auth

type AnonymousConfig struct {
	Allowed bool   `json:"allowed" yaml:"allowed"`
	Role    string `json:"role" yaml:"role"`
}

type AnonymousProvider struct {
	Config AnonymousConfig
}

type ApiKeyConfig struct {
	Key         string `json:"key" yaml:"key"`
	Header      string `json:"header" yaml:"header"`
	DefaultRole string `json:"default_role" yaml:"default-role"`

	Headers UserAuthInfoConfig `json:"headers" yaml:"headers"`
}

type ApiKeyProvider struct {
	// contains filtered or unexported fields
}

type AuthInfo struct {
	Role     string
	UserId   string
	UserName string

	AuthType     string
	AuthProvider string
	Token        string

	// Claims holds the scalar claims carried by the authentication token
	// (JWT/OIDC), exposed to permission filters and mutation data as
	// [$auth.<claim>] placeholders. Nil for token-less auth (API key,
	// anonymous) and for impersonated identities. Built-in placeholders
	// (user_id, role, …) always take precedence over a same-named claim.
	Claims map[string]any

	// ImpersonatedBy holds the original admin identity when this request
	// is running under impersonation. Nil means no impersonation.
	ImpersonatedBy *AuthInfo
}

type AuthProvider interface {
	Authenticate(r *http.Request) (*AuthInfo, error)
	Name() string
	Type() string
}

type Config struct {
	Providers []AuthProvider

	RedirectLoginPaths []string
	LoginUrl           string
	RedirectUrl        string
	DBApiKeysEnabled   bool
}

type CookieExtractor string

type DBApiKey struct {
	// contains filtered or unexported fields
}

type JwtConfig struct {
	Issuer string `json:"issuer" yaml:"issuer"`
	// PublicKey is the PEM-encoded public key. It is a string (not []byte) so
	// it parses from a plain multi-line scalar in YAML/JSON configs; []byte
	// would require YAML !!binary / JSON base64 encoding.
	PublicKey string `json:"public_key" yaml:"public-key"`

	CookieName string `json:"cookie_name" yaml:"cookie-name"`

	ScopeRolePrefix string `json:"scope_role_prefix" yaml:"scope-role-prefix"`
	// RoleHeader is the header to check for role if not in claims than check that scope contains prefix+role (if the many roles a)
	RoleHeader string             `json:"role_header" yaml:"role-header"`
	Claims     UserAuthInfoConfig `json:"claims" yaml:"claims"`
}

type JwtProvider struct {
	Issuer string
	// contains filtered or unexported fields
}

type ProviderInfo struct {
	Name string `json:"name" yaml:"name"`
	Type string `json:"type" yaml:"type"`
}

type UserAuthInfoConfig struct {
	Role     string `json:"role" yaml:"role"`
	UserId   string `json:"user_id" yaml:"user-id"`
	UserName string `json:"user_name" yaml:"user-name"`
}