issuer

type Config struct {
	// Name identifies the issuer inside Dexaflow. Its users are linked by
	// (Provider(), subject), so it must stay stable once users exist.
	Name string
	// Issuer is the exact `iss` the tokens carry.
	Issuer string
	// JWKSURL is where the issuer publishes its public signing keys.
	JWKSURL string
	// Audience is the `aud` the tokens must carry for this Dexaflow.
	Audience string
	// TenantClaim names the string claim carrying the Dexaflow tenant name.
	TenantClaim string
	// AllowedTenants lists the tenants this issuer may sign in to; "*" allows
	// every tenant.
	AllowedTenants []string
	// MaxLifetime caps exp - iat; zero means DefaultMaxLifetime.
	MaxLifetime time.Duration
	// BearerAudiences are the `aud` values of tokens accepted as a bearer on
	// every request (VerifyBearer). Empty turns the bearer mode off. They must
	// differ from Audience, so a handoff token is never a bearer.
	BearerAudiences []string
	// BearerMaxLifetime caps exp - iat of a bearer; zero means
	// DefaultBearerMaxLifetime.
	BearerMaxLifetime time.Duration
	// DeployAudience is the `aud` of the bearers that may deploy when the
	// operator makes the issuer the only way to deploy (#1773). It is a
	// bearer audience of its own, accepted even when BearerAudiences is
	// empty, and VerifyBearer marks a token whose aud is it alone
	// (Identity.DeployAudience).
	// Empty means no deploy audience.
	DeployAudience string
}

type Identity struct {
	Subject string
	Email   string
	Tenant  string
	// Scopes are a bearer token's OAuth scopes (ADR 0067); nil for a handoff
	// token, whose session is not scoped.
	Scopes []string
	// DeployAudience is true for a bearer whose `aud` is Config.DeployAudience
	// alone (#1773); a token that also names another audience is not one. It says where the token was minted for,
	// not what it may do: its scopes still decide that.
	DeployAudience bool
}

type Verifier struct {
	// contains filtered or unexported fields
}