oidfed

type AllowedTrustMarkIssuers map[string][]string

type CmdHookConfig struct {
	// Path is the path to the executable to run.
	Path string
	// Args are the command-line arguments passed to the executable.
	Args []string
	// Env is appended to the current process environment for the command.
	Env []string
	// Timeout is the maximum duration the command may run. Default: 30s.
	Timeout time.Duration
}

type CollectedEntity struct {
	EntityID   string         `json:"entity_id"`
	TrustMarks TrustMarkInfos `json:"trust_marks,omitempty"`

	EntityTypes []string          `json:"entity_types,omitempty"`
	UIInfos     map[string]UIInfo `json:"ui_infos,omitempty"`
	Extra       map[string]any    `json:"-"`
	// contains filtered or unexported fields
}

type ConstraintSpecification struct {
	MaxPathLength      *int               `json:"max_path_length,omitempty"`
	NamingConstraints  *NamingConstraints `json:"naming_constraints,omitempty"`
	AllowedEntityTypes []string           `json:"allowed_entity_types,omitempty"`
}

type DelegationJWT struct {
	Issuer        string                 `json:"iss"`
	Subject       string                 `json:"sub"`
	TrustMarkType string                 `json:"trust_mark_type"`
	IssuedAt      unixtime.Unixtime      `json:"iat"`
	ExpiresAt     *unixtime.Unixtime     `json:"exp,omitempty"`
	Ref           string                 `json:"ref,omitempty"`
	Extra         map[string]interface{} `json:"-"`
	// contains filtered or unexported fields
}

type DynamicFederationEntity struct {
	ID                             string
	Metadata                       func() (*Metadata, error)
	AuthorityHints                 func() ([]string, error)
	TrustAnchorHints               func() ([]string, error)
	ConfigurationLifetime          func() (time.Duration, error)
	EntityStatementSigner          func() (*jwx.EntityStatementSigner, error)
	TrustMarks                     func() ([]*EntityConfigurationTrustMarkConfig, error)
	TrustMarkIssuers               func() (AllowedTrustMarkIssuers, error)
	TrustMarkOwners                func() (TrustMarkOwners, error)
	Extra                          func() (map[string]any, []string, error)
	ShouldApplyInformationalClaims func() (bool, error)
}

type ECFetcher func(entityID string) (*EntityStatement, error)

type EntityCollectionFilter interface {
	Filter(*CollectedEntity) bool
}

type EntityCollectionFilterVerifiedChains struct {
	TrustAnchors TrustAnchors
}

type EntityCollectionResponse struct {
	Entities    []*CollectedEntity `json:"entities"`
	Next        string             `json:"next,omitempty"`
	LastUpdated *unixtime.Unixtime `json:"last_updated,omitempty"`
	Extra       map[string]any     `json:"-"`
}

type EntityCollector interface {
	CollectEntities(req apimodel.EntityCollectionRequest) (*EntityCollectionResponse, *ErrorResponse)
}

type EntityConfigurationTrustMarkConfig struct {
	TrustMarkType      string                   `yaml:"trust_mark_type"`
	TrustMarkIssuer    string                   `yaml:"trust_mark_issuer"`
	SelfIssuanceSpec   *SelfIssuedTrustMarkSpec `yaml:"self_issuance_spec"`
	JWT                string                   `yaml:"trust_mark_jwt"`
	Refresh            bool                     `yaml:"refresh"`
	MinLifetime        duration.DurationOption  `yaml:"min_lifetime"`
	RefreshGracePeriod duration.DurationOption  `yaml:"refresh_grace_period"`
	RefreshRateLimit   duration.DurationOption  `yaml:"refresh_rate_limit"`
	// contains filtered or unexported fields
}

type EntityObserver interface {
	// OnDiscoveredEntities is called with the trust anchor and the full set of
	// entities discovered for it.
	OnDiscoveredEntities(trustAnchor string, entities []*CollectedEntity)
}

type EntityStatement struct {
	EntityStatementPayload
	// contains filtered or unexported fields
}

type EntityStatementPayload struct {
	Issuer             string                   `json:"iss"`
	Subject            string                   `json:"sub"`
	IssuedAt           unixtime.Unixtime        `json:"iat"`
	ExpiresAt          unixtime.Unixtime        `json:"exp"`
	JWKS               jwx.JWKS                 `json:"jwks"`
	Audience           string                   `json:"aud,omitempty"`
	AuthorityHints     []string                 `json:"authority_hints,omitempty"`
	TrustAnchorHints   []string                 `json:"trust_anchor_hints,omitempty"`
	Metadata           *Metadata                `json:"metadata,omitempty"`
	MetadataPolicy     *MetadataPolicies        `json:"metadata_policy,omitempty"`
	Constraints        *ConstraintSpecification `json:"constraints,omitempty"`
	CriticalExtensions []string                 `json:"crit,omitempty"`
	MetadataPolicyCrit []PolicyOperatorName     `json:"metadata_policy_crit,omitempty"`
	TrustMarks         TrustMarkInfos           `json:"trust_marks,omitempty"`
	TrustMarkIssuers   AllowedTrustMarkIssuers  `json:"trust_mark_issuers,omitempty"`
	TrustMarkOwners    TrustMarkOwners          `json:"trust_mark_owners,omitempty"`
	SourceEndpoint     string                   `json:"source_endpoint,omitempty"`
	TrustAnchor        string                   `json:"trust_anchor,omitempty"`
	Extra              map[string]interface{}   `json:"-"`
}

type Error struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description"`
}

type ErrorResponse struct {
	*Error
	Status int `json:"-"`
}

type FederationEntity interface {
	EntityID() string
	// EntityConfigurationPayload returns the payload for the entity configuration
	EntityConfigurationPayload() (*EntityStatementPayload, error)
	// EntityConfigurationJWT returns the signed entity configuration as a JWT
	EntityConfigurationJWT() ([]byte, error)
	// SignEntityStatement signs the provided entity configuration payload
	SignEntityStatement(payload EntityStatementPayload) ([]byte, error)
	// SignEntityStatementWithHeaders signs the provided entity configuration payload and adds the passed jws.Headers
	SignEntityStatementWithHeaders(payload EntityStatementPayload, headers jws.Headers) ([]byte, error)
}

type FederationEntityMetadata struct {
	FederationFetchEndpoint                      string         `json:"federation_fetch_endpoint,omitempty"`
	FederationListEndpoint                       string         `json:"federation_list_endpoint,omitempty"`
	FederationResolveEndpoint                    string         `json:"federation_resolve_endpoint,omitempty"`
	FederationTrustMarkStatusEndpoint            string         `json:"federation_trust_mark_status_endpoint,omitempty"`
	FederationTrustMarkListEndpoint              string         `json:"federation_trust_mark_list_endpoint,omitempty"`
	FederationTrustMarkEndpoint                  string         `json:"federation_trust_mark_endpoint,omitempty"`
	FederationHistoricalLKeysEndpoint            string         `json:"federation_historical_keys_endpoint,omitempty"`
	FederationFetchEndpointAuthMethods           []string       `json:"federation_fetch_endpoint_auth_methods,omitempty"`
	FederationListEndpointAuthMethods            []string       `json:"federation_list_endpoint_auth_methods,omitempty"`
	FederationResolveEndpointAuthMethods         []string       `json:"federation_resolve_endpoint_auth_methods,omitempty"`
	FederationTrustMarkStatusEndpointAuthMethods []string       `json:"federation_trust_mark_status_endpoint_auth_methods,omitempty"`
	FederationTrustMarkListEndpointAuthMethods   []string       `json:"federation_trust_mark_list_endpoint_auth_methods,omitempty"`
	FederationTrustMarkEndpointAuthMethods       []string       `json:"federation_trust_mark_endpoint_auth_methods,omitempty"`
	FederationHistoricalLKeysEndpointAuthMethods []string       `json:"federation_historical_keys_endpoint_auth_methods,omitempty"`
	EndpointAuthSigningAlgValuesSupported        []string       `json:"endpoint_auth_signing_alg_values_supported,omitempty"`
	Extra                                        map[string]any `json:"-"`
	DisplayName                                  string         `json:"display_name,omitempty"`
	Description                                  string         `json:"description,omitempty"`
	Keywords                                     []string       `json:"keywords,omitempty"`
	Contacts                                     []string       `json:"contacts,omitempty"`
	LogoURI                                      string         `json:"logo_uri,omitempty"`
	PolicyURI                                    string         `json:"policy_uri,omitempty"`
	InformationURI                               string         `json:"information_uri,omitempty"`
	OrganizationName                             string         `json:"organization_name,omitempty"`
	OrganizationURI                              string         `json:"organization_uri,omitempty"`
	// contains filtered or unexported fields
}

type FederationLeaf struct {
	FederationEntity
	TrustAnchors TrustAnchors

	RequestURIGenerator RequestURIGenerator
	// contains filtered or unexported fields
}

type FileJWKStorage struct {
	Dir string
	// contains filtered or unexported fields
}

type FilterableVerifiedChainsEntityCollector struct {
	Collector EntityCollector
	Filters   []EntityCollectionFilter
}

type HTTPHookBodyMode string

type HTTPHookClientAuth struct {
	// ROProducer produces the client assertion JWT (private_key_jwt).
	ROProducer *RequestObjectProducer
	// Algs, if non-nil, returns the signature algorithms acceptable to the
	// target endpoint (e.g. read from the target's Entity Configuration
	// endpoint_auth_signing_alg_values_supported). The producer's signer
	// selects the first compatible algorithm from this list; if none match the
	// available signing keys the request is skipped with a logged error. If
	// nil, the producer's DefaultSigner is used.
	Algs func() []string
}

type HTTPHookConfig struct {
	// URL is the URL to send the request to. Either URL or URLFunc must be
	// set; URLFunc takes precedence when both are provided.
	URL string
	// URLFunc, if non-nil, resolves the request URL dynamically per
	// invocation (e.g. by reading the target's Entity Configuration). It takes
	// precedence over URL. The resolved URL is also used as the audience
	// (aud claim) of any client assertion produced via ClientAuth.
	URLFunc func(ctx context.Context, event kms.KeyRotationEvent) (string, error)
	// Method is the HTTP method. Default: POST.
	Method string
	// BodyMode selects what is sent in the request body. Default: none.
	BodyMode HTTPHookBodyMode
	// Headers are additional headers set on the request.
	Headers map[string]string
	// Timeout is the HTTP client timeout. Default: 20s.
	Timeout time.Duration

	// ClientAuth enables private_key_jwt client authentication. When set, a
	// client assertion JWT is minted on each request and sent as the
	// "client_assertion" and "client_assertion_type" form parameters in the
	// request body. The assertion's audience is the hook URL. Incompatible
	// with HTTPBodyJWKS and HTTPBodySignedJWKS.
	ClientAuth *HTTPHookClientAuth

	// Signer is required when BodyMode is signed_jwks. It is used to mint the
	// jwk-set+jwt.
	Signer jwx.VersatileSigner
	// JWTLifetime is the lifetime (exp - iat) of the signed JWKS JWT.
	// Default: 10 minutes.
	JWTLifetime time.Duration
}

type IssueTrustMarkOptions struct {
	// Lifetime overrides the spec's lifetime if set (> 0).
	Lifetime time.Duration
	// SubjectClaims are additional claims specific to this subject.
	// These are merged with (and override) the spec's Extra claims.
	SubjectClaims map[string]any
}

type JWKSUpdateHookConfig struct {
	// TargetEntityID is the entity identifier of the federating entity (e.g.
	// a lighthouse) that exposes the jwks update endpoint.
	TargetEntityID string
	// Signer is the entity's federation signer used to mint the signed JWK Set
	// JWT. Required.
	Signer jwx.VersatileSigner
	// JWTLifetime is the lifetime (exp - iat) of the signed JWKS JWT.
	// Default: 10 minutes.
	JWTLifetime time.Duration
	// Headers are additional headers set on the request.
	Headers map[string]string
	// Timeout is the HTTP client timeout. Default: 20s.
	Timeout time.Duration
}

type JWKStorage interface {
	// UpdateJWKS stores the complete JWKS for an entity
	// Replaces any existing JWKS for this entityID
	UpdateJWKS(entityID string, jwks jwx.JWKS) error
	// GetJWKS retrieves stored JWKS
	// Returns nil, nil if no JWKS is stored for the entityID
	GetJWKS(entityID string) (*jwx.JWKS, error)
	// RegisterEntityJWKSFile registers an explicit JWKS file path for an entity
	// The storage may use this path for read/write operations instead of the default location
	RegisterEntityJWKSFile(entityID, jwksFile string) error
}

type JWSMessages []*jwx.ParsedJWT

type LocalMetadataResolver struct{}

type MapTrustMarkSpecProvider struct {
	// contains filtered or unexported fields
}

type Metadata struct {
	OpenIDProvider           *OpenIDProviderMetadata           `json:"openid_provider,omitempty"`
	RelyingParty             *OpenIDRelyingPartyMetadata       `json:"openid_relying_party,omitempty"`
	OAuthAuthorizationServer *OAuthAuthorizationServerMetadata `json:"oauth_authorization_server,omitempty"`
	OAuthClient              *OAuthClientMetadata              `json:"oauth_client,omitempty"`
	OAuthProtectedResource   *OAuthProtectedResourceMetadata   `json:"oauth_resource,omitempty"`
	FederationEntity         *FederationEntityMetadata         `json:"federation_entity,omitempty"`
	// Extra contains additional metadata this entity should advertise.
	Extra map[string]any `json:"-"`
}

type MetadataPolicies struct {
	OpenIDProvider           MetadataPolicy `json:"openid_provider,omitempty"`
	RelyingParty             MetadataPolicy `json:"openid_relying_party,omitempty"`
	OAuthAuthorizationServer MetadataPolicy `json:"oauth_authorization_server,omitempty"`
	OAuthClient              MetadataPolicy `json:"oauth_client,omitempty"`
	OAuthProtectedResource   MetadataPolicy `json:"oauth_resource,omitempty"`
	FederationEntity         MetadataPolicy `json:"federation_entity,omitempty"`
	// Extra contains metadata policies for entity types unknown to this module.
	Extra map[string]MetadataPolicy `json:"-"`
}

type MetadataPolicy map[string]MetadataPolicyEntry

type MetadataPolicyEntry map[PolicyOperatorName]any

type MetadataResolver interface {
	Resolve(request apimodel.ResolveRequest) (*Metadata, error)
	ResolveResponsePayload(request apimodel.ResolveRequest) (ResolveResponsePayload, error)
	ResolvePossible(request apimodel.ResolveRequest) (validConfirmed, invalidConfirmed bool)
}

type MultilingualString map[string]string

type MultilingualUIInfo struct {
	DisplayName    MultilingualString `json:"display_name,omitempty"`
	Description    MultilingualString `json:"description,omitempty"`
	Keywords       []string           `json:"keywords,omitempty"`
	LogoURI        MultilingualString `json:"logo_uri,omitempty"`
	PolicyURI      MultilingualString `json:"policy_uri,omitempty"`
	InformationURI MultilingualString `json:"information_uri,omitempty"`
	Extra          map[string]any     `json:"-"`
}

type NamingConstraints struct {
	Permitted []string `json:"permitted,omitempty"`
	Excluded  []string `json:"excluded,omitempty"`
}

type OAuthAuthorizationServerMetadata OpenIDProviderMetadata

type OAuthClientMetadata OpenIDRelyingPartyMetadata

type OAuthProtectedResourceMetadata struct {
	Resource                             string         `json:"resource,omitempty"`
	AuthorizationServers                 []string       `json:"authorization_servers,omitempty"`
	ScopesSupported                      []string       `json:"scopes_supported,omitempty"`
	BearerMethodsSupported               []string       `json:"bearer_methods_supported,omitempty"`
	ResourceSigningAlgValuesSupported    []string       `json:"resource_signing_alg_values_supported,omitempty"`
	ResourceEncryptionAlgValuesSupported []string       `json:"resource_encryption_alg_values_supported"`
	ResourceEncryptionEncValuesSupported []string       `json:"resource_encryption_enc_values_supported"`
	ResourceName                         string         `json:"resource_name,omitempty"`
	ResourceDocumentation                string         `json:"resource_documentation,omitempty"`
	ResourcePolicyURI                    string         `json:"resource_policy_uri,omitempty"`
	ResourceTOSURI                       string         `json:"resource_tos_uri,omitempty"`
	Extra                                map[string]any `json:"-"`
	SignedJWKSURI                        string         `json:"signed_jwks_uri,omitempty"`
	JWKSURI                              string         `json:"jwks_uri,omitempty"`
	JWKS                                 *jwx.JWKS      `json:"jwks,omitempty"`
	DisplayName                          string         `json:"display_name,omitempty"`
	Description                          string         `json:"description,omitempty"`
	Keywords                             []string       `json:"keywords,omitempty"`
	Contacts                             []string       `json:"contacts,omitempty"`
	LogoURI                              string         `json:"logo_uri,omitempty"`
	PolicyURI                            string         `json:"policy_uri,omitempty"`
	InformationURI                       string         `json:"information_uri,omitempty"`
	OrganizationName                     string         `json:"organization_name,omitempty"`
	OrganizationURI                      string         `json:"organization_uri,omitempty"`
	// contains filtered or unexported fields
}

type OIDCErrorResponse struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type OIDCRP struct {
	*oauth2.Config
	*oidc.Provider
	*oidc.IDTokenVerifier
}

type OIDCTokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int64  `json:"expires_in"`
	RefreshToken string `json:"refresh_token"`
	Scopes       string `json:"scope"`
	IDToken      string `json:"id_token"`

	Extra map[string]any `json:"-"`
}

type OpenIDProviderMetadata struct {
	Issuer                                                    string              `json:"issuer"`
	AuthorizationEndpoint                                     string              `json:"authorization_endpoint"`
	TokenEndpoint                                             string              `json:"token_endpoint"`
	UserinfoEndpoint                                          string              `json:"userinfo_endpoint,omitempty"`
	RegistrationEndpoint                                      string              `json:"registration_endpoint,omitempty"`
	ScopesSupported                                           []string            `json:"scopes_supported,omitempty"`
	ResponseTypesSupported                                    []string            `json:"response_types_supported"`
	ResponseModesSupported                                    []string            `json:"response_modes_supported,omitempty"`
	GrantTypesSupported                                       []string            `json:"grant_types_supported,omitempty"`
	ACRValuesSupported                                        []string            `json:"acr_values_supported,omitempty"`
	SubjectTypesSupported                                     []string            `json:"subject_types_supported"`
	IDTokenSigningAlgValuesSupported                          []string            `json:"id_token_signing_alg_values_supported,omitempty"`
	IDTokenEncryptionAlgValuesSupported                       []string            `json:"id_token_encryption_alg_values_supported,omitempty"`
	IDTokenEncryptionEncValuesSupported                       []string            `json:"id_token_encryption_enc_values_supported,omitempty"`
	UserinfoSignedResponseAlgValuesSupported                  []string            `json:"userinfo_signed_response_alg_values_supported,omitempty"`
	UserinfoEncryptedResponseAlgValuesSupported               []string            `json:"userinfo_encrypted_response_alg_values_supported,omitempty"`
	UserinfoEncryptedResponseEncValuesSupported               []string            `json:"userinfo_encrypted_response_enc_values_supported,omitempty"`
	RequestObjectSigningAlgValuesSupported                    []string            `json:"request_object_signing_alg_values_supported,omitempty"`
	RequestObjectEncryptionAlgValuesSupported                 []string            `json:"request_object_encryption_alg_values_supported,omitempty"`
	RequestObjectEncryptionEncValuesSupported                 []string            `json:"request_object_encryption_enc_values_supported,omitempty"`
	TokenEndpointAuthMethodsSupported                         []string            `json:"token_endpoint_auth_methods_supported,omitempty"`
	TokenEndpointAuthSigningAlgValuesSupported                []string            `json:"token_endpoint_auth_signing_alg_values_supported,omitempty"`
	DisplayValuesSupported                                    []string            `json:"display_values_supported,omitempty"`
	ClaimsSupported                                           []string            `json:"claims_supported,omitempty"`
	ServiceDocumentation                                      string              `json:"service_documentation,omitempty"`
	ClaimsLocalesSupported                                    []string            `json:"claims_locales_supported,omitempty"`
	UILocalesSupported                                        []string            `json:"ui_locales_supported,omitempty"`
	ClaimsParameterSupported                                  bool                `json:"claims_parameter_supported,omitempty"`
	RequestParameterSupported                                 bool                `json:"request_parameter_supported,omitempty"`
	RequestURIParameterSupported                              bool                `json:"request_uri_parameter_supported,omitempty"`
	RequireRequestURIRegistration                             bool                `json:"require_request_uri_registration,omitempty"`
	OPPolicyURI                                               string              `json:"op_policy_uri,omitempty"`
	OPTOSURI                                                  string              `json:"op_tos_uri,omitempty"`
	RevocationEndpoint                                        string              `json:"revocation_endpoint,omitempty"`
	RevocationEndpointAuthMethodsSupported                    []string            `json:"revocation_endpoint_auth_methods_supported,omitempty"`
	RevocationEndpointAuthSigningAlgValuesSupported           []string            `json:"revocation_endpoint_auth_signing_alg_values_supported,omitempty"`
	IntrospectionEndpoint                                     string              `json:"introspection_endpoint,omitempty"`
	IntrospectionEndpointAuthMethodsSupported                 []string            `json:"introspection_endpoint_auth_methods_supported,omitempty"`
	IntrospectionEndpointAuthSigningAlgValuesSupported        []string            `json:"introspection_endpoint_auth_signing_alg_values_supported,omitempty"`
	IntrospectionSigningAlgValuesSupported                    []string            `json:"introspection_signing_alg_values_supported,omitempty"`
	IntrospectionEncryptionAlgValuesSupported                 []string            `json:"introspection_encryption_alg_values_supported,omitempty"`
	IntrospectionEncryptionEncValuesSupported                 []string            `json:"introspection_encryption_enc_values_supported,omitempty"`
	CodeChallengeMethodsSupported                             []string            `json:"code_challenge_methods_supported,omitempty"`
	SignedMetadata                                            string              `json:"signed_metadata,omitempty"`
	DeviceAuthorizationEndpoint                               string              `json:"device_authorization_endpoint,omitempty"`
	TLSClientCertificateBoundAccessTokens                     bool                `json:"tls_client_certificate_bound_access_tokens,omitempty"`
	MTLSEndpointAliases                                       map[string]string   `json:"mtls_endpoint_aliases,omitempty"`
	NFVTokenSigningAlgValuesSupported                         []string            `json:"nfv_token_signing_alg_values_supported,omitempty"`
	NFVTokenEncryptionAlgValuesSupported                      []string            `json:"nfv_token_encryption_alg_values_supported,omitempty"`
	NFVTokenEncryptionEncValuesSupported                      []string            `json:"nfv_token_encryption_enc_values_supported,omitempty"`
	RequireSignedRequestObject                                bool                `json:"require_signed_request_object,omitempty"`
	PushedAuthorizationRequestEndpoint                        string              `json:"pushed_authorization_request_endpoint,omitempty"`
	RequirePushedAuthorizationRequests                        bool                `json:"require_pushed_authorization_requests,omitempty"`
	AuthorizationResponseIssParameterSupported                bool                `json:"authorization_response_iss_parameter_supported,omitempty"`
	CheckSessionIFrame                                        string              `json:"check_session_iframe,omitempty"`
	FrontchannelLogoutSupported                               bool                `json:"frontchannel_logout_supported,omitempty"`
	BackchannelLogoutSupported                                bool                `json:"backchannel_logout_supported,omitempty"`
	BackchannelLogoutSessionSupported                         bool                `json:"backchannel_logout_session_supported,omitempty"`
	EndSessionEndpoint                                        string              `json:"end_session_endpoint,omitempty"`
	BackchannelTokenDeliveryModesSupported                    []string            `json:"backchannel_token_delivery_modes_supported,omitempty"`
	BackchannelAuthenticationEndpoint                         string              `json:"backchannel_authentication_endpoint,omitempty"`
	BackchannelAuthenticationRequestSigningAlgValuesSupported []string            `json:"backchannel_authentication_request_signing_alg_values_supported,omitempty"`
	BackchannelUserCodeParameterSupported                     bool                `json:"backchannel_user_code_parameter_supported,omitempty"`
	AuthorizationDetailsTypesSupported                        []string            `json:"authorization_details_types_supported,omitempty"`
	ClientRegistrationTypesSupported                          []string            `json:"client_registration_types_supported"`
	FederationRegistrationEndpoint                            string              `json:"federation_registration_endpoint,omitempty"`
	RequestAuthenticationMethodsSupported                     map[string][]string `json:"request_authentication_methods_supported,omitempty"`
	RequestAuthenticationSigningAlgValuesSupported            []string            `json:"request_authentication_signing_alg_values_supported,omitempty"`
	Extra                                                     map[string]any      `json:"-"`
	SignedJWKSURI                                             string              `json:"signed_jwks_uri,omitempty"`
	JWKSURI                                                   string              `json:"jwks_uri,omitempty"`
	JWKS                                                      *jwx.JWKS           `json:"jwks,omitempty"`
	DisplayName                                               string              `json:"display_name,omitempty"`
	Description                                               string              `json:"description,omitempty"`
	Keywords                                                  []string            `json:"keywords,omitempty"`
	Contacts                                                  []string            `json:"contacts,omitempty"`
	LogoURI                                                   string              `json:"logo_uri,omitempty"`
	PolicyURI                                                 string              `json:"policy_uri,omitempty"`
	InformationURI                                            string              `json:"information_uri,omitempty"`
	OrganizationName                                          string              `json:"organization_name,omitempty"`
	OrganizationURI                                           string              `json:"organization_uri,omitempty"`
	// contains filtered or unexported fields
}

type OpenIDRelyingPartyMetadata struct {
	Scope                                      string         `json:"scope,omitempty"`
	RedirectURIS                               []string       `json:"redirect_uris,omitempty"`
	ResponseTypes                              []string       `json:"response_types,omitempty"`
	GrantTypes                                 []string       `json:"grant_types,omitempty"`
	ApplicationType                            string         `json:"application_type,omitempty"`
	Contacts                                   []string       `json:"contacts,omitempty"`
	ClientName                                 string         `json:"client_name,omitempty"`
	LogoURI                                    string         `json:"logo_uri,omitempty"`
	ClientURI                                  string         `json:"client_uri,omitempty"`
	PolicyURI                                  string         `json:"policy_uri,omitempty"`
	TOSURI                                     string         `json:"tos_uri,omitempty"`
	SectorIdentifierURI                        string         `json:"sector_identifier_uri,omitempty"`
	SubjectType                                string         `json:"subject_type,omitempty"`
	SubjectTypesSupported                      []string       `json:"subject_types_supported,omitempty"`
	IDTokenSignedResponseAlg                   string         `json:"id_token_signed_response_alg,omitempty"`
	IDTokenSigningAlgValuesSupported           []string       `json:"id_token_signing_alg_values_supported,omitempty"`
	IDTokenEncryptedResponseAlg                string         `json:"id_token_encrypted_response_alg,omitempty"`
	IDTokenEncryptionAlgValuesSupported        []string       `json:"id_token_encryption_alg_values_supported,omitempty"`
	IDTokenEncryptedResponseEnc                string         `json:"id_token_encrypted_response_enc,omitempty"`
	IDTokenEncryptionEncValuesSupported        []string       `json:"id_token_encryption_enc_values_supported,omitempty"`
	UserinfoSignedResponseAlg                  string         `json:"userinfo_signed_response_alg,omitempty"`
	UserinfoSigningAlgValuesSupported          []string       `json:"userinfo_signing_alg_values_supported,omitempty"`
	UserinfoEncryptedResponseAlg               string         `json:"userinfo_encrypted_response_alg,omitempty"`
	UserinfoEncryptionAlgValuesSupported       []string       `json:"userinfo_encryption_alg_values_supported,omitempty"`
	UserinfoEncryptedResponseEnc               string         `json:"userinfo_encrypted_response_enc,omitempty"`
	UserinfoEncryptionEncValuesSupported       []string       `json:"userinfo_encryption_enc_values_supported,omitempty"`
	RequestObjectSigningAlg                    string         `json:"request_object_signing_alg,omitempty"`
	RequestObjectSigningAlgValuesSupported     []string       `json:"request_object_signing_alg_values_supported,omitempty"`
	RequestObjectEncryptionAlg                 string         `json:"request_object_encryption_alg,omitempty"`
	RequestObjectEncryptionAlgValuesSupported  []string       `json:"request_object_encryption_alg_values_supported,omitempty"`
	RequestObjectEncryptionEnc                 string         `json:"request_object_encryption_enc,omitempty"`
	RequestObjectEncryptionEncValuesSupported  []string       `json:"request_object_encryption_enc_values_supported,omitempty"`
	TokenEndpointAuthMethod                    string         `json:"token_endpoint_auth_method,omitempty"`
	TokenEndpointAuthMethodsSupported          []string       `json:"token_endpoint_auth_methods_supported,omitempty"`
	TokenEndpointAuthSigningAlg                string         `json:"token_endpoint_auth_signing_alg,omitempty"`
	TokenEndpointAuthSigningAlgValuesSupported []string       `json:"token_endpoint_auth_signing_alg_values_supported,omitempty"`
	AuthorizationSignedResponseAlg             string         `json:"authorization_signed_response_alg,omitempty"`
	AuthorizationSigningAlgValuesSupported     []string       `json:"authorization_signing_alg_values_supported,omitempty"`
	AuthorizationEncryptedResponseAlg          string         `json:"authorization_encrypted_response_alg,omitempty"`
	AuthorizationEncryptionAlgValuesSupported  []string       `json:"authorization_encryption_alg_values_supported,omitempty"`
	AuthorizationEncryptedResponseEnc          string         `json:"authorization_encrypted_response_enc,omitempty"`
	AuthorizationEncryptionEncValuesSupported  []string       `json:"authorization_encryption_enc_values_supported,omitempty"`
	DefaultMaxAge                              int64          `json:"default_max_age,omitempty"`
	RequireAuthTime                            bool           `json:"require_auth_time,omitempty"`
	DefaultACRValues                           []string       `json:"default_acr_values,omitempty"`
	InitiateLoginURI                           string         `json:"initiate_login_uri,omitempty"`
	RequestURIs                                []string       `json:"request_uris,omitempty"`
	SoftwareID                                 string         `json:"software_id,omitempty"`
	SoftwareVersion                            string         `json:"software_version,omitempty"`
	ClientID                                   string         `json:"client_id,omitempty"`
	ClientSecret                               string         `json:"client_secret,omitempty"`
	ClientIDIssuedAt                           int64          `json:"client_id_issued_at,omitempty"`
	ClientSecretExpiresAt                      int64          `json:"client_secret_expires_at,omitempty"`
	RegistrationAccessToken                    string         `json:"registration_access_token,omitempty"`
	RegistrationClientURI                      string         `json:"registration_client_uri,omitempty"`
	ClaimsRedirectURIs                         []string       `json:"claims_redirect_uris,omitempty"`
	NFVTokenSignedResponseAlg                  string         `json:"nfv_token_signed_response_alg,omitempty"`
	NFVTokenEncryptedResponseAlg               string         `json:"nfv_token_encrypted_response_alg,omitempty"`
	NFVTokenEncryptedResponseEnc               string         `json:"nfv_token_encrypted_response_enc,omitempty"`
	TLSClientCertificateBoundAccessTokens      bool           `json:"tls_client_certificate_bound_access_tokens,omitempty"`
	TLSClientAuthSubjectDN                     string         `json:"tls_client_auth_subject_dn,omitempty"`
	TLSClientAuthSANDNS                        string         `json:"tls_client_auth_san_dns,omitempty"`
	TLSClientAuthSANURI                        string         `json:"tls_client_auth_san_uri,omitempty"`
	TLSClientAuthSANIP                         string         `json:"tls_client_auth_san_ip,omitempty"`
	TLSClientAuthSANEMAIL                      string         `json:"tls_client_auth_san_email,omitempty"`
	RequireSignedRequestObject                 bool           `json:"require_signed_request_object,omitempty"`
	RequirePushedAuthorizationRequests         bool           `json:"require_pushed_authorization_requests,omitempty"`
	IntrospectionSignedResponseAlg             string         `json:"introspection_signed_response_alg,omitempty"`
	IntrospectionSigningAlgValuesSupported     []string       `json:"introspection_signing_alg_values_supported,omitempty"`
	IntrospectionEncryptedResponseAlg          string         `json:"introspection_encrypted_response_alg,omitempty"`
	IntrospectionEncryptionAlgValuesSupported  []string       `json:"introspection_encryption_alg_values_supported,omitempty"`
	IntrospectionEncryptedResponseEnc          string         `json:"introspection_encrypted_response_enc,omitempty"`
	IntrospectionEncryptionEncValuesSupported  []string       `json:"introspection_encryption_enc_values_supported,omitempty"`
	FrontchannelLogoutURI                      string         `json:"frontchannel_logout_uri,omitempty"`
	FrontchannelLogoutSessionRequired          bool           `json:"frontchannel_logout_session_required,omitempty"`
	BackchannelLogoutURI                       string         `json:"backchannel_logout_uri,omitempty"`
	BackchannelLogoutSessionRequired           bool           `json:"backchannel_logout_session_required,omitempty"`
	PostLogoutRedirectURIs                     []string       `json:"post_logout_redirect_uris,omitempty"`
	AuthorizationDetailsTypes                  []string       `json:"authorization_details_types,omitempty"`
	ClientRegistrationTypes                    []string       `json:"client_registration_types"`
	Extra                                      map[string]any `json:"-"`
	SignedJWKSURI                              string         `json:"signed_jwks_uri,omitempty"`
	JWKSURI                                    string         `json:"jwks_uri,omitempty"`
	JWKS                                       *jwx.JWKS      `json:"jwks,omitempty"`
	DisplayName                                string         `json:"display_name,omitempty"`
	Description                                string         `json:"description,omitempty"`
	Keywords                                   []string       `json:"keywords,omitempty"`
	InformationURI                             string         `json:"information_uri,omitempty"`
	OrganizationName                           string         `json:"organization_name,omitempty"`
	OrganizationURI                            string         `json:"organization_uri,omitempty"`
	// contains filtered or unexported fields
}

type OwnedTrustMark struct {
	ID                 string
	DelegationLifetime time.Duration
	Ref                string
	Extra              map[string]any
}

type PeriodicEntityCollector struct {
	// Collector used for actual collection (defaults to SimpleEntityCollector).
	Collector EntityCollector

	// TrustAnchors is the full list of trust anchors to iterate over.
	TrustAnchors []string

	// Interval between background collection rounds.
	Interval time.Duration `yaml:"interval"`

	// Concurrency limits simultaneous trust anchor collections per run.
	// If 0 or negative, a sensible default is used.
	Concurrency int `yaml:"concurrency"`

	SortEntitiesComparisonFunc func(a, b *CollectedEntity) int
	PagingLimit                int `yaml:"paging_limit"`

	// Optional handler invoked after each trust anchor collection with the
	// discovered entities; can be used to trigger proactive resolver jobs.
	Handler EntityObserver
	// contains filtered or unexported fields
}

type PolicyOperator interface {
	// Merge merges two policy operator values and returns the result
	Merge(a, b any, pathInfo string) (any, error)
	// Apply applies the policy operator value to the attribute value and returns the result
	Apply(value any, valueSet bool, policyValue any, essential bool, pathInfo string) (any, bool, error)
	// Name returns the PolicyOperatorName
	Name() PolicyOperatorName
	// MayCombineWith gives a list of PolicyOperatorName with which this PolicyOperator may be combined
	MayCombineWith() []PolicyOperatorName
}

type PolicyOperatorName string

type PolicyVerifier func(p MetadataPolicyEntry, pathInfo string) error

type ProactiveResolver struct {
	// EntityID is the issuer of the resolve response.
	EntityID string
	// Store persists signed responses.
	Store ResolveResponseStorage
	// Signer used to sign resolve responses.
	Signer *jwx.ResolveResponseSigner
	// RefreshLead defines how far ahead of expiration we refresh.
	RefreshLead time.Duration
	// Concurrency limits simultaneous resolve jobs.
	Concurrency int
	// QueueSize configures the job channel buffer; if <= 0, the channel is
	// unbuffered and producers will block until a worker receives.
	QueueSize int
	// contains filtered or unexported fields
}

type RequestObjectProducer struct {
	EntityID string
	// contains filtered or unexported fields
}

type RequestURIGenerator func([]byte) (string, error)

type ResolveResponse struct {
	Issuer                 string            `json:"iss"`
	Subject                string            `json:"sub"`
	IssuedAt               unixtime.Unixtime `json:"iat"`
	ExpiresAt              unixtime.Unixtime `json:"exp"`
	Audience               string            `json:"aud,omitempty"`
	ResolveResponsePayload `json:",inline"`
}

type ResolveResponseKey struct {
	Subject string
	Types   []string
}

type ResolveResponsePayload struct {
	Metadata    *Metadata              `json:"metadata,omitempty"`
	TrustMarks  TrustMarkInfos         `json:"trust_marks,omitempty"`
	TrustChain  JWSMessages            `json:"trust_chain,omitempty"`
	TrustAnchor string                 `json:"trust_anchor,omitempty"`
	Extra       map[string]interface{} `json:"-"`
}

type ResolveResponseStorage interface {
	// WriteJSON stores the given ResolveResponse as a JSON document for the specified subject, trust anchor, and entity types.
	WriteJSON(subject, trustAnchor string, types []string, payload ResolveResponse) error
	// WriteJWT stores the given ResolveResponse as a JWT document for the specified subject, trust anchor, and entity types.
	WriteJWT(subject, trustAnchor string, types []string, jwt func() ([]byte, error)) error
	// ReadJSON reads and unmarshalls the JSON response for the specified subject, trust anchor, and entity types.
	ReadJSON(subject, trustAnchor string, types []string) (*ResolveResponse, error)
	// ReadJWT reads the JWT response for the specified subject, trust anchor, and entity types.
	ReadJWT(subject, trustAnchor string, types []string) ([]byte, error)
	// Prune removes stored prepared responses for a trust anchor that are not
	// part of the expected set anymore (e.g., entities dropped from collection
	// or their entity type subsets changed).
	Prune(trustAnchor string, expected []ResolveResponseKey) error
}

type ResolveStore struct {
	// BaseDir where files are written.
	BaseDir string
	// StoreJWT controls whether the signed JWT is persisted.
	StoreJWT bool
	// StoreJSON controls whether the unsigned JSON is persisted.
	StoreJSON bool
}

type SelfIssuedTrustMarkIssuer struct {
	EntityID string
	*jwx.TrustMarkSigner
	// contains filtered or unexported fields
}

type SelfIssuedTrustMarkSpec struct {
	TrustMarkSpec            `yaml:",inline"`
	IncludeExtraClaimsInInfo bool `json:"include_extra_claims_in_info" yaml:"include_extra_claims_in_info"`
}

type SignedJWKS struct {

	// Keys is the REQUIRED "keys" claim: the array of JWK values.
	Keys jwx.JWKS `json:"keys"`
	// Issuer is the REQUIRED "iss" claim.
	Issuer string `json:"iss"`
	// Subject is the REQUIRED "sub" claim (owner of the keys; SHOULD equal iss).
	Subject string `json:"sub"`
	// IssuedAt is the OPTIONAL "iat" claim.
	IssuedAt *unixtime.Unixtime `json:"iat,omitempty"`
	// ExpiresAt is the OPTIONAL "exp" claim.
	ExpiresAt *unixtime.Unixtime `json:"exp,omitempty"`
	// contains filtered or unexported fields
}

type SimpleEntityCollector struct {
	// contains filtered or unexported fields
}

type SimpleOPCollector struct{}

type SimpleRemoteEntityCollector struct {
	EntityCollectionEndpoint string
}

type SimpleRemoteMetadataResolver struct {
	ResolveEndpoint string
}

type SliceOrSingleValue[T any] []T

type SmartRemoteEntityCollector struct {
	TrustAnchors []string
}

type SmartRemoteMetadataResolver struct{}

type StaticFederationEntity struct {
	ID                    string
	Metadata              *Metadata
	AuthorityHints        []string
	TrustAnchorHints      []string
	ConfigurationLifetime time.Duration
	*jwx.EntityStatementSigner
	TrustMarks                     []*EntityConfigurationTrustMarkConfig
	TrustMarkIssuers               AllowedTrustMarkIssuers
	TrustMarkOwners                TrustMarkOwners
	Extra                          map[string]any
	CriticalClaims                 []string
	ShouldApplyInformationalClaims bool
}

type SubordinateJWKSInfo struct {
	EntityID         string
	EnableJWKSUpdate bool
	JWKSPollInterval *int64 // seconds; nil or <=0 means derive from EC exp
	JWKS             jwx.JWKS
}

type SubordinateJWKSRefreshStorage interface {
	// ListEnabled returns all subordinates with EnableJWKSUpdate=true.
	ListEnabled() ([]SubordinateJWKSInfo, error)
	// Get returns the subordinate with the given entity ID, or
	// (nil, nil) if not found.
	Get(entityID string) (*SubordinateJWKSInfo, error)
	// UpdateJWKS replaces the stored JWKS for the given entity ID.
	UpdateJWKS(entityID string, jwks jwx.JWKS) error
}

type SubordinateJWKSRefresher struct {
	// contains filtered or unexported fields
}

type SubordinateJWKSRefresherConfig struct {
	// LogLevel sets the minimum log level. Default: "info".
	LogLevel string `yaml:"log_level"`
}

type TAJWKSRefresher struct {
	// contains filtered or unexported fields
}

type TAJWKSRefresherConfig struct {
	// LogLevel sets minimum log level ("debug", "info", "warn", "error")
	// Default: "info"
	LogLevel string `yaml:"log_level"`
}

type TriggerUpdateHookConfig struct {
	// TargetEntityID is the entity identifier of the federating entity (e.g.
	// a lighthouse) that exposes the trigger endpoint.
	TargetEntityID string
	// ROProducer produces the client assertion JWT (private_key_jwt) used to
	// authenticate to the trigger endpoint. Optional; when nil the hook never
	// authenticates, even if the target requires it.
	ROProducer *RequestObjectProducer
	// Headers are additional headers set on the request.
	Headers map[string]string
	// Timeout is the HTTP client timeout. Default: 20s.
	Timeout time.Duration
}

type TrustAnchor struct {
	EntityID         string                  `json:"entity_id"`
	JWKSFile         string                  `json:"jwks_file"`
	EnableJWKSUpdate bool                    `json:"enable_jwks_update"`
	KeyPollInterval  duration.DurationOption `json:"key_poll_interval"`
	// contains filtered or unexported fields
}

type TrustAnchorHintsMode string

type TrustAnchors []*TrustAnchor

type TrustChain []*EntityStatement

type TrustChainChecker interface {
	Check(TrustChain) bool
}

type TrustChainScoringFnc func(c TrustChain) int

type TrustChains []TrustChain

type TrustChainsFilter interface {
	Filter(TrustChains) TrustChains
}

type TrustMark struct {
	Issuer        string                 `json:"iss"`
	Subject       string                 `json:"sub"`
	TrustMarkType string                 `json:"trust_mark_type"`
	IssuedAt      unixtime.Unixtime      `json:"iat"`
	LogoURI       string                 `json:"logo_uri,omitempty"`
	ExpiresAt     *unixtime.Unixtime     `json:"exp,omitempty"`
	Ref           string                 `json:"ref,omitempty"`
	DelegationJWT string                 `json:"delegation,omitempty"`
	Extra         map[string]interface{} `json:"-"`
	// contains filtered or unexported fields
}

type TrustMarkInfo struct {
	TrustMarkType string                 `json:"trust_mark_type" yaml:"type"`
	TrustMarkJWT  string                 `json:"trust_mark" yaml:"trust_mark"`
	Extra         map[string]interface{} `json:"-" yaml:"-"`
	// contains filtered or unexported fields
}

type TrustMarkInfos []TrustMarkInfo

type TrustMarkIssuer struct {
	EntityID string
	*jwx.TrustMarkSigner
	// contains filtered or unexported fields
}

type TrustMarkOwner struct {
	EntityID string
	*jwx.TrustMarkDelegationSigner
	// contains filtered or unexported fields
}

type TrustMarkOwnerSpec struct {
	ID   string   `json:"sub" yaml:"entity_id"`
	JWKS jwx.JWKS `json:"jwks" yaml:"jwks"`
}

type TrustMarkOwners map[string]TrustMarkOwnerSpec

type TrustMarkSpec struct {
	TrustMarkType string                  `json:"trust_mark_type" yaml:"trust_mark_type"`
	Lifetime      duration.DurationOption `json:"lifetime" yaml:"lifetime"`
	Ref           string                  `json:"ref" yaml:"ref"`
	LogoURI       string                  `json:"logo_uri" yaml:"logo_uri"`
	Extra         map[string]any          `json:"-" yaml:"-"`
	DelegationJWT string                  `json:"delegation_jwt" yaml:"delegation_jwt"`
}

type TrustMarkSpecProvider interface {
	// GetTrustMarkSpec returns the TrustMarkSpec for the given trust mark type.
	// Returns nil if the trust mark type is not found.
	GetTrustMarkSpec(trustMarkType string) *TrustMarkSpec

	// TrustMarkTypes returns all available trust mark types.
	TrustMarkTypes() []string
}

type TrustResolver struct {
	TrustAnchors   TrustAnchors
	StartingEntity string
	Types          []string

	TrustAnchorHintsMode TrustAnchorHintsMode
	// contains filtered or unexported fields
}

type UIInfo struct {
	DisplayName    string         `json:"display_name,omitempty"`
	Description    string         `json:"description,omitempty"`
	Keywords       []string       `json:"keywords,omitempty"`
	LogoURI        string         `json:"logo_uri,omitempty"`
	PolicyURI      string         `json:"policy_uri,omitempty"`
	InformationURI string         `json:"information_uri,omitempty"`
	Extra          map[string]any `json:"-"`
}

type VerifiedChainsEntityCollector struct{}