security

const (
	// DefaultMaxRegistrationsPerHour is the default limit for client registrations per IP per hour
	DefaultMaxRegistrationsPerHour = 10

	// DefaultRegistrationWindow is the default time window for rate limiting (1 hour)
	DefaultRegistrationWindow = time.Hour

	// DefaultRegistrationCleanupInterval is how often the cleanup goroutine runs
	DefaultRegistrationCleanupInterval = 15 * time.Minute

	// DefaultMaxRegistrationEntries is the maximum number of IPs to track
	DefaultMaxRegistrationEntries = 10000
)

const (

	// EventTokenIssued is logged when a new access token is issued to a client
	EventTokenIssued = "token_issued"

	// EventTokenRefreshed is logged when an access token is refreshed using a refresh token
	EventTokenRefreshed = "token_refreshed"

	// EventTokenProactivelyRefreshed is logged when a token is proactively refreshed before expiry
	EventTokenProactivelyRefreshed = "token_proactively_refreshed"

	// EventTokenRevoked is logged when a token is revoked by the user or client
	EventTokenRevoked = "token_revoked"

	// EventAllTokensRevoked is logged when all tokens for a user are revoked
	EventAllTokensRevoked = "all_tokens_revoked" //nolint:gosec // G101: False positive - this is an event type name, not a credential

	// EventAuthorizationFlowStarted is logged when an authorization flow is initiated
	EventAuthorizationFlowStarted = "authorization_flow_started"

	// EventAuthorizationCodeIssued is logged when an authorization code is issued
	EventAuthorizationCodeIssued = "authorization_code_issued"

	// EventAuthorizationCodeReuseDetected is logged when an authorization code is reused (attack)
	EventAuthorizationCodeReuseDetected = "authorization_code_reuse_detected"

	// EventClientRegistered is logged when a new OAuth client is registered
	EventClientRegistered = "client_registered"

	// EventClientRegisteredViaTrustedScheme is logged when a client is registered without a token
	// because it uses only trusted custom URI schemes (e.g., cursor://, vscode://).
	// This enables compatibility with MCP clients that don't support registration tokens.
	EventClientRegisteredViaTrustedScheme = "client_registered_via_trusted_scheme"

	// EventClientRegisteredViaTrustedRedirectURI is logged when a client is registered without a token
	// because every redirect_uri matches the TrustedPublicRegistrationRedirectURIs allowlist.
	EventClientRegisteredViaTrustedRedirectURI = "client_registered_via_trusted_redirect_uri"

	// EventClientRegistrationRejected is logged when client registration is rejected for security reasons
	EventClientRegistrationRejected = "client_registration_rejected"

	// EventClientRegistrationRateLimitExceeded is logged when client registration rate limit is exceeded
	EventClientRegistrationRateLimitExceeded = "client_registration_rate_limit_exceeded"

	// EventAuthFailure is logged when authentication fails (wrong credentials, etc.)
	EventAuthFailure = "auth_failure"

	// EventRateLimitExceeded is logged when a rate limit is exceeded
	EventRateLimitExceeded = "rate_limit_exceeded"

	// EventInvalidPKCE is logged when PKCE validation fails
	EventInvalidPKCE = "invalid_pkce"

	// EventPKCEValidationFailed is logged when PKCE code_verifier validation fails
	EventPKCEValidationFailed = "pkce_validation_failed"

	// EventPKCERequiredForPublicClient is logged when a public client attempts flow without PKCE
	EventPKCERequiredForPublicClient = "pkce_required_for_public_client"

	// EventInsecurePublicClientWithoutPKCE is logged when insecure flow is attempted
	EventInsecurePublicClientWithoutPKCE = "insecure_public_client_without_pkce"

	// EventTokenReuseDetected is logged when refresh token reuse is detected (theft)
	EventTokenReuseDetected = "token_reuse_detected" //nolint:gosec // G101: False positive - this is an event type name, not a credential

	// EventRefreshTokenReuseDetected is logged when a refresh token is reused in the same family
	EventRefreshTokenReuseDetected = "refresh_token_reuse_detected"

	// EventRefreshTokenMissingClientBinding is logged when a refresh token lacks client binding
	// This may occur for legacy tokens issued before OAuth 2.1 client binding was implemented
	EventRefreshTokenMissingClientBinding = "refresh_token_missing_client_binding"

	// EventRefreshTokenClientBindingMismatch is logged when the requesting client doesn't match
	// the client that was originally issued the refresh token (OAuth 2.1 Section 6 violation)
	// This is a critical security event indicating possible cross-client token theft
	EventRefreshTokenClientBindingMismatch = "refresh_token_client_binding_mismatch"

	// EventRefreshTokenFamilyRevoked is logged when an entire refresh token family is revoked
	// during explicit token revocation (all tokens sharing the same family ID become invalid)
	EventRefreshTokenFamilyRevoked = "refresh_token_family_revoked"

	// EventRevokedTokenFamilyReuseAttempt is logged when a revoked token family is accessed
	EventRevokedTokenFamilyReuseAttempt = "revoked_token_family_reuse_attempt"

	// EventSuspiciousActivity is logged for general suspicious behavior
	EventSuspiciousActivity = "suspicious_activity"

	// EventInvalidRedirect is logged when an invalid redirect URI is used
	EventInvalidRedirect = "invalid_redirect"

	// EventScopeEscalationAttempt is logged when a client tries to escalate scopes
	EventScopeEscalationAttempt = "scope_escalation_attempt"

	// EventScopeDefaultsApplied is logged when provider default scopes are used (forensics/compliance)
	EventScopeDefaultsApplied = "scope_defaults_applied"

	// EventResourceMismatch is logged when resource parameter doesn't match (RFC 8707)
	EventResourceMismatch = "resource_mismatch"

	// EventCrossClientTokenAccepted is logged when a token is accepted via TrustedAudiences.
	// This occurs in SSO scenarios where tokens issued to a trusted upstream (e.g., muster)
	// are accepted by a downstream MCP server. This event is logged for security monitoring
	// and forensics to track cross-client token usage patterns.
	EventCrossClientTokenAccepted = "cross_client_token_accepted"

	// EventForwardedIDTokenAccepted is logged when a forwarded ID token (JWT) is validated
	// and accepted via JWKS signature verification. This is part of SSO token forwarding
	// where an upstream MCP server's ID token is passed as a Bearer token to downstream services.
	EventForwardedIDTokenAccepted = "forwarded_id_token_accepted"

	// EventSelfIssuedJWTAccepted is logged when a self-issued JWT access token
	// (server.AccessTokenFormatJWT mode, RFC 9068) is validated locally via
	// signature verification against the configured public key. Useful for
	// audit trails and for distinguishing local-validation hot-path bearers
	// from opaque-storage bearers in dashboards.
	EventSelfIssuedJWTAccepted = "self_issued_jwt_accepted"

	// EventSelfIssuedJWTRevoked is logged when /oauth/revoke records a
	// self-issued JWT access token's jti in the RevokedTokenStore denylist.
	EventSelfIssuedJWTRevoked = "self_issued_jwt_revoked"

	// EventIntrospectionRequesterDenied is logged when /oauth/introspect is
	// called by a client that is neither the token's client_id nor on the
	// IntrospectionResourceServers allowlist. The endpoint returns
	// {"active": false} per RFC 7662 §2.2 so the denial is invisible to the
	// caller, but the audit record preserves the cross-client probe attempt.
	EventIntrospectionRequesterDenied = "introspection_requester_denied"

	// EventUserInfoServed is logged when /oauth/userinfo (OIDC Core 1.0 §5.3)
	// returns claims to an authenticated caller. The audit record carries the
	// subject and the scope-derived claim groups that were emitted so
	// operators can audit personal-data egress.
	EventUserInfoServed = "userinfo_served"

	// EventInvalidProviderCallback is logged when provider callback validation fails
	EventInvalidProviderCallback = "invalid_provider_callback"

	// EventProviderStateMismatch is logged when provider state parameter doesn't match
	EventProviderStateMismatch = "provider_state_mismatch"

	// EventProviderNonceMismatch is logged when an upstream id_token's `nonce`
	// claim does not echo the value bound at /authorize.
	EventProviderNonceMismatch = "provider_nonce_mismatch"

	// EventProviderCodeExchangeFailed is logged when code exchange with provider fails (PKCE, etc.)
	EventProviderCodeExchangeFailed = "provider_code_exchange_failed"

	// EventProviderRevocationThresholdExceeded is logged when provider revocation partial failure occurs
	EventProviderRevocationThresholdExceeded = "provider_revocation_threshold_exceeded"

	// EventProviderRevocationCompleteFailure is logged when all provider revocation attempts fail
	EventProviderRevocationCompleteFailure = "provider_revocation_complete_failure"

	// EventTokenRevocationNotSupported is logged when provider doesn't support token revocation
	EventTokenRevocationNotSupported = "token_revocation_not_supported"

	// EventProactiveRefreshFailed is logged when proactive token refresh fails
	EventProactiveRefreshFailed = "proactive_refresh_failed"

	// EventProviderTokenStorageFailed is logged when persisting the upstream
	// provider token (or its associated UserInfo) to the token store fails.
	// Dashboards key off this event to surface SSO-token-forwarding outages
	// that previously manifested only as silent post-auth breakage.
	EventProviderTokenStorageFailed = "provider_token_storage_failed"
)

const (
	// DefaultMaxEntries is the default maximum number of tracked identifiers
	DefaultMaxEntries = 10000

	// DefaultCleanupInterval is how often the cleanup goroutine runs
	DefaultCleanupInterval = 5 * time.Minute

	// DefaultIdleTimeout is how long an entry can be idle before cleanup
	DefaultIdleTimeout = 30 * time.Minute
)

const (
	// DefaultClockSkewGracePeriod is the default grace period for token expiration checks
	// This prevents false expiration errors due to time synchronization issues
	// between different systems (client, server, provider).
	//
	// Security Rationale:
	//   - Prevents false expiration errors due to minor time differences
	//   - Balances security (minimize token lifetime extension) with usability
	//   - 5 seconds is a conservative value that handles typical NTP drift
	//
	// Trade-offs:
	//   - Allows tokens to be used up to 5 seconds beyond their true expiration
	//   - This is acceptable for most use cases and improves reliability
	//   - For high-security scenarios, this can be reduced or disabled
	DefaultClockSkewGracePeriod = 5 * time.Second
)

const InterstitialScriptHash = "sha256-BSPDdcxaKPs2IRkTMWvH7KxMRr/MuFv1HaDJlxd1UTI="

const MinKeyDistinctBytes = 16

const RequestIDHeader = "X-Request-ID"