auth

type ArtifactRegistryCredentials struct {
	authn.Authenticator
	ExpiresAt time.Time
}

type ArtifactRegistryCredentialsProvider interface {
	Provider

	// GetAccessCredentialOptionsForArtifactRepository returns the options that must be
	// passed to the provider to retrieve access credentials for an artifact repository.
	GetAccessCredentialOptionsForArtifactRepository(artifactRepository string,
		opts ...Option) ([]Option, error)

	// ParseArtifactRepository parses the artifact repository to verify
	// it's a valid repository for the provider. As a result, it returns
	// the input required for the provider to issue registry credentials.
	// This input is included in the cache key for the issued credentials.
	ParseArtifactRepository(artifactRepository string) (string, error)

	// NewArtifactRegistryCredentials takes the registry input extracted by
	// ParseArtifactRepository() and an access credential and returns
	// credentials that can be used to authenticate with the registry.
	NewArtifactRegistryCredentials(ctx context.Context, registryInput string,
		accessCredential Credential, opts ...Option) (*ArtifactRegistryCredentials, error)
}

type Credential interface {
	// GetDuration returns the duration for which the credential will still be
	// valid relative to approximately time.Now(). This is used to determine
	// when the credential should be renewed.
	GetDuration() time.Duration
}

type GitCredentials struct {
	BearerToken string
	Username    string
	Password    string
	ExpiresAt   time.Time
}

type GitCredentialsProvider interface {
	Provider

	// GetAccessCredentialOptionsForGitRepository returns the options that must be
	// passed to the provider to retrieve access credentials for the given Git
	// repository URL.
	GetAccessCredentialOptionsForGitRepository(gitURL *url.URL) ([]Option, error)

	// ParseGitRepository parses the given Git repository URL to verify
	// it's a valid repository URL for the provider. As a result it returns
	// an opaque per-repository input required for issuing Git credentials.
	// This input is included in the cache key for the issued credentials,
	// which is critical for providers whose credentials depend on the URL
	// (e.g. AWS CodeCommit, whose credentials are a SigV4 signature over
	// the request URL).
	ParseGitRepository(gitURL *url.URL) (string, error)

	// NewGitCredentials takes the input extracted by ParseGitRepository()
	// and an access credential and returns credentials that can be used to
	// authenticate against the Git repository.
	NewGitCredentials(ctx context.Context, gitInput string,
		accessCredential Credential, opts ...Option) (*GitCredentials, error)
}

type JWTCredential struct {
	// Provider is the credential provider that minted the JWT, e.g.
	// `kubernetes` or `spiffe`.
	Provider string
	// Token is the serialized JWT.
	Token string
	// ExpiresAt is the expiration time extracted from the JWT.
	ExpiresAt time.Time
}

type ObjectReference struct {
	APIGroup  string
	Kind      string
	Name      string
	Namespace string
	UID       string
}

type Option func(*Options)

type Options struct {
	Client       client.Client
	Cache        *cache.TokenCache
	SPIFFEBroker broker.Interface

	// Object entitled to the identity.
	ObjectReference ObjectReference

	// Object involved in the operation, i.e. the object using the identity.
	// It is used for cache entries.
	InvolvedObjectReference ObjectReference
	CacheOperation          string

	// ServiceAccount for object-level workload identity.
	ServiceAccountName string

	// Credential acquisition.
	CredentialProvider   string
	CredentialType       string
	CredentialExpiration time.Duration
	CredentialUsername   string
	CredentialAudiences  []string

	// Request configuration.
	Scopes        []string
	ProxyURL      *url.URL
	GitURL        *url.URL
	AllowShellOut bool

	// Remote Kubernetes cluster connection.
	ClusterResource string
	ClusterAddress  string
	CAData          string

	// AWS.
	AWSRoleARN     string
	AWSRegion      string
	AWSSTSEndpoint string
	AWSClusterName string

	// Azure.
	AzureTenantID       string
	AzureClientID       string
	AzureSubscriptionID string
	AzureResourceGroup  string
	AzureClusterName    string

	// GCP.
	GCPWorkloadIdentityProvider string
	GCPServiceAccount           string

	// Docker Hub.
	DockerHubOIDCConnectionID string
}

type Provider interface {
	// GetName returns the name of the cloud provider.
	GetName() string

	// NewControllerToken returns a credential that can be used to authenticate
	// with the cloud provider retrieved from the default source, i.e. from
	// the environment of the controller pod, e.g. files mounted in the pod,
	// environment variables, local metadata services, etc.
	NewControllerToken(ctx context.Context, opts ...Option) (Credential, error)

	// GetAudiences returns the audiences the OIDC tokens issued by the
	// credential provider should have. These are usually strings that represent
	// the cloud provider's STS service, or some entity in the provider for
	// which the OIDC tokens are targeted to. The provider decides whether any
	// caller-provided credential audiences are used.
	GetAudiences(ctx context.Context, opts ...Option) ([]string, error)

	// GetIdentity returns the identity which the ServiceAccount wants to
	// impersonate, as configured in the options.
	GetIdentity(opts ...Option) (string, error)

	// NewAccessCredentialForIdentity takes the identity credential and
	// returns a credential that can be used to authenticate with the cloud
	// provider. The implementation should exchange this credential for a
	// cloud provider access credential through the provider's STS service.
	NewAccessCredentialForIdentity(ctx context.Context, identity Credential, opts ...Option) (Credential, error)
}

type RESTConfig struct {
	Host        string
	BearerToken string
	CAData      []byte
	ExpiresAt   time.Time
}

type RESTConfigProvider interface {
	Provider

	// GetAccessCredentialOptionsForCluster returns the options that must be
	// passed to the provider to retrieve access credentials for a cluster.
	// More than one access credential may be required depending on the
	// provider, with different options (e.g. scope). Hence the return
	// type is a slice of []Option.
	GetAccessCredentialOptionsForCluster(opts ...Option) ([][]Option, error)

	// NewRESTConfig returns a new RESTConfig that can be used to authenticate
	// with the Kubernetes API server. The access credentials are used for
	// looking up connection details like the API server address and CA
	// certificate data, and for accessing the cluster API server itself via
	// the IAM system of the cloud provider. If it's just a single credential
	// or multiple, it depends on the provider.
	NewRESTConfig(ctx context.Context, accessCredentials []Credential, opts ...Option) (*RESTConfig, error)
}