jwt

type ClientRoles struct {
	Roles []string `json:"roles"`
}

type ExtractToken func(r *echo.Context) string

type Identity struct {
	// Subject is the Keycloak sub claim: the user id for a human, the
	// service-account user's UUID for a service. Never a service name - use
	// ClientID or Actor() for that.
	Subject string

	// Email is set for humans only.
	Email string

	// ClientID is the calling service's Keycloak client id, set only for a
	// client_credentials (service account) token. Empty for a human.
	ClientID string

	// Audience is the client id this token was accepted for, which is also the
	// key its roles were read from.
	Audience string

	// Roles are the caller's roles on Audience, without the hierarchy applied.
	Roles []string
}

type KeycloakClaims struct {
	Email          string                 `json:"email"`
	ResourceAccess map[string]ClientRoles `json:"resource_access"`

	// ClientID is the client_credentials marker: set for a service account,
	// absent for a human. Added by the service_account client scope.
	ClientID string `json:"client_id"`

	// PreferredUsername is service-account-<client-id> for a service account.
	// Fallback for a realm whose service_account scope lacks the client_id
	// mapper.
	PreferredUsername string `json:"preferred_username"`
}

type MiddlewareOptions[Claims any] struct {
	TokenVerifier Verifier

	// ExtractToken extracts the raw token from the request.
	// If not defined, it will fall back to ExtractTokenFromAuthorizationHeader
	ExtractToken ExtractToken

	UpdateContext func(c *echo.Context, token jwt.Token, claims Claims) error
}

type Token = jwt.Token

type TokenVerifier struct {
	Close context.CancelFunc
	// contains filtered or unexported fields
}

type Verifier interface {
	// Verify parses & verifies the token.
	Verify(ctx context.Context, rawToken string) (jwt.Token, error)
}