authzserver

type DefaultPolicyEvaluator struct {

	// DefaultProtocol is the protocol to use when no policy matches.
	// Default is "aauth" (require human consent for unknown scopes).
	DefaultProtocol string
	// contains filtered or unexported fields
}

type ErrorResponse struct {
	Error       string `json:"error"`
	Description string `json:"error_description,omitempty"`
}

type IntrospectionResponse struct {
	Active    bool   `json:"active"`
	Scope     string `json:"scope,omitempty"`
	ClientID  string `json:"client_id,omitempty"`
	Username  string `json:"username,omitempty"`
	TokenType string `json:"token_type,omitempty"`
	Exp       int64  `json:"exp,omitempty"`
	Iat       int64  `json:"iat,omitempty"`
	Sub       string `json:"sub,omitempty"`
	Aud       string `json:"aud,omitempty"`
	Iss       string `json:"iss,omitempty"`

	// Actor chain for delegation tokens
	Act map[string]any `json:"act,omitempty"`
}

type MultiIssuerVerifier struct {
	// contains filtered or unexported fields
}

type Option func(*Server)

type PolicyDecision struct {
	// Protocol indicates which protocol to use: "idjag" for automated, "aauth" for human consent
	Protocol string `json:"protocol"`

	// InteractionType indicates the required interaction level (for AAuth)
	InteractionType string `json:"interaction_type,omitempty"`

	// AllowedScopes is the list of scopes that can be automatically approved
	AllowedScopes []string `json:"allowed_scopes,omitempty"`

	// RequiredConsentScopes are scopes that require human consent
	RequiredConsentScopes []string `json:"required_consent_scopes,omitempty"`

	// Reason provides context for the decision
	Reason string `json:"reason,omitempty"`
}

type PolicyEvaluator interface {
	// Evaluate determines the authorization protocol for the requested scopes.
	Evaluate(ctx context.Context, agentID string, scopes []string) (*PolicyDecision, error)
}

type ScopePolicy struct {
	ID              string    `json:"id"`
	Pattern         string    `json:"pattern"`
	Protocol        string    `json:"protocol"`
	InteractionType string    `json:"interaction_type,omitempty"`
	Description     string    `json:"description,omitempty"`
	Priority        int       `json:"priority"`
	CreatedAt       time.Time `json:"created_at"`
}

type Server struct {
	// contains filtered or unexported fields
}

type StaticPolicyEvaluator struct {
	// IDJAGScopes are scopes that can be automatically authorized via ID-JAG.
	IDJAGScopes []string

	// AAuthScopes are scopes that require human consent via AAuth.
	AAuthScopes []string

	// DefaultProtocol is used for scopes not in either list.
	DefaultProtocol string
}

type Store interface {
	// Close closes the store.
	Close() error

	// CreateToken stores a new token record.
	CreateToken(ctx context.Context, token *Token) error

	// GetToken retrieves a token by ID.
	GetToken(ctx context.Context, id string) (*Token, error)

	// RevokeToken marks a token as revoked.
	RevokeToken(ctx context.Context, id string) error

	// ListTokens returns all tokens (for admin purposes).
	ListTokens(ctx context.Context) ([]*Token, error)

	// CreateScopePolicy creates a new scope policy.
	CreateScopePolicy(ctx context.Context, policy *ScopePolicy) error

	// GetScopePolicy retrieves a scope policy by ID.
	GetScopePolicy(ctx context.Context, id string) (*ScopePolicy, error)

	// ListScopePolicies returns all scope policies ordered by priority.
	ListScopePolicies(ctx context.Context) ([]*ScopePolicy, error)

	// DeleteScopePolicy removes a scope policy by ID.
	DeleteScopePolicy(ctx context.Context, id string) error
}

type Token struct {
	ID        string     `json:"id"`
	MissionID string     `json:"mission_id,omitempty"`
	AgentID   string     `json:"agent_id"`
	UserID    string     `json:"user_id"`
	Scopes    string     `json:"scopes"`
	TokenType string     `json:"token_type"`
	Protocol  string     `json:"protocol"`
	IssuedAt  time.Time  `json:"issued_at"`
	ExpiresAt time.Time  `json:"expires_at"`
	RevokedAt *time.Time `json:"revoked_at,omitempty"`
}

type TokenExchangeRequest struct {
	GrantType          string `json:"grant_type"`
	SubjectToken       string `json:"subject_token"`
	SubjectTokenType   string `json:"subject_token_type"`
	ActorToken         string `json:"actor_token,omitempty"`
	ActorTokenType     string `json:"actor_token_type,omitempty"`
	RequestedTokenType string `json:"requested_token_type,omitempty"`
	Audience           string `json:"audience,omitempty"`
	Scope              string `json:"scope,omitempty"`
	Resource           string `json:"resource,omitempty"`
}

type TokenResponse struct {
	AccessToken     string `json:"access_token"`
	IssuedTokenType string `json:"issued_token_type,omitempty"`
	TokenType       string `json:"token_type"`
	ExpiresIn       int    `json:"expires_in"`
	Scope           string `json:"scope,omitempty"`
	RefreshToken    string `json:"refresh_token,omitempty"`
}

type VerifierChain struct {
	// contains filtered or unexported fields
}