auth

type ArtifactRegistryCredentials struct {
	Username  string
	Password  string
	ExpiresAt time.Time
}

type Option func(*Options)

type Options struct {
	Client             client.Client
	Cache              *cache.TokenCache
	ServiceAccount     *client.ObjectKey
	InvolvedObject     cache.InvolvedObject
	Scopes             []string
	ArtifactRepository string
	STSEndpoint        string
	ProxyURL           *url.URL
}

type Provider interface {
	// GetName returns the name of the provider.
	GetName() string

	// NewDefaultToken returns a token that can be used to authenticate with the
	// cloud provider retrieved from the default source, i.e. from the pod's
	// environment, e.g. files mounted in the pod, environment variables,
	// local metadata services, etc. In this case the method would implicitly
	// use the ServiceAccount associated with the controller pod, and not one
	// specified in the options.
	NewDefaultToken(ctx context.Context, opts ...Option) (Token, error)

	// GetAudience returns the audience the OIDC tokens issued representing
	// ServiceAccounts should have. This is usually a string that represents
	// the cloud provider's STS service, or some entity in the provider for
	// which the OIDC tokens are targeted to.
	GetAudience(ctx context.Context) (string, error)

	// GetIdentity takes a ServiceAccount and returns the identity which the
	// ServiceAccount wants to impersonate, by looking at annotations.
	GetIdentity(serviceAccount corev1.ServiceAccount) (string, error)

	// NewToken takes a ServiceAccount and its OIDC token and returns a token
	// that can be used to authenticate with the cloud provider. The OIDC token is
	// the JWT token that was issued for the ServiceAccount by the Kubernetes API.
	// The implementation should exchange this token for a cloud provider access
	// token through the provider's STS service.
	NewTokenForServiceAccount(ctx context.Context, oidcToken string,
		serviceAccount corev1.ServiceAccount, opts ...Option) (Token, error)

	// GetArtifactCacheKey extracts the part of the artifact repository that must be
	// included in cache keys when caching registry credentials for the provider.
	GetArtifactCacheKey(artifactRepository string) string

	// NewArtifactRegistryToken takes an artifact repository and an access token and returns a token
	// that can be used to authenticate with the artifact registry of the artifact.
	NewArtifactRegistryToken(ctx context.Context, artifactRepository string,
		accessToken Token, opts ...Option) (Token, error)
}

type Token interface {
	// GetDuration returns the duration for which the token will still be valid
	// relative to approximately time.Now(). This is used to determine when the token should
	// be refreshed.
	GetDuration() time.Duration
}