identity

type Claims struct {
	// SPIFFEID is spiffe://<trust-domain>/agent-run/<run-id>.
	SPIFFEID string
	RunID    uuid.UUID
	// Sub is the human principal the run acts on behalf of.
	Sub string
	// Sponsor is the accountable human owner (defaults to Sub).
	Sponsor string
	// JTI uniquely identifies this token for revocation/audit join.
	JTI string
	// Audience the token was minted for (RFC 8707 discipline).
	Audience string
	IssuedAt time.Time
	Expiry   time.Time
}

type Constructor func(Deps) (Provider, error)

type Deps struct {
	SigningKey  *ecdsa.PrivateKey // embedded signs with this; nil => generated
	TrustDomain string
	Revocations RevocationStore // kill-switch denylist (pg-backed in production)
	Audit       audit.Recorder
	Options     map[string]string // impl-specific config, from WARDYN_IDENTITY_*
}

type Provider interface {
	// Name returns "embedded" or "spire" — surfaced in UI/audit so the
	// trust boundary is always visible.
	Name() string
	// MintRunIdentity creates the run's identity. audience binds the token.
	MintRunIdentity(ctx context.Context, runID uuid.UUID, humanSub, sponsor, audience string) (RunIdentity, error)
	// Verify authenticates a presented token and returns its claims.
	// Revoked or expired tokens must fail closed.
	Verify(ctx context.Context, token, expectedAudience string) (*Claims, error)
	// RevokeRun invalidates ALL identities for a run (kill-switch cascade).
	RevokeRun(ctx context.Context, runID uuid.UUID) error
}

type RevocationStore interface {
	IsRevoked(ctx context.Context, jti string, runID uuid.UUID) (bool, error)
	RevokeRun(ctx context.Context, runID uuid.UUID) error
	RevokeJTI(ctx context.Context, jti string, runID uuid.UUID) error
}

type RunIdentity struct {
	SPIFFEID string
	// Token is the JWT-SVID (or embedded JWT) presented by sidecars and the
	// in-sandbox credential helper when calling the broker.
	Token  string
	JTI    string
	Expiry time.Time
}