policyserver

type Config struct {
	// CAPublicKey is the CA's SSH public key, used to verify the request-bound
	// JWT (pkg/serviceauth) on every request. Required.
	CAPublicKey sshcert.RawPublicKey

	// Validator validates tokens and extracts identity (authentication).
	Validator *oidc.Validator

	// Evaluator makes authorization decisions based on identity.
	Evaluator PolicyEvaluator

	// Discovery is the configuration returned on GET / requests.
	// The CA fetches this to serve discovery data to clients.
	Discovery *wire.Discovery
}

type OIDCConfig struct {
	Issuer       string `yaml:"issuer" json:"issuer"`
	ClientID     string `yaml:"client_id" json:"client_id"`
	ClientSecret string `yaml:"client_secret,omitempty" json:"client_secret,omitempty"` // Optional, for confidential clients
}

type PolicyConfig struct {
	Users    map[string][]string `yaml:"users" json:"users"` // user identity → tags
	Defaults *Rules              `yaml:"defaults,omitempty" json:"defaults,omitempty"`
	Hosts    map[string]*Rules   `yaml:"hosts,omitempty" json:"hosts,omitempty"` // hostname → host rules
}

type PolicyEvaluator interface {
	// Evaluate makes an authorization decision for the given identity and connection.
	// The identity has already been extracted from a validated token.
	// tokenExpiry is the auth token's expiry, used to clamp the issued
	// certificate's validity so it can never outlive the auth session that
	// requested it.
	// Returns:
	// - *wire.PolicyResponse: Certificate parameters and policy if authorized
	// - error: If authorization denied
	//
	// Error handling:
	// - Return policyserver.Forbidden (403) if access denied by policy
	// - Return other errors (500) for internal errors
	Evaluate(ctx context.Context, identity string, tokenExpiry time.Time, conn policy.Connection) (*wire.PolicyResponse, error)
}

type PolicyRulesConfig struct {
	CAPublicKey string              `yaml:"ca_pubkey" json:"ca_pubkey"`
	OIDC        OIDCConfig          `yaml:"oidc" json:"oidc"`
	Users       map[string][]string `yaml:"users" json:"users"` // user identity → tags
	Defaults    *Rules              `yaml:"defaults,omitempty" json:"defaults,omitempty"`
	Hosts       map[string]*Rules   `yaml:"hosts,omitempty" json:"hosts,omitempty"` // hostname → host rules
}

type Rules struct {
	Allow      map[string][]string `yaml:"allow,omitempty" json:"allow,omitempty"`           // principal → allowed tags
	Expiration string              `yaml:"expiration,omitempty" json:"expiration,omitempty"` // Cert expiration (e.g., "5m")
	Extensions map[string]string   `yaml:"extensions,omitempty" json:"extensions,omitempty"` // Cert extensions
}

type ServerConfig struct {
	CAPublicKey string     `yaml:"ca_pubkey" json:"ca_pubkey"`
	OIDC        OIDCConfig `yaml:"oidc" json:"oidc"`
}