smartauth

type Client struct {
	ID   string `yaml:"id"`
	Name string `yaml:"name"`
	Kind string `yaml:"kind"`
	// Scopes are the most this client may be granted, matched exactly; one ending in * covers every scope beginning with
	// what comes before it ("system/*" covers every system scope).
	Scopes []string `yaml:"scopes"`
	// JWKSURI or JWKS hold the client's public keys, for backend and asymmetric clients.
	JWKSURI string         `yaml:"jwks_uri"`
	JWKS    map[string]any `yaml:"jwks"`
	// SecretHash is HashPassword's output for a symmetric client's secret; the secret itself is never stored.
	SecretHash   string   `yaml:"secret_hash"`
	RedirectURIs []string `yaml:"redirect_uris"`
	LaunchURL    string   `yaml:"launch_url"`
	// DaVinciVersion is the release of the Da Vinci guides (CRD, DTR, PAS) this client speaks, "2.1" or "2.2", when the
	// requests it sends do not say; empty leaves it to the server's -davinci-version.
	DaVinciVersion string `yaml:"davinci_version"`
	// contains filtered or unexported fields
}

type Clients map[string]*Client

type Grants interface {
	Put(ctx context.Context, kind, key string, data []byte, expires time.Time) error
	Get(ctx context.Context, kind, key string, now time.Time) ([]byte, bool, error)
	// Take reads and removes, atomically: a code or launch id works once.
	Take(ctx context.Context, kind, key string, now time.Time) ([]byte, bool, error)
	// Claim stores a key only if no live one is there, reporting whether it did: an assertion id is used once even when two
	// requests race with it.
	Claim(ctx context.Context, kind, key string, expires, now time.Time) (bool, error)
	Delete(ctx context.Context, kind, key string) error
	Prune(ctx context.Context, now time.Time) error
}

type Key struct {

	// ID is the key's JWK thumbprint (RFC 7638), so a token names the key it was signed with and a rotated key is told apart.
	ID string
	// contains filtered or unexported fields
}

type MemoryGrants struct {
	// contains filtered or unexported fields
}

type PatientChoice struct {
	ID, Name, BirthDate string
}

type Server struct {
	// Issuer is this server's identifier, the iss of every token: the public URL of its base, such as https://host/auth.
	Issuer string
	// Audience is the FHIR base the tokens are for.
	Audience string
	Key      *Key
	Clients  Clients
	Now      func() time.Time

	// Users sign in to authorize apps; without any, only backend clients get tokens.
	Users Users
	// Patients lists patients a clinician may pick, matching a search text; PatientExists checks a pick.
	Patients      func(ctx context.Context, search string) ([]PatientChoice, error)
	PatientExists func(ctx context.Context, id string) bool

	// Upstream, when set, offers sign-in at the organisation's identity provider beside the password.
	Upstream *Upstream

	// Grants keeps codes, refresh tokens, revocations, used assertion ids and launch ids; in memory when nil.
	Grants Grants
	// contains filtered or unexported fields
}

type Upstream struct {
	// Label is the button's text: "Sign in with <Label>".
	Label        string
	ClientID     string
	ClientSecret string
	Scopes       []string
	Provider     *oidc.Provider
	Keys         *oidc.KeySet
	// HTTP is the client for the token exchange; nil for the default.
	HTTP *http.Client
}

type UpstreamFile struct {
	Issuer           string   `yaml:"issuer"`
	ClientID         string   `yaml:"client_id"`
	ClientSecretFile string   `yaml:"client_secret_file"`
	ClientSecretEnv  string   `yaml:"client_secret_env"`
	Label            string   `yaml:"label"`
	Scopes           []string `yaml:"scopes"`
}

type User struct {
	Username string `yaml:"username"`
	Name     string `yaml:"name"`
	// PasswordHash is perfuse smart hash's output; the password itself is never stored.
	PasswordHash string `yaml:"password_hash"`
	// FHIRUser is the FHIR resource the person is, Patient/123 or Practitioner/456. A Patient user only ever gets their own
	// record, whatever scopes an app asks for.
	FHIRUser string `yaml:"fhir_user"`
	// OIDCSubject links the person to their account at the upstream identity provider (-smart-oidc): the ID token's sub,
	// which is stable, never an email that can be reassigned. Either this or a password_hash is needed.
	OIDCSubject string `yaml:"oidc_subject,omitempty"`
}

type Users map[string]*User