶

type Authenticator interface {
	Authenticate(ctx context.Context, credential Credential) (Principal, error)
}

Authenticator verifies a transport credential and returns a normalized Principal.

type CachedAuthenticator ¶ added in v0.2.4

type CachedAuthenticator struct {
	// contains filtered or unexported fields
}

CachedAuthenticator caches verified Principals for bearer JWTs.

It caches the *verification result*, not any decrypted secret. JWTs are not encrypted here; they are signed. Cache keys are SHA-256 hashes of the raw token and TTL is capped by the token's exp claim, so an expired token is never accepted from cache.

func NewCachedAuthenticator(inner Authenticator, cache cachex.Cache, opts ...CachedAuthenticatorOption) *CachedAuthenticator

func (c *CachedAuthenticator) Authenticate(ctx context.Context, credential Credential) (Principal, error)

type CachedAuthenticatorOption ¶ added in v0.2.4

type CachedAuthenticatorOption func(*CachedAuthenticator)

func WithAuthenticatorCacheTTL(ttl time.Duration) CachedAuthenticatorOption

type CachedClient ¶ added in v0.0.3

type CachedClient struct {
	// contains filtered or unexported fields
}

CachedClient wraps an Authenticator + TokenService + LogoutService with a shared cache.

Construction:

client := casdoor.New(cfg)              // implements all three interfaces
cached := authn.NewCachedClient(client, client, client, cache,
    authn.WithCachedTTL(5*time.Minute))
_ = authn.Authenticator(cached)         // usable as Authenticator
_ = authn.TokenService(cached)          // usable as TokenService
_ = authn.LogoutService(cached)         // usable as LogoutService

All three of `auth`, `tokens` and `logout` may point to the same object (typical for the casdoor Client which implements all three). They are accepted separately so callers can mix providers (e.g. JWT verifier for Authenticate, introspection endpoint for TokenService) if needed.

func NewCachedClient(auth Authenticator, tokens TokenService, logout LogoutService, cache cachex.Cache, opts ...CachedOption) *CachedClient

func (c *CachedClient) Authenticate(ctx context.Context, credential Credential) (Principal, error)

func (c *CachedClient) BuildLogoutURL(ctx context.Context, req LogoutURLRequest) (LogoutURL, error)

func (c *CachedClient) ExchangeCode(ctx context.Context, req AuthCodeExchangeRequest) (TokenSet, Principal, error)

func (c *CachedClient) Invalidate(ctx context.Context, token string) error

func (c *CachedClient) RefreshToken(ctx context.Context, req RefreshTokenRequest) (TokenSet, error)

func (c *CachedClient) RevokeToken(ctx context.Context, req RevokeTokenRequest) error

func (c *CachedClient) VerifyToken(ctx context.Context, req VerifyTokenRequest) (Principal, error)

type CachedOption ¶ added in v0.0.3

type CachedOption func(*CachedClient)

CachedOption configures a CachedClient.

func WithCachedTTL(ttl time.Duration) CachedOption

type CallbackRequest ¶

type CallbackRequest struct {
	Code          string
	State         string
	ExpectedState string
	RedirectURI   string
	OrgID         string
	AppID         string
	Metadata      map[string]string
}

CallbackRequest is the provider-neutral OAuth/OIDC callback payload.

type CallbackResult ¶

type CallbackResult struct {
	Tokens    TokenSet
	Principal Principal
	State     string
	Provider  string
}

CallbackResult is the result of a successful browser callback flow.

type CompositeAuthenticator ¶ added in v0.2.4

type CompositeAuthenticator struct {
	Primary   Authenticator
	Secondary Authenticator
}

CompositeAuthenticator tries Primary first and falls back to Secondary only when the primary credential is missing/invalid for migration-friendly hybrid modes. Avoid using this as a long-term production default; prefer one clear authn mode per service.

func (a CompositeAuthenticator) Authenticate(ctx context.Context, cred Credential) (Principal, error)

type CreateApplicationRequest ¶

type CreateApplicationRequest struct {
	Application    Application
	IdempotencyKey string
	Metadata       map[string]string
}

type CreateGroupRequest ¶

type CreateGroupRequest struct {
	Group          Group
	IdempotencyKey string
	Metadata       map[string]string
}

type CreateOrganizationRequest ¶

type CreateOrganizationRequest struct {
	Organization   Organization
	IdempotencyKey string
	Metadata       map[string]string
}

type CreateUserRequest ¶ added in v0.2.4

type CreateUserRequest struct {
	User           User
	IdempotencyKey string
	Metadata       map[string]string
}

CreateUserRequest creates an identity-provider user without exposing any concrete provider SDK type. Password credentials, MFA and hosted login state are owned by the backing identity provider such as Casdoor.

type Credential ¶

type Credential struct {
	Scheme   string
	Token    string
	Metadata map[string]string
}

Credential is authentication input extracted by HTTP/gRPC middleware.

func BearerCredential(header string) (Credential, bool)

type DeleteApplicationRequest ¶

type DeleteApplicationRequest struct {
	AppID    string
	OrgID    string
	Hard     bool
	Metadata map[string]string
}

type DeleteGroupRequest ¶

type DeleteGroupRequest struct {
	OrgID     string
	GroupID   string
	Recursive bool
	Metadata  map[string]string
}

type DeleteOrganizationRequest ¶

type DeleteOrganizationRequest struct {
	OrgID    string
	Hard     bool
	Metadata map[string]string
}

type DeleteUserRequest ¶ added in v0.2.4

type DeleteUserRequest struct {
	OrgID    string
	UserID   string
	Hard     bool
	Metadata map[string]string
}

DeleteUserRequest deletes or disables an identity-provider user.

type Group ¶

type Group struct {
	ID          string
	ExternalID  string
	OrgID       string
	ParentID    string
	Name        string
	DisplayName string
	Type        string
	Path        string
	Users       []string
	Attributes  AttributeSet
}

Group models Casdoor's organization tree/groups without coupling Kernel to Casdoor names. Group.Type can be physical, virtual, team, etc.

type GroupAdmin ¶

type GroupAdmin interface {
	CreateGroup(ctx context.Context, req CreateGroupRequest) (Group, error)
	GetGroup(ctx context.Context, orgID, groupID string) (Group, error)
	ListGroups(ctx context.Context, filter GroupFilter) ([]Group, error)
	UpdateGroup(ctx context.Context, req UpdateGroupRequest) (Group, error)
	DeleteGroup(ctx context.Context, req DeleteGroupRequest) error
	AssignUserToGroup(ctx context.Context, req AssignUserToGroupRequest) error
	RemoveUserFromGroup(ctx context.Context, req AssignUserToGroupRequest) error
}

GroupAdmin manages app/org group trees. Casdoor maps this naturally to organization groups with ParentGroup.

type GroupFilter ¶

type GroupFilter struct {
	OrgID    string
	ParentID string
	Type     string
	UserID   string
	Limit    int
	Offset   int
}

type IdentityAdmin ¶

type IdentityAdmin interface {
	TokenService
	UserDirectory
	UserAdmin
	OrganizationAdmin
	ApplicationAdmin
	GroupAdmin
}

IdentityAdmin is the external identity-provider management surface expected from adapters such as Casdoor. It is deliberately not Kernel's canonical IAM storage API.

Use IdentityAdmin only in IAM provisioning/sync adapters after platform-level authorization has already been checked. Business services and domain code should depend on iamx.Service/iamx.Directory for users, organizations, groups and memberships. That split keeps provider-side projections separate from the Kernel IAM control-plane facts.

func NoopAdmin() IdentityAdmin

type IdentityProfile ¶

type IdentityProfile struct {
	Principal Principal

	// User is the canonical user projection from the identity provider when it
	// can be read. It may be zero when only token claims were available.
	User User

	// Groups contains expanded group objects. Principal.Groups and User.Groups
	// are usually only group IDs/names; this slice carries display names, parent
	// IDs and group type when available.
	Groups []Group

	// CurrentApplication is the login/OIDC application used by the current flow.
	// A user does not usually "belong" to an application in the same way they
	// belong to a group; the application here means the OAuth client that issued
	// the token or handled the login.
	CurrentApplication Application

	Warnings   []string
	Attributes AttributeSet
}

IdentityProfile is the normalized post-login identity snapshot used by handlers, middleware and Kernel IAM sync logic.

func (p IdentityProfile) GroupIDs() []string

func (p IdentityProfile) HasFullUser() bool

func (p IdentityProfile) IsPartial() bool

type IdentityProfileRequest ¶

type IdentityProfileRequest struct {
	Principal  Principal
	Token      string
	Credential Credential

	OrgID string
	AppID string

	IncludeUser               bool
	IncludeGroups             bool
	IncludeCurrentApplication bool

	// AllowPartial returns Principal plus whatever profile data can be read when
	// admin/read APIs fail. This is useful for normal request paths where token
	// authentication must not fail only because optional profile enrichment is
	// unavailable.
	AllowPartial bool

	Metadata map[string]string
}

IdentityProfileRequest controls how much identity-provider data should be loaded after login or token verification.

For request handling, pass Principal when you already have one from Authenticate/VerifyToken. For test tools and middleware, pass Token or Credential and the implementation will authenticate first.

type InternalServiceTokenConfig ¶ added in v0.2.4

type InternalServiceTokenConfig struct {
	Enabled    bool   `json:"enabled" yaml:"enabled"`
	HeaderName string `json:"header" yaml:"header"`
	Token      string `json:"token" yaml:"token"`
}

InternalServiceTokenConfig configures the simple first-phase Gateway -> backend trust boundary.

It is intentionally a shared-secret mechanism for MVP deployments. Production can later add NetworkPolicy and mTLS without changing the authn/accessx contract.

func (c InternalServiceTokenConfig) Header() string

func (c InternalServiceTokenConfig) Normalized() InternalServiceTokenConfig

func (c InternalServiceTokenConfig) ValidateToken(got string) bool

type LoginService ¶

type LoginService interface {
	BuildLoginURL(ctx context.Context, req LoginURLRequest) (LoginURL, error)
	HandleCallback(ctx context.Context, req CallbackRequest) (CallbackResult, error)
}

LoginService is the provider-neutral browser login contract used by HTTP handlers, examples and application boot code. Implementations can use Casdoor/OIDC SDKs internally, but callers only depend on Kernel authn types.

type LoginURL ¶

type LoginURL struct {
	URL         string
	RedirectURI string
	State       string
	Scope       string
	Provider    string
	OrgID       string
	AppID       string
}

LoginURL is the safe redirect target returned by LoginService.

type LoginURLRequest ¶

type LoginURLRequest struct {
	RedirectURI string
	State       string
	Scope       string
	OrgID       string
	AppID       string
	Metadata    map[string]string
}

LoginURLRequest asks an identity provider for a hosted login URL.

type LogoutService ¶ added in v0.0.7

type LogoutService interface {
	BuildLogoutURL(ctx context.Context, req LogoutURLRequest) (LogoutURL, error)
}

LogoutService builds identity-provider hosted logout (end-session) URLs.

Implementations construct the provider-specific end-session endpoint URL with the required OIDC RP-Initiated Logout parameters (id_token_hint, post_logout_redirect_uri, state, client_id). The returned LogoutURL.URL is the full redirect target for a 302 response.

type LogoutURL ¶ added in v0.0.7

type LogoutURL struct {
	URL                   string
	PostLogoutRedirectURI string
	State                 string
	Provider              string
	OrgID                 string
	AppID                 string
}

LogoutURL is the safe redirect target returned by LogoutService.

type LogoutURLRequest ¶ added in v0.0.7

type LogoutURLRequest struct {
	PostLogoutRedirectURI string
	IDTokenHint           string
	State                 string
	OrgID                 string
	AppID                 string
	Metadata              map[string]string
}

LogoutURLRequest asks an identity provider for a hosted logout (end-session) URL.

type ManagementProvider ¶ added in v0.1.16

type ManagementProvider interface {
	Provider
	IdentityAdmin
}

ManagementProvider extends Provider with user/organization/application/group administration. It is intended for IAM control-plane code and provisioning, not normal business request handlers.

Kernel's default implementation is authn/casdoor.Client. Business packages should not import the Casdoor SDK directly.

type Organization ¶

type Organization struct {
	ID          string
	ExternalID  string
	Name        string
	DisplayName string
	OwnerID     string
	ParentID    string
	Tags        []string
	Enabled     bool
	Attributes  AttributeSet
}

Organization is Kernel's identity-side organization projection. Kernel IAM DB can store richer business org metadata; this type is for authn provider sync.

type OrganizationAdmin ¶

type OrganizationAdmin interface {
	CreateOrganization(ctx context.Context, req CreateOrganizationRequest) (Organization, error)
	GetOrganization(ctx context.Context, orgID string) (Organization, error)
	UpdateOrganization(ctx context.Context, req UpdateOrganizationRequest) (Organization, error)
	DeleteOrganization(ctx context.Context, req DeleteOrganizationRequest) error
}

OrganizationAdmin manages identity-provider organizations.

type Principal ¶

type Principal struct {
	SubjectID   string
	SubjectType string

	Provider   string
	ExternalID string
	Issuer     string
	Audience   []string

	TenantID  string
	OrgID     string
	AppID     string
	ProjectID string

	Username string
	Name     string
	Email    string
	Phone    string

	Roles  []string
	Groups []string
	Scopes []string

	// AuthMethod records how the subject authenticated. It is intentionally a
	// string instead of an enum type so adapters can preserve provider-specific
	// methods while still using the AuthMethod* constants above.
	AuthMethod string

	Attributes AttributeSet
	IssuedAt   time.Time
	ExpiresAt  time.Time
}

Principal is the normalized identity passed to business code.

SubjectID must be stable inside Kernel. For Casdoor this should normally map from the Casdoor user's stable UUID when available, not only owner/name.

func Anonymous() Principal

func MustPrincipal(ctx context.Context) (Principal, error)

func PrincipalFromContext(ctx context.Context) (Principal, bool)

func PrincipalFromTrustedHeaders(headers map[string]string) (Principal, bool)

func (p Principal) Attribute(key string) any

func (p Principal) Expired(now time.Time) bool

func (p Principal) HasGroup(group string) bool

func (p Principal) HasRole(role string) bool

func (p Principal) HasScope(scope string) bool

func (p Principal) IsAnonymous() bool

func (p Principal) IsAuthenticated() bool

func (p Principal) Normalize() Principal

type PrincipalJWTAuthenticator ¶ added in v0.3.0

type PrincipalJWTAuthenticator struct{ Config PrincipalJWTConfig }

func (a PrincipalJWTAuthenticator) Authenticate(ctx context.Context, cred Credential) (Principal, error)

type PrincipalJWTClaims ¶ added in v0.3.0

type PrincipalJWTClaims struct {
	jwt.RegisteredClaims
	Type        string   `json:"typ,omitempty"`
	SubjectType string   `json:"subject_type,omitempty"`
	Provider    string   `json:"provider,omitempty"`
	ExternalID  string   `json:"external_id,omitempty"`
	TenantID    string   `json:"tenant_id,omitempty"`
	OrgID       string   `json:"org_id,omitempty"`
	AppID       string   `json:"app_id,omitempty"`
	ProjectID   string   `json:"project_id,omitempty"`
	Username    string   `json:"username,omitempty"`
	Name        string   `json:"name,omitempty"`
	Email       string   `json:"email,omitempty"`
	Phone       string   `json:"phone,omitempty"`
	Roles       []string `json:"roles,omitempty"`
	Groups      []string `json:"groups,omitempty"`
	Scopes      []string `json:"scopes,omitempty"`
	AuthMethod  string   `json:"auth_method,omitempty"`
}

func (c PrincipalJWTClaims) Principal() Principal

type PrincipalJWTConfig ¶ added in v0.3.0

type PrincipalJWTConfig struct {
	Enabled   bool          `json:"enabled" yaml:"enabled"`
	Header    string        `json:"header" yaml:"header"`
	Secret    string        `json:"secret" yaml:"secret"`
	Issuer    string        `json:"issuer" yaml:"issuer"`
	Audience  []string      `json:"audience" yaml:"audience"`
	TTL       time.Duration `json:"ttl_ns" yaml:"ttl_ns"`
	ClockSkew time.Duration `json:"clock_skew_ns" yaml:"clock_skew_ns"`
}

func (c PrincipalJWTConfig) Normalized() PrincipalJWTConfig

type ProfileService ¶

type ProfileService interface {
	GetIdentityProfile(ctx context.Context, req IdentityProfileRequest) (IdentityProfile, error)
}

ProfileService enriches an authenticated Principal with identity-provider profile data. It is intentionally provider-neutral: callers should not have to know whether the backing system is Casdoor, OIDC, LDAP, SCIM, etc.

type Provider ¶ added in v0.1.16

type Provider interface {
	Authenticator
	TokenService
	LoginService
	LogoutService
}

Provider is Kernel's default runtime authentication surface.

Business code must depend on this interface (or one of its smaller sub-interfaces), not on concrete identity providers such as Casdoor. Casdoor/OIDC/JWT implementations live behind this contract.

type ProviderSet ¶ added in v0.1.16

type ProviderSet struct {
	Runtime    Provider
	Management ManagementProvider

	// Optional identity-provider backed read models. In Casdoor-first deployments
	// this is implemented by the Casdoor adapter and is used only for display
	// surfaces such as online-user/session dashboards.
	Sessions SessionDirectory
}

ProviderSet names the Kernel authn capabilities that boot/server wiring can expose without leaking a concrete provider implementation.

func (p ProviderSet) Authenticator() Authenticator

func (p ProviderSet) IdentityAdmin() IdentityAdmin

func (p ProviderSet) Login() LoginService

func (p ProviderSet) Logout() LogoutService

func (p ProviderSet) SessionDirectory() SessionDirectory

func (p ProviderSet) Tokens() TokenService

type RefreshTokenRequest ¶

type RefreshTokenRequest struct {
	RefreshToken string
	Scope        string
	OrgID        string
	AppID        string
	Metadata     map[string]string
}

type RevokeTokenRequest ¶

type RevokeTokenRequest struct {
	Token     string
	TokenType string
	OrgID     string
	AppID     string
	Metadata  map[string]string
}

type Session ¶ added in v0.2.4

type Session struct {
	ID                string
	Provider          string
	ProviderSessionID string

	OrgID       string
	Application string

	SubjectID   string
	SubjectType string
	Username    string
	DisplayName string
	Email       string

	Status    string
	UserAgent string
	IP        string

	CreatedAt  time.Time
	UpdatedAt  time.Time
	ExpiresAt  time.Time
	LastSeenAt time.Time

	Attributes AttributeSet
}

Session is Kernel's provider-neutral view of an identity-provider session.

Casdoor-first deployments must treat Casdoor as the source of truth for sessions. Kernel does not create, validate, refresh or persist sessions. This type is only used for admin/user-facing read models such as "who is online", "which users have active sessions", or "show my logged-in devices".

func (s Session) IsActive(now time.Time) bool

type SessionDirectory ¶ added in v0.2.4

type SessionDirectory interface {
	GetSession(ctx context.Context, orgID, sessionID string) (Session, error)
	ListSessions(ctx context.Context, filter SessionFilter) ([]Session, error)
	SummarizeSessions(ctx context.Context, filter SessionFilter) (SessionSummary, error)
}

SessionDirectory reads identity-provider sessions for display and operational visibility. It deliberately does not create or validate sessions; login, logout, refresh-token and browser session lifecycle remain owned by Casdoor or another external identity provider.

type SessionFilter ¶ added in v0.2.4

type SessionFilter struct {
	SessionID         string
	ProviderSessionID string
	OrgID             string
	Application       string
	SubjectID         string
	Username          string
	Email             string
	Status            string
	OnlineOnly        bool
	Limit             int
	Offset            int
}

type SessionSummary ¶ added in v0.2.4

type SessionSummary struct {
	TotalSessions  int
	ActiveSessions int
	OnlineUsers    int
	ByApplication  map[string]int
}

type TokenAuthenticator ¶

type TokenAuthenticator struct {
	Verifier TokenVerifier
	Issuer   string
	Audience []string
	OrgID    string
	AppID    string
}

TokenAuthenticator adapts a TokenService/TokenVerifier to Authenticator.

func (a TokenAuthenticator) Authenticate(ctx context.Context, credential Credential) (Principal, error)

type TokenService ¶

type TokenService interface {
	ExchangeCode(ctx context.Context, req AuthCodeExchangeRequest) (TokenSet, Principal, error)
	RefreshToken(ctx context.Context, req RefreshTokenRequest) (TokenSet, error)
	VerifyToken(ctx context.Context, req VerifyTokenRequest) (Principal, error)
	RevokeToken(ctx context.Context, req RevokeTokenRequest) error
}

TokenService covers OAuth/OIDC token flows such as Casdoor code exchange, refresh, validation and revocation.

type TokenSet ¶

type TokenSet struct {
	AccessToken  string
	RefreshToken string
	IDToken      string
	TokenType    string
	Scope        string
	ExpiresAt    time.Time
	Raw          AttributeSet
}

TokenSet is the result of OAuth/OIDC token operations.

type TokenVerifier ¶

type TokenVerifier func(ctx context.Context, req VerifyTokenRequest) (Principal, error)

TokenVerifier adapts JWT/OIDC libraries into Authenticator.

type TrustedHeaderAuthenticator ¶ added in v0.2.4

type TrustedHeaderAuthenticator struct {
	// InternalToken optionally requires a Gateway-to-backend shared secret before
	// trusting X-Aisphere-* identity headers. Use this in gateway_trusted mode.
	InternalToken InternalServiceTokenConfig
}

TrustedHeaderAuthenticator trusts a Principal already verified and injected by Gateway. Use only behind network policy / mTLS / service-token boundaries that prevent clients from bypassing Gateway.

func (a TrustedHeaderAuthenticator) Authenticate(ctx context.Context, credential Credential) (Principal, error)

type UpdateApplicationRequest ¶

type UpdateApplicationRequest struct {
	Application Application
	Metadata    map[string]string
}

type UpdateGroupRequest ¶

type UpdateGroupRequest struct {
	Group    Group
	Metadata map[string]string
}

type UpdateOrganizationRequest ¶

type UpdateOrganizationRequest struct {
	Organization Organization
	Metadata     map[string]string
}

type UpdateUserRequest ¶ added in v0.2.4

type UpdateUserRequest struct {
	User     User
	Metadata map[string]string
}

UpdateUserRequest updates an identity-provider user projection.

type User ¶

type User struct {
	ID          string
	ExternalID  string
	Provider    string
	OrgID       string
	Username    string
	DisplayName string
	Email       string
	Phone       string
	Roles       []string
	Groups      []string
	Enabled     bool
	Attributes  AttributeSet
}

User mirrors identity-provider user data without importing a provider SDK.

type UserAdmin ¶ added in v0.2.4

type UserAdmin interface {
	CreateUser(ctx context.Context, req CreateUserRequest) (User, error)
	UpdateUser(ctx context.Context, req UpdateUserRequest) (User, error)
	DeleteUser(ctx context.Context, req DeleteUserRequest) error
	UpsertUser(ctx context.Context, user User) (User, error)
	DisableUser(ctx context.Context, orgID, userID string) error
}

UserAdmin manages identity-provider users. Passwords, MFA and session state are owned by the backing identity provider, such as Casdoor. Kernel only exposes the management surface; it must not store password hashes or local sessions.

type UserDirectory ¶

type UserDirectory interface {
	GetUser(ctx context.Context, orgID, userID string) (User, error)
	FindUsers(ctx context.Context, filter UserFilter) ([]User, error)
}

UserDirectory reads identity-provider users. Business modules should usually go through Kernel IAM service, not a provider SDK directly.

type UserFilter ¶

type UserFilter struct {
	ID         string
	ExternalID string
	OrgID      string
	Username   string
	Email      string
	Phone      string
	GroupID    string
	Role       string
	Limit      int
	Offset     int
}

type VerifyTokenRequest ¶

type VerifyTokenRequest struct {
	Token     string
	TokenType string
	Issuer    string
	Audience  []string
	OrgID     string
	AppID     string
	Leeway    time.Duration
	Metadata  map[string]string
}