saml

type Assertion struct {
	// NameID is the subject identifier the IdP assigned.
	NameID string

	// SessionIndex is the IdP's session reference, used for logout.
	SessionIndex string

	// Attributes are the SAML attribute statements: attribute name → list of values.
	Attributes map[string][]string

	// NotBefore is the earliest time this assertion is valid.
	NotBefore time.Time

	// NotOnOrAfter is the time after which this assertion must not be accepted.
	NotOnOrAfter time.Time
}

type Config struct {
	// EntityID is this SP's entity identifier, used as the Issuer in AuthnRequests and as the Audience for
	// AudienceRestriction validation.
	EntityID string

	// ACSPath is the path portion of the Assertion Consumer Service URL where the IdP posts responses.
	ACSPath string

	// IdPMetadataURL is the IdP's metadata endpoint. Used to discover the SSO URL.
	// If IdPSSOURL is set directly, this is not required.
	IdPMetadataURL string

	// IdPSSOURL is the IdP's Single Sign-On URL (HTTP-Redirect binding).
	IdPSSOURL string

	// IdPCertPEM is the PEM-encoded X.509 certificate of the IdP used to verify response signatures.
	// This is the ONLY certificate trusted for verification - never a cert embedded in the response.
	IdPCertPEM string

	// AllowUnsolicited permits a response that answers no request this server issued.
	//
	// Off by default, and the default is the safe one. An unsolicited response is how identity-provider-initiated sign-on works -
	// somebody clicks Perfuse in a portal and arrives already authenticated - so it is a real feature that real sites want. It is
	// also the thing that makes a captured response reusable against a different browser, because nothing ties the response to a
	// login that browser began.
	//
	// Turning it on is therefore a decision with a cost, and it should be made deliberately rather than inherited from a default.
	AllowUnsolicited bool

	// SignRequests indicates whether AuthnRequests should be signed.
	SignRequests bool
}

type FileConfig struct {
	EntityID string `yaml:"entity_id"`
	ACSURL   string `yaml:"acs_url"`

	IdPSSOURL string `yaml:"idp_sso_url"`

	// IdPCertPEM is the certificate inline. Multi-line YAML, usually written with a block scalar.
	IdPCertPEM string `yaml:"idp_cert_pem,omitempty"`

	// IdPCertFile reads the certificate from a separate file.
	//
	// Offered because a certificate is rotated on the identity provider's schedule rather than Perfuse's, and a separate file can be
	// replaced by whatever already manages certificates on the host without editing this one.
	IdPCertFile string `yaml:"idp_cert_file,omitempty"`

	// GroupsAttribute names the assertion attribute carrying group membership.
	//
	// Required, with no default, and that is deliberate. Entra sends "groups", Okta sends whatever the administrator named in the
	// application, ADFS sends a claim URI. A default would be wrong for two of the three and would produce a sign-in that succeeds
	// and grants nobody anything - which reads as a broken product rather than as a setting somebody has not filled in.
	GroupsAttribute string `yaml:"groups_attribute"`

	Label       string `yaml:"label,omitempty"`
	CreateUsers bool   `yaml:"create_users,omitempty"`

	// AllowUnsolicited accepts responses that answer no request this server sent.
	//
	// Off unless written down. It is how a portal tile works, and it is also what lets a response captured anywhere be posted into
	// somebody else's browser, so it is a trade a site should make on purpose.
	AllowUnsolicited bool `yaml:"allow_unsolicited,omitempty"`

	Roles struct {
		Platform      []string `yaml:"platform,omitempty"`
		Admin         []string `yaml:"admin,omitempty"`
		Editor        []string `yaml:"editor,omitempty"`
		Operator      []string `yaml:"operator,omitempty"`
		Viewer        []string `yaml:"viewer,omitempty"`
		Monitor       []string `yaml:"monitor,omitempty"`
		CaseSensitive bool     `yaml:"case_sensitive,omitempty"`

		// ChannelGroups limits a directory group to these channel groups; absent or empty is every channel.
		ChannelGroups map[string][]string `yaml:"channel_groups,omitempty"`
	} `yaml:"roles"`
}

type IDPMetadata struct {
	// EntityID is the provider's own identifier, which every assertion it issues carries as the Issuer.
	EntityID string

	// SSOURL is where a sign-on request is sent, for HTTP-Redirect binding.
	SSOURL string

	// SSOPostURL is the same for HTTP-POST binding, empty when the provider does not offer it.
	SSOPostURL string

	// Certificates are the signing certificates, in document order.
	//
	// More than one is normal and is not a problem to be resolved here: a provider rotating keys publishes both, and an assertion may be
	// signed with either. Keeping them all is what makes a rotation invisible rather than an outage.
	Certificates []*x509.Certificate
}

type ServiceProvider struct {
	// contains filtered or unexported fields
}