tokenbroker

type AuditEntry struct {
	TokenID    string
	IssuedTo   UserID
	Delegator  UserID // service identity for delegated issuance; empty otherwise
	Channels   []string
	ExpiresAt  time.Time
	IssuedAt   time.Time
	RemoteAddr string
}

type AuditLogger interface {
	Audit(ctx context.Context, entry AuditEntry)
}

type AuditLoggerFunc func(ctx context.Context, entry AuditEntry)

type AuthDecision struct {
	Granted []string        `json:"granted"`
	Denied  []DeniedChannel `json:"denied,omitempty"`
}

type Authenticator interface {
	Authenticate(ctx context.Context, bearer string) (UserID, error)
}

type AuthenticatorFunc func(ctx context.Context, bearer string) (UserID, error)

type Authorizer interface {
	Authorize(ctx context.Context, user UserID, channels []string) AuthDecision
}

type AuthorizerFunc func(ctx context.Context, user UserID, channels []string) AuthDecision

type Broker struct {
	// contains filtered or unexported fields
}

type DelegateRequest struct {
	OnBehalfOf      string   `json:"on_behalf_of"`
	Channels        []string `json:"channels"`
	LifetimeSeconds int      `json:"lifetime_seconds,omitempty"`
}

type DeniedChannel struct {
	Channel string `json:"channel"`
	Reason  string `json:"reason"`
}

type IssueRequest struct {
	Channels []string      `json:"channels"`
	TTL      time.Duration `json:"ttl,omitempty"`
}

type IssueResponse struct {
	Token           string          `json:"token"`
	TokenID         string          `json:"token_id"`
	ExpiresAt       time.Time       `json:"expires_at"`
	ChannelsGranted []string        `json:"channels_granted"`
	ChannelsDenied  []DeniedChannel `json:"channels_denied,omitempty"`
}

type MemoryRevocations struct {
	// contains filtered or unexported fields
}

type Options struct {
	Issuer        *auth.Issuer
	Authorizer    Authorizer
	Authenticator Authenticator
	Revocations   RevocationStore
	// DefaultTTL is the access-token TTL when the caller did not
	// specify one. Zero falls back to auth.Issuer's own AccessTTL.
	DefaultTTL time.Duration
	// AuditLog, when non-nil, receives one entry per successful issuance.
	AuditLog AuditLogger
	// DelegateAuthorizer, when non-nil, gates /parsec/token/delegate.
	// The service identity is the bearer's UserID; the function returns
	// nil if the service is allowed to act on behalf of the target user.
	DelegateAuthorizer func(ctx context.Context, service UserID, onBehalfOf UserID) error
}

type RevocationStore interface {
	Revoke(ctx context.Context, tokenID, userID, reason string) error
	IsRevoked(ctx context.Context, tokenID string) (bool, error)
	RevokeAllForUser(ctx context.Context, userID string) error
	IsUserRevoked(ctx context.Context, userID string, issuedAt time.Time) (bool, error)
}

type RevokeRequest struct {
	TokenID string `json:"token_id,omitempty"`
	UserID  string `json:"user_id,omitempty"`
	Reason  string `json:"reason,omitempty"`
}

type RoleAuthorizer struct {
	UserRoles    func(ctx context.Context, user UserID) []string
	RolePatterns map[string][]string
}

type UserID string