auth

type AuditLogger interface {
	LogAuth(ctx context.Context, event string, user *UserInfo, r *http.Request, attrs ...slog.Attr)
}

type AuthMetrics struct {
	Latency     *prometheus.HistogramVec // provider, result
	CacheHits   prometheus.Counter
	CacheMisses prometheus.Counter
	Attempts    *prometheus.CounterVec // provider, result
}

type AuthProvider interface {
	Authenticate(ctx context.Context, token string) (*UserInfo, error)
}

type CompositeProvider struct {
	// contains filtered or unexported fields
}

type GitHubProvider struct {
	// contains filtered or unexported fields
}

type GitHubProviderConfig struct {
	// AllowedOrgs restricts access to members of these GitHub organizations.
	// Empty list means all authenticated GitHub users are allowed.
	AllowedOrgs []string
	// AllowedGroups restricts access to users in these groups (org:team format).
	// Applied after session JWT verification.
	AllowedGroups []string
}

type MiddlewareConfig struct {
	Provider       AuthProvider
	Cache          *TokenCache
	Logger         *slog.Logger
	AuditLogger    AuditLogger
	Metrics        *AuthMetrics
	ExemptPaths    []string
	ExemptPrefixes []string
	// LoginURL, when set, is where an unauthenticated BROWSER NAVIGATION is
	// redirected instead of receiving the raw 401 below. A signed-out human
	// loading the dashboard is the routine case — every session expires — and
	// "missing or invalid authorization header" as a bare page is an error
	// message for a state that is not an error. API callers, and anything not
	// asking for text/html, keep the 401 they can act on.
	LoginURL string
}

type OIDCProvider struct {
	// contains filtered or unexported fields
}

type OIDCProviderConfig struct {
	// IssuerURL is the OIDC provider's issuer URL (used for discovery).
	IssuerURL string
	// ClientID is the OIDC client ID for token audience validation.
	ClientID string
	// UsernameClaim is the JWT claim used for the username. Defaults to "preferred_username".
	UsernameClaim string
	// GroupsClaim is the JWT claim used for group membership. Defaults to "groups".
	GroupsClaim string
	// AllowedGroups restricts access to users whose groups intersect this list.
	// Empty list means all authenticated users are allowed.
	AllowedGroups []string
}

type SessionClaims struct {
	Subject  string   `json:"sub"`
	Email    string   `json:"email,omitempty"`
	Groups   []string `json:"groups,omitempty"`
	Issuer   string   `json:"iss"`
	IssuedAt int64    `json:"iat"`
	Expiry   int64    `json:"exp"`
	// Provider tracks which auth method created this session (e.g. "oidc", "github").
	Provider string `json:"provider,omitempty"`
}

type SessionConfig struct {
	// SigningKey is the HMAC-SHA256 key for signing session JWTs.
	SigningKey []byte
	// MaxAge is the session duration. Defaults to 24 hours.
	MaxAge time.Duration
	// Issuer is the JWT issuer claim. Defaults to "diverge-server".
	Issuer string
}

type SessionManager struct {
	// contains filtered or unexported fields
}

type TokenCache struct {
	// contains filtered or unexported fields
}

type TokenReviewProvider struct {
	// contains filtered or unexported fields
}

type UserInfo struct {
	Username string
	UID      string
	Email    string
	Groups   []string
	Extra    map[string]authorizationv1.ExtraValue
}