authorization

type Authorization interface {
	IsAuthorized() bool
	EnvVars() sys.EnvVars
	Flow() configuration.FlowName
	Remote() net.Remote
	FindSession() session.Session
	FindSessionsPublicKey() ssh.PublicKey
	Dispose(context.Context) (bool, error)
}

type AuthorizationEvidence struct {
	Schema string                      `json:"schema"`
	Origin AuthorizationEvidenceOrigin `json:"origin"`
	Hops   []AuthorizationEvidenceHop  `json:"hops"`
}

type AuthorizationEvidenceHop struct {
	CaFingerprint          string    `json:"caFingerprint"`
	SubjectKeyFingerprint  string    `json:"subjectKeyFingerprint"`
	Serial                 uint64    `json:"serial"`
	KeyId                  string    `json:"keyId"`
	SessionId              string    `json:"sessionId"`
	Flow                   string    `json:"flow"`
	AuthorizationKind      string    `json:"authorizationKind"`
	Audience               string    `json:"audience,omitempty"`
	TargetUser             string    `json:"targetUser"`
	IssuedAt               time.Time `json:"issuedAt"`
	ValidAfter             time.Time `json:"validAfter"`
	ValidBefore            time.Time `json:"validBefore"`
	PtyAllowed             bool      `json:"ptyAllowed"`
	PortForwardingAllowed  bool      `json:"portForwardingAllowed"`
	AgentForwardingAllowed bool      `json:"agentForwardingAllowed"`
}

type AuthorizationEvidenceOrigin struct {
	User              string `json:"user"`
	Host              string `json:"host"`
	AuthorizationKind string `json:"authorizationKind"`
}

type AuthorizationEvidencePolicy struct {
	PtyAllowed             bool `json:"ptyAllowed"`
	PortForwardingAllowed  bool `json:"portForwardingAllowed"`
	AgentForwardingAllowed bool `json:"agentForwardingAllowed"`
}

type AuthorizationEvidenceProvider interface {
	AuthorizationEvidence() *AuthorizationEvidence
}

type AuthorizedKeyPolicy struct {
	ForcedCommand          *string
	Environment            sys.EnvVars
	PtyAllowed             bool
	PortForwardingAllowed  bool
	AgentForwardingAllowed bool
	// contains filtered or unexported fields
}

type Authorizer interface {
	AuthorizePublicKey(PublicKeyRequest) (Authorization, error)
	AuthorizePassword(PasswordRequest) (Authorization, error)
	AuthorizeInteractive(InteractiveRequest) (Authorization, error)

	// RestoreFromSession tries to restore the existing authorization from the given
	// session.Session. If the given session does not contain enough information to restore
	// the Authorization ErrNoSuchAuthorization is returned.
	RestoreFromSession(context.Context, session.Session, *RestoreOpts) (Authorization, error)
}

type AuthorizerFacade struct {
	// contains filtered or unexported fields
}

type AuthorizerFactory[C any, A CloseableAuthorizer] func(ctx context.Context, flow configuration.FlowName, conf C) (A, error)

type BifroestAuthorization struct {
	// contains filtered or unexported fields
}

type BifroestAuthorizer struct {
	// contains filtered or unexported fields
}

type CloseableAuthorizer interface {
	Authorizer
	io.Closer
}

type ContextEnabled interface {
	Context() essh.Context
}

type FlowAuthorizationMethod string

type FlowAuthorizationObservation struct {
	Flow              configuration.FlowName
	ConnectionId      string
	SessionId         string
	Method            FlowAuthorizationMethod
	Phase             FlowAuthorizationPhase
	Outcome           FlowAuthorizationOutcome
	AuthorizationKind string
	Err               error
}

type FlowAuthorizationObserver func(context.Context, FlowAuthorizationObservation) error

type FlowAuthorizationOutcome string

type FlowAuthorizationPhase string

type HtpasswdAuthorizer struct {
	Logger log.Logger
	// contains filtered or unexported fields
}

type InteractiveRequest interface {
	Request
	SendInfo(string) error
	SendError(string) error
	Prompt(msg string, echoOn bool) (string, error)
}

type LocalAuthorizer struct {
	Logger log.Logger
	// contains filtered or unexported fields
}

type NoneAuthorizer struct {
	Logger log.Logger
	// contains filtered or unexported fields
}

type OidcDeviceAuthAuthorizer struct {
	Logger       log.Logger
	OnVerified   func(session.Session, time.Time)
	OnLostAccess func(session.Session)
	// contains filtered or unexported fields
}

type OidcIdToken struct {
	*coidc.IDToken
	// contains filtered or unexported fields
}

type OidcToken struct {
	*oauth2.Token
}

type OidcUserInfo struct {
	*coidc.UserInfo
	// contains filtered or unexported fields
}

type PasswordRequest interface {
	Request
	RemotePassword() string
}

type PublicKeyRequest interface {
	Request
	RemotePublicKey() gossh.PublicKey
}

type Request interface {
	Sessions() session.Repository
	Connection() connection.Connection
	Context() essh.Context
	Validate(Authorization) (bool, error)
}

type RestoreOpts struct {
	// AutoCleanUpAllowed tells the Authorizer to clean up everything
	// automatically while executing the search. The requester will never
	// see the requested result. This is false by default because it could
	// lead to quite performance impacts or other unwanted side effects.
	//
	// Therefore: Use with caution.
	AutoCleanUpAllowed *bool

	// Logger will be used (if any log is required) instead of the standard logger.
	Logger log.Logger
}

type SimpleAuthorizer struct {
	Logger log.Logger
	// contains filtered or unexported fields
}