bridge

type AAuthVerifier interface {
	VerifyAgentToken(ctx context.Context, tokenString string) (*aauth.AgentToken, error)
}

type Actor struct {
	// Subject is the actor's identity.
	Subject string

	// Issuer is the actor's issuer (optional).
	Issuer string

	// Actor is the nested actor for multi-level delegation.
	Actor *Actor
}

type IDJAGVerifier interface {
	Verify(ctx context.Context, tokenString string) (*idjag.Assertion, error)
}

type Identity struct {
	// Protocol indicates which protocol this identity was extracted from.
	Protocol Protocol

	// Issuer is the entity that issued the token (iss claim).
	Issuer string

	// Subject is the primary identity being asserted (sub claim).
	Subject string

	// Audience is the intended recipient(s) of the token (aud claim).
	Audience []string

	// IssuedAt is when the token was created (iat claim).
	IssuedAt time.Time

	// ExpiresAt is when the token expires (exp claim).
	ExpiresAt time.Time

	// JWTID is the unique token identifier (jti claim).
	JWTID string

	// KeyBinding contains proof-of-possession key information if present.
	// This is extracted from CNF claims in AIMS and AAuth.
	KeyBinding *KeyBinding

	// Actor contains delegation chain information if present.
	// This is extracted from act claims in ID-JAG and AAuth.
	Actor *Actor

	// OriginalClaims preserves protocol-specific claims for reference.
	OriginalClaims map[string]any
}

type KeyBinding struct {
	// Kid is the key identifier.
	Kid string

	// JWK is the embedded public key in JWK format.
	JWK []byte

	// JKU is the URL to fetch the JWK Set.
	JKU string

	// X5T is the X.509 certificate SHA-256 thumbprint.
	X5T string
}

type MiddlewareConfig struct {
	// IDJAGVerifier verifies ID-JAG assertions.
	IDJAGVerifier IDJAGVerifier

	// WITVerifier verifies AIMS WITs.
	WITVerifier WITVerifier

	// AAuthVerifier verifies AAuth agent tokens.
	AAuthVerifier AAuthVerifier

	// OnError is called when verification fails.
	// If nil, a 401 response is returned.
	OnError func(w http.ResponseWriter, r *http.Request, err error)

	// RequireKeyBinding requires proof-of-possession for all protocols.
	RequireKeyBinding bool

	// AllowedProtocols limits which protocols are accepted.
	// If empty, all configured protocols are allowed.
	AllowedProtocols []Protocol
}

type MiddlewareOption func(*MiddlewareConfig)

type ParseResult struct {
	// Protocol is the detected protocol.
	Protocol Protocol

	// Identity is the canonical identity extracted from the token.
	Identity *Identity

	// IDJAGAssertion is the parsed ID-JAG assertion (if Protocol == ProtocolIDJAG).
	IDJAGAssertion *idjag.Assertion

	// WIT is the parsed AIMS WIT (if Protocol == ProtocolAIMS).
	WIT *aims.WorkloadIdentityToken

	// AAuthToken is the parsed AAuth agent token (if Protocol == ProtocolAAuth).
	AAuthToken *aauth.AgentToken
}

type Protocol string

type WITVerifier interface {
	Verify(tokenString string) (*aims.WorkloadIdentityToken, error)
}