identity

type Claims struct {
	// SPIFFEID is spiffe://<trust-domain>/agent-run/<run-id>.
	SPIFFEID string
	RunID    uuid.UUID
	// Sub is the human principal the run acts on behalf of.
	Sub string
	// Sponsor is the accountable human owner (defaults to Sub).
	Sponsor string
	// OperatorOwned says the run's owner is the operator itself (admin token, local mode),
	// not a person — decided from what authenticated the request, never from Sub
	// (IdP-spoofable), and signed into the token.
	OperatorOwned bool
	// JTI uniquely identifies this token for revocation/audit join.
	JTI string
	// Audience the token was minted for (RFC 8707 discipline).
	Audience string
	IssuedAt time.Time
	Expiry   time.Time
}

type Constructor func(Deps) (Provider, error)

type Deps struct {
	SigningKey  *ecdsa.PrivateKey // embedded signs with this; nil => generated
	TrustDomain string
	Revocations RevocationStore // kill-switch denylist (pg-backed in production)
	Audit       audit.Recorder
}

type ExpiredTokenError struct {
	RunID uuid.UUID
	Err   error
}

type Provider interface {
	// Name returns "embedded" or "spire" — surfaced in UI/audit so the trust boundary is always visible.
	Name() string
	// MintRunIdentity creates the run's identity; audience binds the token, operatorOwned becomes Claims.OperatorOwned.
	MintRunIdentity(ctx context.Context, runID uuid.UUID, humanSub, sponsor, audience string, operatorOwned bool) (RunIdentity, error)
	// Verify authenticates a presented token and returns its claims; revoked or expired tokens must fail closed.
	Verify(ctx context.Context, token, expectedAudience string) (*Claims, error)
	// RevokeRun invalidates ALL identities for a run (kill-switch cascade).
	RevokeRun(ctx context.Context, runID uuid.UUID) error
}

type RevocationStore interface {
	IsRevoked(ctx context.Context, jti string, runID uuid.UUID) (bool, error)
	RevokeRun(ctx context.Context, runID uuid.UUID) error
	RevokeJTI(ctx context.Context, jti string, runID uuid.UUID) error
}

type RunIdentity struct {
	SPIFFEID string
	// Token is the JWT-SVID (or embedded JWT) presented by sidecars and the in-sandbox credential helper when calling the broker.
	Token  string
	JTI    string
	Expiry time.Time
}