iamserver

type AppAuthConfig struct {
	AppId     string `json:"app_id" yaml:"app_id" toml:"app_id"`
	SecretKey string `json:"secret_key" yaml:"secret_key" toml:"secret_key"`
	Endpoint  string `json:"endpoint" yaml:"endpoint" toml:"endpoint"`

	Flush func() error `json:"-" yaml:"-" toml:"-"`
}

type AuthCodeResult struct {
	AccessToken   string
	IdentityToken *inauth.IdentityToken
}

type UserAuth struct {
	*httpsrv.Controller
}

type UserAuthSessionRequest struct {
	CurrentUrl string `json:"current_url"`
}

type UserAuthSessionResponse struct {
	Status inauth.ServiceStatus `json:"status"`

	AppId        string `json:"app_id,omitempty"`
	AuthEndpoint string `json:"auth_endpoint,omitempty"`

	AuthClaims    *inauth.AuthClaims    `json:"auth_claims,omitempty"`
	IdentityToken *inauth.IdentityToken `json:"identity_token,omitempty"`
}

type UserProfile struct {
	Username string `json:"username,omitempty" toml:"username,omitempty"`
	PhotoURL string `json:"photo_url,omitempty" toml:"photo_url,omitempty"`
}

type UserSession interface {
	// CheckServer validates whether the IAM server connection is properly
	// configured and reachable. Returns a non-nil error if the server
	// is misconfigured or unavailable.
	CheckServer() error

	// RequireAuth verifies that the current user is authenticated.
	// If the user is not logged in, it returns the redirect URL for the
	// sign-in page and a non-nil error. Callers should redirect the user
	// to the returned URL to initiate authentication.
	RequireAuth() (redirectURL string, err error)

	// Allow checks whether the specified user is authorized to perform
	// the given operations identified by permission strings.
	// Returns true if all permissions are granted, false otherwise.
	Allow(username string, permissions ...string) bool

	// Profile retrieves the public profile information of the currently
	// authenticated user. Returns an error if no user is authenticated
	// or the profile cannot be fetched.
	Profile() (*UserProfile, error)
}

type Verifier interface {
	Setup(cfg *AppAuthConfig) error
	Config() *AppAuthConfig
	Ping() error
	Update(app *iamapi.AppInstance) error
	Auth(accessToken any) (*inauth.SessionToken, error)

	Session(accessToken any) UserSession
}