oidf

type CodeChallengeMethod string

type EntityStatement struct {
	ExpiresAt      int64     `json:"exp"`
	IssuedAt       int64     `json:"iat"`
	Issuer         string    `json:"iss"`
	Subject        string    `json:"sub"`
	AuthorityHints []string  `json:"authority_hints"`
	Jwks           *Jwks     `json:"jwks"`
	Metadata       *Metadata `json:"metadata"`
}

type Error struct {
	Operation        string `json:"operation"`
	ErrorCode        string `json:"error"`
	Description      string `json:"error_description"`
	GematikTimestamp int64  `json:"gematik_timestamp,omitempty"`
	GematikUUID      string `json:"gematik_uuid,omitempty"`
	GematikCode      string `json:"gematik_code,omitempty"`
	// BadDescription captures error_description sent in camelCase ("errorDescription"), which some IDPs
	// return in violation of RFC 6749. parseErrorResponse folds it into Description.
	BadDescription string `json:"errorDescription,omitempty"`
}

type FederationEntity struct {
	Name        string   `yaml:"name,omitempty"`
	Contacts    []string `yaml:"contacts,omitempty"`
	HomepageURI string   `yaml:"homepage_uri,omitempty"`
}

type FederationEntityMetadata struct {
	Name                    string   `json:"name,omitempty"`
	Contacts                []string `json:"contacts,omitempty"`
	HomepageURI             string   `json:"homepage_uri,omitempty"`
	FederationFetchEndpoint string   `json:"federation_fetch_endpoint,omitempty"`
	FederationListEndpoint  string   `json:"federation_list_endpoint,omitempty"`
	IdpListEndpoint         string   `json:"idp_list_endpoint,omitempty"`
}

type IdentityProviderInfo struct {
	Issuer           string   `json:"iss"`
	LogoURI          string   `json:"logo_uri"`
	OrganizationName string   `json:"organization_name"`
	IsPkv            bool     `json:"pkv"`
	UserType         UserType `json:"user_type_supported"`
}

type Jwk struct {
	Key jwk.Key
}

type Jwks struct {
	Keys jwk.Set
}

type KeyConfig struct {
	KeyPEMPath  string         `yaml:"key_pem_path,omitempty"`
	CertPEMPath string         `yaml:"cert_pem_path,omitempty"`
	JWKPath     string         `yaml:"jwk_path,omitempty"`
	JWK         map[string]any `yaml:"jwk,omitempty"`
	Kid         string         `yaml:"kid,omitempty"`
}

type Metadata struct {
	OpenidRelyingParty *OpenIDRelyingPartyMetadata `json:"openid_relying_party,omitempty"`
	OpenidProvider     *OpenIDProviderMetadata     `json:"openid_provider,omitempty"`
	FederationEntity   *FederationEntityMetadata   `json:"federation_entity"`
}

type OpenIDProviderMetadata struct {
	AuthorizationEndpoint                 string   `json:"authorization_endpoint"`
	ClientRegistrationTypesSupported      []string `json:"client_registration_types_supported"`
	GrantTypesSupported                   []string `json:"grant_types_supported"`
	IDTokenEncryptionAlgValuesSupported   []string `json:"id_token_encryption_alg_values_supported"`
	IDTokenEncryptionEncValuesSupported   []string `json:"id_token_encryption_enc_values_supported"`
	IDTokenSigningAlgValuesSupported      []string `json:"id_token_signing_alg_values_supported"`
	Issuer                                string   `json:"issuer"`
	LogoURI                               string   `json:"logo_uri"`
	OrganizationName                      string   `json:"organization_name"`
	PushedAuthorizationRequestEndpoint    string   `json:"pushed_authorization_request_endpoint"`
	RequestAuthenticationMethodsSupported struct {
		Ar  []string `json:"ar"`
		Par []string `json:"par"`
	} `json:"request_authentication_methods_supported"`
	RequirePushedAuthorizationRequests         bool       `json:"require_pushed_authorization_requests"`
	ResponseModesSupported                     []string   `json:"response_modes_supported"`
	ResponseTypesSupported                     []string   `json:"response_types_supported"`
	ScopesSupported                            []string   `json:"scopes_supported"`
	SignedJwksUri                              string     `json:"signed_jwks_uri"`
	SubjectTypesSupported                      []string   `json:"subject_types_supported"`
	TokenEndpoint                              string     `json:"token_endpoint"`
	TokenEndpointAuthMethodsSupported          []string   `json:"token_endpoint_auth_methods_supported"`
	TokenEndpointAuthSigningAlgValuesSupported []string   `json:"token_endpoint_auth_signing_alg_values_supported"`
	UserTypeSupported                          []UserType `json:"user_type_supported"`
}

type OpenIDRelyingPartyMetadata struct {
	SignedJwksUri                      string   `json:"signed_jwks_uri,omitempty"`
	Jwks                               *Jwks    `json:"jwks"`
	OrganizationName                   string   `json:"organization_name"`
	ClientName                         string   `json:"client_name"`
	LogoURI                            string   `json:"logo_uri"`
	RedirectURIs                       []string `json:"redirect_uris"`
	ResponseTypes                      []string `json:"response_types"`
	ClientRegistrationTypes            []string `json:"client_registration_types"`
	GrantTypes                         []string `json:"grant_types"`
	RequirePushedAuthorizationRequests bool     `json:"require_pushed_authorization_requests"`
	TokenEndpointAuthMethod            string   `json:"token_endpoint_auth_method"`
	DefaultACRValues                   []string `json:"default_acr_values"`
	IDTokenSignedResponseAlg           string   `json:"id_token_signed_response_alg"`
	IDTokenEncryptedResponseAlg        string   `json:"id_token_encrypted_response_alg"`
	IDTokenEncryptedResponseEnc        string   `json:"id_token_encrypted_response_enc"`
	Scope                              string   `json:"scope"`
}

type OpenidFederation struct {
	// contains filtered or unexported fields
}

type OpenidProvider struct {
	Issuer string
}

type Option func(*federationOptions)

type RelyingParty struct {
	// contains filtered or unexported fields
}

type RelyingPartyClient struct {
	// contains filtered or unexported fields
}

type RelyingPartyConfig struct {
	BaseDir string `yaml:"-"`

	// Subject is this relying party's entity identifier — its own public URL — and also the entity
	// statement's iss/sub and the OIDF client_id.
	Subject string `yaml:"sub" validate:"required"`

	// FedMasterURL is the federation master. Its trust-anchor signing key is resolved from a built-in table
	// of known gematik masters (see knownFedMasters); set FedMasterJWK to override or for an unlisted master.
	FedMasterURL string `yaml:"fed_master_url" validate:"required"`
	FedMasterJWK *Jwk   `yaml:"fed_master_jwk,omitempty"`

	// SignKey signs the entity statement; EncKey decrypts the JWE id_token; ClientKey authenticates the
	// self_signed_tls_client_auth mTLS calls (its cert_pem_path is required). Each is a KeyConfig.
	SignKey   KeyConfig `yaml:"sign_key" validate:"required"`
	EncKey    KeyConfig `yaml:"enc_key" validate:"required"`
	ClientKey KeyConfig `yaml:"client_key" validate:"required"`

	// RelyingParty + FederationEntity are the deployment-specific entity-statement metadata; the rest is
	// defaulted.
	RelyingParty     RelyingPartyMetadata `yaml:"relying_party" validate:"required"`
	FederationEntity FederationEntity     `yaml:"federation_entity"`

	// Scopes requested from the OpenID provider's authorization endpoint (which identity claims it returns).
	// When empty, defaultOPScopes is used.
	Scopes []string `yaml:"scopes,omitempty"`

	// HTTPClient is the base client for federation and relying-party calls. Not serialized; supplied
	// programmatically. When nil, a client with a default timeout is created. The relying party's
	// authenticated calls layer mutual TLS onto a copy of it.
	HTTPClient *http.Client `yaml:"-"`
}

type RelyingPartyMetadata struct {
	ClientName       string   `yaml:"client_name" validate:"required"`
	RedirectURIs     []string `yaml:"redirect_uris" validate:"required,min=1"`
	OrganizationName string   `yaml:"organization_name,omitempty"`
	LogoURI          string   `yaml:"logo_uri,omitempty"`
	Scope            string   `yaml:"scope,omitempty"`              // default defaultMetadataScope
	DefaultACRValues []string `yaml:"default_acr_values,omitempty"` // default [defaultACRValue]
	SignedJwksURI    string   `yaml:"signed_jwks_uri,omitempty"`
}

type UserType string