robotaccount

type Builder struct {
	// contains filtered or unexported fields
}

type Claims struct {
	jwt.RegisteredClaims
	Role           Role   `json:"role"`      // either downloader or uploader
	StoredSecretID string `json:"secret-id"` // path to the OCI secret in the vault
	BackendType    string `json:"backend"`   // backend to use, i.e OCI
	MaxBytes       int64  `json:"maxbytes"`  // max bytes to upload
	// OrgID identifies the authenticated org this token was minted for.
	// Managed providers (e.g. AWS-S3-ACCESS-POINT) require it to scope
	// per-tenant STS sessions; the non-managed providers ignore it but
	// it is still carried for audit traceability.
	OrgID string `json:"org-id"`
	// SourceInternal is true when the token was minted for the control plane's
	// own CAS client (e.g. attestation storage, policy material reads).
	// The CAS skips audit event emission for this traffic so it doesn't
	// pollute per-org usage numbers. The zero value (false) means client traffic.
	SourceInternal bool `json:"source-internal,omitempty"`
}

type GenerateOpt func(c *Claims)

type NewOpt func(b *Builder) error

type Role string