tts

type Config struct {
	// TrustDomain is the trust domain identifier, used as the `aud` claim in TxTokens.
	TrustDomain string `yaml:"trustDomain"`
	// Issuer is the TTS issuer URI, used as the `iss` claim in TxTokens.
	Issuer string `yaml:"issuer"`
	// SubjectTokens is an ordered list of JWT authenticators for subject token validation.
	SubjectTokens []authn.AuthenticatorConfig `yaml:"subjectTokens"`
	// Defaults contains default token settings.
	Defaults TokenDefaults `yaml:"defaults"`
}

type ErrorResponse struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type Handler struct {
	// contains filtered or unexported fields
}

type IssuanceContext struct {
	Subject    string
	Scope      string
	Tctx       map[string]any
	Rctx       map[string]any
	Workload   string
	WorkloadNS string
}

type IssuanceDeniedError struct {
	RuleName string
	Message  string
}

type IssuanceRule struct {
	Name string
	// contains filtered or unexported fields
}

type IssuanceRuleConfig struct {
	Name    string `json:"name" yaml:"name"`
	CEL     string `json:"cel" yaml:"cel"`
	Message string `json:"message" yaml:"message"`
}

type Server struct {
	// contains filtered or unexported fields
}

type TokenDefaults struct {
	// TokenLifetime is the default TxToken lifetime (e.g., "15s").
	TokenLifetime string `yaml:"tokenLifetime"`
	// KeySize is the RSA key size in bits (e.g., 2048).
	KeySize int `yaml:"keySize"`
}

type TokenExchangeRequest struct {
	GrantType          string
	SubjectToken       string
	SubjectTokenType   string
	RequestedTokenType string
	Audience           string
	Scope              string
	RequestDetails     map[string]any // becomes tctx
	RequestContext     map[string]any // becomes rctx
}

type TokenExchangeResponse struct {
	AccessToken     string `json:"access_token"`
	IssuedTokenType string `json:"issued_token_type"`
	TokenType       string `json:"token_type"`
}