idjag

type Actor struct {
	// Subject identifies the actor (sub claim within act).
	Subject string `json:"sub"`

	// Issuer optionally identifies who asserted this actor's identity.
	Issuer string `json:"iss,omitempty"`

	// Actor allows for nested delegation chains.
	// For example, User -> Agent1 -> Agent2.
	Actor *Actor `json:"act,omitempty"`
}

type Assertion struct {
	// Issuer identifies the principal that issued the assertion (iss claim).
	Issuer string `json:"iss"`

	// Subject identifies the principal that is the subject of the assertion (sub claim).
	// For direct agent authentication, this is the agent's identity.
	// For delegation, this is the human/principal identity being delegated.
	Subject string `json:"sub"`

	// Audience identifies the recipients that the assertion is intended for (aud claim).
	// Typically includes the authorization server's token endpoint.
	Audience []string `json:"aud"`

	// IssuedAt is the time at which the assertion was issued (iat claim).
	IssuedAt time.Time `json:"iat"`

	// ExpiresAt is the expiration time of the assertion (exp claim).
	ExpiresAt time.Time `json:"exp"`

	// NotBefore is the time before which the assertion is not valid (nbf claim).
	NotBefore time.Time `json:"nbf,omitempty"`

	// JWTID is a unique identifier for the assertion (jti claim).
	JWTID string `json:"jti,omitempty"`

	// Actor identifies the acting party in delegation scenarios (act claim).
	// When present, Subject identifies the delegating principal and Actor
	// identifies the party acting on their behalf.
	Actor *Actor `json:"act,omitempty"`

	// Claims contains additional custom claims not covered by the standard fields.
	Claims map[string]any `json:"-"`
}

type AuthorizationServer struct {
	// Verifier validates incoming assertions.
	Verifier Verifier

	// SigningMethod is the JWT signing method for access tokens.
	SigningMethod jwt.SigningMethod

	// SigningKey is the private key for signing access tokens.
	SigningKey crypto.PrivateKey

	// KeyID is the key identifier to include in token headers.
	KeyID string

	// Issuer is the issuer claim for access tokens.
	Issuer string

	// TokenTTL is the lifetime for issued access tokens.
	TokenTTL time.Duration

	// AllowedScopes restricts which scopes can be requested.
	// If empty, all scopes are allowed.
	AllowedScopes []string

	// ScopeValidator is an optional function to validate scope requests.
	// If set, it is called to validate the requested scope against the assertion.
	ScopeValidator func(assertion *Assertion, requestedScope string) error
}

type JWK struct {
	KeyType   string `json:"kty"`
	KeyID     string `json:"kid"`
	Algorithm string `json:"alg,omitempty"`
	Use       string `json:"use,omitempty"`

	// RSA parameters
	N string `json:"n,omitempty"` // Modulus
	E string `json:"e,omitempty"` // Exponent

	// EC parameters
	Curve string `json:"crv,omitempty"` // Curve name
	X     string `json:"x,omitempty"`   // X coordinate
	Y     string `json:"y,omitempty"`   // Y coordinate
}

type JWKS struct {
	Keys []JWK `json:"keys"`
}

type JWKSHandler struct {
	// contains filtered or unexported fields
}

type JWKSVerifier struct {
	// contains filtered or unexported fields
}

type JWTBearerClient struct {
	// TokenURL is the authorization server's token endpoint.
	TokenURL string

	// HTTPClient is the HTTP client to use for requests.
	HTTPClient *http.Client

	// ClientID is the OAuth client identifier.
	ClientID string
}

type ResourceServer struct {
	// Verifier validates incoming access tokens.
	Verifier Verifier
}

type StaticKeyVerifier struct {
	// contains filtered or unexported fields
}

type TokenErrorResponse struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
	ErrorURI         string `json:"error_uri,omitempty"`
}

type TokenExchangeClient struct {
	// TokenURL is the authorization server's token endpoint.
	TokenURL string

	// HTTPClient is the HTTP client to use for requests.
	// If nil, http.DefaultClient is used.
	HTTPClient *http.Client

	// ClientID is the OAuth client identifier.
	// If set, it will be included in the request.
	ClientID string

	// ClientSecret is the OAuth client secret.
	// If set, HTTP Basic authentication will be used.
	ClientSecret string
}

type TokenExchangeRequest struct {
	// SubjectToken is the security token being exchanged (required).
	// For ID-JAG, this is the signed assertion JWT.
	SubjectToken string

	// SubjectTokenType identifies the type of subject token (required).
	// For ID-JAG assertions, use TokenTypeJWT.
	SubjectTokenType string

	// ActorToken is an optional security token representing the actor.
	ActorToken string

	// ActorTokenType identifies the type of actor token (required if ActorToken is set).
	ActorTokenType string

	// RequestedTokenType identifies the type of token being requested.
	// Defaults to TokenTypeAccessToken if not specified.
	RequestedTokenType string

	// Scope is the requested scope for the issued token.
	Scope string

	// Resource is the target resource for the issued token.
	Resource string

	// Audience is the target audience for the issued token.
	Audience string
}

type TokenExchangeResponse struct {
	// AccessToken is the issued security token.
	AccessToken string `json:"access_token"`

	// IssuedTokenType identifies the type of token issued.
	IssuedTokenType string `json:"issued_token_type"`

	// TokenType is typically "Bearer".
	TokenType string `json:"token_type"`

	// ExpiresIn is the lifetime in seconds of the access token.
	ExpiresIn int `json:"expires_in,omitempty"`

	// Scope is the scope of the access token.
	Scope string `json:"scope,omitempty"`

	// RefreshToken is an optional refresh token.
	RefreshToken string `json:"refresh_token,omitempty"`
}

type Verifier interface {
	// Verify validates the JWT and returns the parsed Assertion.
	Verify(ctx context.Context, tokenString string) (*Assertion, error)
}

type VerifierOptions struct {
	// ExpectedIssuer is the required issuer claim value.
	// If empty, issuer is not validated.
	ExpectedIssuer string

	// ExpectedAudience is the required audience claim value.
	// If empty, audience is not validated.
	ExpectedAudience string

	// AllowedAlgorithms restricts which signing algorithms are accepted.
	// If empty, defaults to RS256, RS384, RS512, ES256, ES384, ES512.
	AllowedAlgorithms []string

	// ClockSkew allows for clock differences between systems.
	// Default is 0 (strict timing).
	ClockSkew time.Duration

	// RequireActor requires the assertion to have an actor claim.
	RequireActor bool
}