ciauth

type Claims struct {
	// Issuer, Subject, Audience and the lifetime bounds are the parts Verify
	// checked. They are recorded rather than recomputed so an audit entry
	// describes the token that was actually accepted.
	Issuer   string   `json:"iss"`
	Subject  string   `json:"sub"`
	Audience []string `json:"aud"`
	JTI      string   `json:"jti,omitempty"`

	IssuedAt  int64 `json:"iat,omitempty"`
	NotBefore int64 `json:"nbf,omitempty"`
	ExpiresAt int64 `json:"exp,omitempty"`

	// The workload's identity, as GitHub describes it.
	Repository          string `json:"repository,omitempty"`
	RepositoryOwner     string `json:"repository_owner,omitempty"`
	RepositoryVisiblity string `json:"repository_visibility,omitempty"`
	Ref                 string `json:"ref,omitempty"`
	RefType             string `json:"ref_type,omitempty"`
	Workflow            string `json:"workflow,omitempty"`
	WorkflowRef         string `json:"workflow_ref,omitempty"`
	JobWorkflowRef      string `json:"job_workflow_ref,omitempty"`
	Environment         string `json:"environment,omitempty"`
	Actor               string `json:"actor,omitempty"`
	EventName           string `json:"event_name,omitempty"`
	RunID               string `json:"run_id,omitempty"`
	RunAttempt          string `json:"run_attempt,omitempty"`
	RunnerEnvironment   string `json:"runner_environment,omitempty"`
	SHA                 string `json:"sha,omitempty"`

	// All is the decoded payload, for CEL conditions.
	All map[string]any `json:"-"`
}

type GrantPolicy struct {
	// Models is an allowlist of model IDs, matched as globs so
	// "claude-sonnet-*" keeps working across point releases. Empty means the
	// hub's own default allowlist applies; it does not mean "any model".
	Models []string `json:"models,omitempty"`

	// MaxRequests caps how many upstream calls one session may make. Zero
	// uses DefaultMaxRequests.
	MaxRequests int `json:"max_requests,omitempty"`

	// MaxOutputTokens clamps `max_tokens` on every request. Zero means the
	// hub default applies.
	MaxOutputTokens int `json:"max_output_tokens,omitempty"`

	// TTLSeconds is the session lifetime. Zero uses DefaultTTL; values are
	// clamped to [MinTTL, MaxTTL].
	TTLSeconds int `json:"ttl_seconds,omitempty"`
}

type MatchResult struct {
	// Rule is the first rule that admitted the claims, or nil.
	Rule *Rule
	// Considered counts the enabled rules examined.
	Considered int
	// Errors names rules that could not be decided, keyed by rule ID. A rule
	// here neither admitted nor cleanly declined, and the distinction is the
	// whole reason this field exists: "no rule matched" and "your rule reads
	// a claim this token does not have" are different problems.
	Errors map[string]string
}

type Matcher struct {
	// Repository is a glob over the `repository` claim, e.g. "acme/tool" or
	// "acme/*". The owner segment may not contain a wildcard.
	Repository string `json:"repository,omitempty"`

	// Ref is a glob over the `ref` claim, e.g. "refs/heads/main" or
	// "refs/heads/**". A trailing "/**" admits anything strictly below.
	Ref string `json:"ref,omitempty"`

	// Workflow is a glob matched against the workflow's display name (the
	// `workflow` claim), its full reference (`workflow_ref`), or that
	// reference with the trailing "@<ref>" removed. Naming the file is the
	// stronger form: a display name is whatever the workflow file says it is,
	// and anyone who can open a pull request can say it.
	//
	// The third form exists because `workflow_ref` is
	// "owner/name/.github/workflows/x.yml@refs/heads/main" and a glob's `*`
	// does not cross a slash, so the pattern an operator naturally writes —
	// ".../x.yml@*" — would match the ref "main" and not "release/1.2". That
	// is a trap that fails open-looking and closed-behaving, so the path is
	// offered as its own thing to match.
	Workflow string `json:"workflow,omitempty"`

	// Environment is a glob over the `environment` claim. A token only
	// carries one when the job declares an environment, so a rule that sets
	// this never admits a job that did not — which is the point: GitHub
	// environment protection rules are the approval gate this leans on.
	Environment string `json:"environment,omitempty"`

	// Actor is a glob over the `actor` claim: who triggered the run.
	Actor string `json:"actor,omitempty"`

	// EventName is a glob over the `event_name` claim, e.g. "push".
	EventName string `json:"event_name,omitempty"`

	// Condition is a strict-CEL expression over `assertion.<claim>`. See
	// pkg/celmatch for exactly what the dialect accepts.
	Condition string `json:"condition,omitempty"`
}

type Rule struct {
	ID      string `json:"id"`
	Name    string `json:"name"`
	Enabled bool   `json:"enabled"`

	Match  Matcher     `json:"match"`
	Policy GrantPolicy `json:"policy"`

	// Project optionally binds sessions minted under this rule to a cloop
	// project, so the spend shows up against it.
	Project string `json:"project,omitempty"`

	CreatedBy string    `json:"created_by,omitempty"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at,omitempty"`

	// LastMatchedAt is advisory, updated out of band. It is what tells an
	// operator that a rule they were about to delete is still load-bearing.
	LastMatchedAt time.Time `json:"last_matched_at,omitempty"`
	// contains filtered or unexported fields
}

type RuleSet struct {
	// contains filtered or unexported fields
}

type Verifier struct {
	// contains filtered or unexported fields
}

type VerifierConfig struct {
	// Issuer is the OIDC issuer, e.g. GitHubActionsIssuer. Discovery runs at
	// <issuer>/.well-known/openid-configuration.
	Issuer string

	// Audience is the `aud` a token must carry. Required: accepting any
	// audience would let a token a pipeline minted for an unrelated service
	// be replayed here.
	Audience string

	// ClockSkew tolerated on exp/iat/nbf. Zero uses DefaultClockSkew,
	// values are clamped to MaxClockSkew.
	ClockSkew time.Duration

	// Client overrides the HTTP client used for discovery and JWKS. Tests
	// point this at an httptest server; production leaves it nil.
	Client *http.Client

	// Now overrides the clock, for tests.
	Now func() time.Time

	// SharedReplay, when set, is consulted after the in-memory replay check
	// with the token's jti and expiry, and a false answer refuses the token
	// as replayed (Task 20354). Several hub processes may serve one control
	// plane, each with its own memory, and a token refused as a replay by one
	// must not be accepted by the next. An error is not a refusal: the
	// in-memory check already passed, and the token's short life is the
	// defence that holds when the shared one cannot answer.
	SharedReplay func(jti string, expires time.Time) (fresh bool, err error)
}