idjag

type Actor struct {
	// Subject identifies the actor (sub claim within act).
	Subject string `json:"sub"`

	// Issuer optionally identifies who asserted this actor's identity.
	Issuer string `json:"iss,omitempty"`

	// Actor allows for nested delegation chains.
	// For example, User -> Agent1 -> Agent2.
	Actor *Actor `json:"act,omitempty"`
}

type Assertion struct {
	// Issuer identifies the principal that issued the assertion (iss claim).
	// This is the IdP Authorization Server identifier.
	Issuer string `json:"iss"`

	// Subject identifies the principal that is the subject of the assertion (sub claim).
	// For direct agent authentication, this is the agent's identity.
	// For delegation, this is the human/principal identity being delegated.
	Subject string `json:"sub"`

	// Audience identifies the recipients that the assertion is intended for (aud claim).
	// This is the Resource Authorization Server identifier.
	Audience []string `json:"aud"`

	// ClientID identifies the OAuth client at the Resource Authorization Server (client_id claim).
	// This is a required claim per IETF draft.
	ClientID string `json:"client_id"`

	// IssuedAt is the time at which the assertion was issued (iat claim).
	IssuedAt time.Time `json:"iat"`

	// ExpiresAt is the expiration time of the assertion (exp claim).
	ExpiresAt time.Time `json:"exp"`

	// NotBefore is the time before which the assertion is not valid (nbf claim).
	NotBefore time.Time `json:"nbf,omitempty"`

	// JWTID is a unique identifier for the assertion (jti claim).
	// This is a required claim per IETF draft.
	JWTID string `json:"jti,omitempty"`

	// Actor identifies the acting party in delegation scenarios (act claim).
	// When present, Subject identifies the delegating principal and Actor
	// identifies the party acting on their behalf.
	// Note: The IETF draft does not normatively define act claim processing;
	// this implementation follows RFC 8693 for delegation semantics.
	Actor *Actor `json:"act,omitempty"`

	// Claims contains additional custom claims not covered by the standard fields.
	Claims map[string]any `json:"-"`
}

type AuthorizationServer struct {
	// Verifier validates incoming assertions.
	Verifier Verifier

	// SigningMethod is the JWT signing method for access tokens.
	SigningMethod jwt.SigningMethod

	// SigningKey is the private key for signing access tokens.
	SigningKey crypto.PrivateKey

	// KeyID is the key identifier to include in token headers.
	KeyID string

	// Issuer is the issuer claim for access tokens.
	Issuer string

	// TokenTTL is the lifetime for issued access tokens.
	TokenTTL time.Duration

	// AllowedScopes restricts which scopes can be requested.
	// If empty, all scopes are allowed.
	AllowedScopes []string

	// ScopeValidator is an optional function to validate scope requests.
	// If set, it is called to validate the requested scope against the assertion.
	ScopeValidator func(assertion *Assertion, requestedScope string) error
}

type DelegationRequest struct {
	Subject           string            `json:"subject"`
	AgentID           string            `json:"agent_id"`
	Audience          []string          `json:"audience"`
	RequestedScopes   []string          `json:"requested_scopes,omitempty"`
	DelegationContext map[string]string `json:"delegation_context,omitempty"`
}

type DelegationResponse struct {
	Assertion string `json:"assertion"`
	ExpiresIn int    `json:"expires_in"`
	Subject   string `json:"subject"`
	Actor     string `json:"actor"`
}

type IDJAGClient struct {
	// TokenURL is the IdP's token endpoint.
	TokenURL string

	// HTTPClient is the HTTP client to use. If nil, http.DefaultClient is used.
	HTTPClient *http.Client

	// ClientID is the OAuth client identifier.
	ClientID string

	// ClientSecret is the OAuth client secret (for confidential clients).
	ClientSecret string
}

type IDJAGRequest struct {
	// SubjectToken is the security token representing the user's identity.
	// This is typically an ID token, SAML assertion, or refresh token.
	SubjectToken string

	// SubjectTokenType identifies the type of subject token.
	// Common values: TokenTypeIDToken, TokenTypeSAML2, TokenTypeRefreshToken.
	SubjectTokenType string

	// ActorToken optionally identifies the acting party (agent).
	// Per IETF draft, processing of actor_token is not normatively defined.
	ActorToken string

	// ActorTokenType identifies the type of actor token (required if ActorToken set).
	ActorTokenType string

	// Audience is the Resource Authorization Server identifier.
	Audience string

	// ClientID is the OAuth client identifier at the Resource Authorization Server.
	ClientID string

	// Scope is the requested scope (optional).
	Scope string

	// Resource is the resource identifier per RFC 8707 (optional).
	Resource string
}

type IDJAGResponse struct {
	// AccessToken contains the ID-JAG assertion (named per OAuth convention).
	AccessToken string `json:"access_token"`

	// IssuedTokenType is always TokenTypeIDJAG for ID-JAG responses.
	IssuedTokenType string `json:"issued_token_type"`

	// TokenType is "N_A" per RFC 8693 for non-access-token responses.
	TokenType string `json:"token_type"`

	// ExpiresIn is the assertion lifetime in seconds.
	ExpiresIn int `json:"expires_in"`

	// Scope is the granted scope.
	Scope string `json:"scope,omitempty"`
}

type IdPAuthorizationServer struct {
	// Issuer is the issuer identifier (iss claim) for created assertions.
	Issuer string

	// SigningMethod is the JWT signing method (e.g., RS256, ES256).
	SigningMethod jwt.SigningMethod

	// SigningKey is the private key for signing assertions.
	SigningKey crypto.PrivateKey

	// KeyID is the key identifier to include in JWT headers.
	KeyID string

	// AssertionTTL is the lifetime for issued assertions.
	// Default is 5 minutes per IETF draft recommendations.
	AssertionTTL time.Duration

	// SubjectTokenVerifier validates the subject_token (e.g., ID token, refresh token).
	// If nil, subject tokens are not validated (not recommended for production).
	SubjectTokenVerifier Verifier

	// DelegationPolicy is called to validate delegation requests.
	// If nil, all delegation requests are allowed.
	DelegationPolicy func(ctx context.Context, req *IDJAGRequest) error
}

type IssuerClient struct {
	IssuerURL  string
	HTTPClient *http.Client
}

type IssuerHandler struct {
	// contains filtered or unexported fields
}

type IssuerService = IdPAuthorizationServer

type JWK struct {
	KeyType   string `json:"kty"`
	KeyID     string `json:"kid"`
	Algorithm string `json:"alg,omitempty"`
	Use       string `json:"use,omitempty"`

	// RSA parameters
	N string `json:"n,omitempty"` // Modulus
	E string `json:"e,omitempty"` // Exponent

	// EC parameters
	Curve string `json:"crv,omitempty"` // Curve name
	X     string `json:"x,omitempty"`   // X coordinate
	Y     string `json:"y,omitempty"`   // Y coordinate
}

type JWKS struct {
	Keys []JWK `json:"keys"`
}

type JWKSHandler struct {
	// contains filtered or unexported fields
}

type JWKSVerifier struct {
	// contains filtered or unexported fields
}

type JWTBearerClient struct {
	// TokenURL is the authorization server's token endpoint.
	TokenURL string

	// HTTPClient is the HTTP client to use for requests.
	HTTPClient *http.Client

	// ClientID is the OAuth client identifier.
	ClientID string
}

type ResourceServer struct {
	// Verifier validates incoming access tokens.
	Verifier Verifier
}

type StaticKeyVerifier struct {
	// contains filtered or unexported fields
}

type TokenErrorResponse struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
	ErrorURI         string `json:"error_uri,omitempty"`
}

type TokenExchangeClient struct {
	// TokenURL is the authorization server's token endpoint.
	TokenURL string

	// HTTPClient is the HTTP client to use for requests.
	// If nil, http.DefaultClient is used.
	HTTPClient *http.Client

	// ClientID is the OAuth client identifier.
	// If set, it will be included in the request.
	ClientID string

	// ClientSecret is the OAuth client secret.
	// If set, HTTP Basic authentication will be used.
	ClientSecret string
}

type TokenExchangeRequest struct {
	// SubjectToken is the security token being exchanged (required).
	// For ID-JAG, this is the signed assertion JWT.
	SubjectToken string

	// SubjectTokenType identifies the type of subject token (required).
	// For ID-JAG assertions, use TokenTypeJWT.
	SubjectTokenType string

	// ActorToken is an optional security token representing the actor.
	ActorToken string

	// ActorTokenType identifies the type of actor token (required if ActorToken is set).
	ActorTokenType string

	// RequestedTokenType identifies the type of token being requested.
	// Defaults to TokenTypeAccessToken if not specified.
	RequestedTokenType string

	// Scope is the requested scope for the issued token.
	Scope string

	// Resource is the target resource for the issued token.
	Resource string

	// Audience is the target audience for the issued token.
	Audience string
}

type TokenExchangeResponse struct {
	// AccessToken is the issued security token.
	AccessToken string `json:"access_token"`

	// IssuedTokenType identifies the type of token issued.
	IssuedTokenType string `json:"issued_token_type"`

	// TokenType is typically "Bearer".
	TokenType string `json:"token_type"`

	// ExpiresIn is the lifetime in seconds of the access token.
	ExpiresIn int `json:"expires_in,omitempty"`

	// Scope is the scope of the access token.
	Scope string `json:"scope,omitempty"`

	// RefreshToken is an optional refresh token.
	RefreshToken string `json:"refresh_token,omitempty"`
}

type Verifier interface {
	// Verify validates the JWT and returns the parsed Assertion.
	Verify(ctx context.Context, tokenString string) (*Assertion, error)
}

type VerifierOptions struct {
	// ExpectedIssuer is the required issuer claim value.
	// If empty, issuer is not validated.
	ExpectedIssuer string

	// ExpectedAudience is the required audience claim value.
	// If empty, audience is not validated.
	ExpectedAudience string

	// AllowedAlgorithms restricts which signing algorithms are accepted.
	// If empty, defaults to RS256, RS384, RS512, ES256, ES384, ES512.
	AllowedAlgorithms []string

	// ClockSkew allows for clock differences between systems.
	// Default is 0 (strict timing).
	ClockSkew time.Duration

	// RequireActor requires the assertion to have an actor claim.
	RequireActor bool
}