iap_request_parser_config

type Config struct {
	// Audience is what the assertion must have been minted for, which names the resource IAP is in
	// front of. For a load balancer it is "/projects/{number}/global/backendServices/{id}", and for
	// App Engine "/projects/{number}/apps/{id}"; BackendServiceAudience builds the first.
	//
	// It is what stops an assertion minted for another service being accepted here. Every
	// deployment behind IAP is issued assertions by the same IAP, signed with the same keys, so the
	// audience is the only thing distinguishing one service's from another's.
	Audience string

	// AllowedEmails are the accounts admitted, where a deployment wants to name them. Empty admits
	// whoever IAP itself admitted, which is the ordinary case: IAP has an access policy, and
	// repeating it here means maintaining it twice.
	AllowedEmails []string

	// AllowedHostedDomains are the Google Workspace domains admitted, read from the hd claim.
	// Empty admits any.
	//
	// A consumer domain has no hd claim at all, so naming a domain here also turns away personal
	// accounts.
	AllowedHostedDomains []string

	// JwkUrl is where the signing keys are published. A nil one is IAP's.
	JwkUrl *url.URL
}

type Option func(*Config)