policyserver

type Config struct {
	// CAPublicKey is the CA's SSH public key, used to verify the request-bound
	// JWT (pkg/serviceauth) on every request. Required.
	CAPublicKey sshcert.RawPublicKey

	// Validator validates tokens and extracts identity (authentication).
	Validator *oidc.Validator

	// Evaluator makes authorization decisions based on identity.
	Evaluator PolicyEvaluator

	// Discovery is the configuration returned on GET / requests.
	// The CA fetches this to serve discovery data to clients.
	Discovery *wire.Discovery
}

type OIDCConfig struct {
	Issuer       string `yaml:"issuer" json:"issuer"`
	ClientID     string `yaml:"client_id" json:"client_id"`
	ClientSecret string `yaml:"client_secret,omitempty" json:"client_secret,omitempty"` // Optional, for confidential clients
}

type PolicyEvaluator interface {
	// Evaluate makes an authorization decision for the given identity and connection.
	// The identity has already been extracted from a validated token.
	// tokenExpiry is the auth token's expiry, used to clamp the issued
	// certificate's validity so it can never outlive the auth session that
	// requested it.
	// Returns:
	// - *wire.PolicyResponse: Certificate parameters and policy if authorized
	// - error: If authorization denied
	//
	// Error handling:
	// - Return policyserver.Forbidden (403) if access denied by policy
	// - Return other errors (500) for internal errors
	Evaluate(ctx context.Context, identity string, tokenExpiry time.Time, conn policy.Connection) (*wire.PolicyResponse, error)
}

type ServerConfig struct {
	CAPublicKey string     `yaml:"ca_pubkey" json:"ca_pubkey"`
	OIDC        OIDCConfig `yaml:"oidc" json:"oidc"`
}