clients

type ClientRegistration struct {
	ID     string `yaml:"id" json:"-"`
	Secret string `yaml:"secret" json:"-"`

	Trusted       bool     `yaml:"trusted" json:"-"`
	TrustedScopes []string `yaml:"trusted_scopes" json:"-"`
	Insecure      bool     `yaml:"insecure" json:"-"`

	// RequirePKCE refuses a code exchange for this client when the
	// authorization request carried no code challenge. It is set for every
	// dynamically registered client, since those have no relationship with the
	// operator which could vouch for them.
	RequirePKCE bool `yaml:"require_pkce" json:"require_pkce,omitempty"`

	ImplicitScopes                []string `yaml:"implicit_scopes" json:"-"`
	ExternalAuthorizeRedirectURIs []string `yaml:"external_authorize_redirect_uris,flow" json:"-"`

	Dynamic         bool      `yaml:"-" json:"-"`
	IDIssuedAt      time.Time `yaml:"-" json:"-"`
	SecretExpiresAt time.Time `yaml:"-" json:"-"`

	// MetadataDocument is true for a client described by the Client ID
	// Metadata Document at its client ID URL. Its Name is then the host of
	// that URL, and ClaimedName the client_name the document gives, which
	// nobody vouches for.
	MetadataDocument bool   `yaml:"-" json:"-"`
	ClaimedName      string `yaml:"-" json:"-"`

	Contacts        []string `yaml:"contacts,flow" json:"contacts,omitempty"`
	Name            string   `yaml:"name" json:"name,omitempty"`
	URI             string   `yaml:"uri"  json:"uri,omitempty"`
	GrantTypes      []string `yaml:"grant_types,flow" json:"grant_types,omitempty"`
	ApplicationType string   `yaml:"application_type"  json:"application_type,omitempty"`

	RedirectURIs []string `yaml:"redirect_uris,flow" json:"redirect_uris,omitempty"`
	Origins      []string `yaml:"origins,flow" json:"-"`

	JWKS *gojwk.Key `yaml:"jwks" json:"-"`

	RawIDTokenSignedResponseAlg    string `yaml:"id_token_signed_response_alg" json:"id_token_signed_response_alg,omitempty"`
	RawUserInfoSignedResponseAlg   string `yaml:"userinfo_signed_response_alg" json:"userinfo_signed_response_alg,omitempty"`
	RawRequestObjectSigningAlg     string `yaml:"request_object_signing_alg" json:"request_object_signing_alg,omitempty"`
	RawTokenEndpointAuthMethod     string `yaml:"token_endpoint_auth_method" json:"token_endpoint_auth_method,omitempty"`
	RawTokenEndpointAuthSigningAlg string `yaml:"token_endpoint_auth_signing_alg"  json:"token_endpoint_auth_signing_alg,omitempty"`

	PostLogoutRedirectURIs []string `yaml:"post_logout_redirect_uris,flow" json:"post_logout_redirect_uris,omitempty"`
}

type Details struct {
	ID          string `json:"id"`
	DisplayName string `json:"display_name"`
	RedirectURI string `json:"redirect_uri"`
	Trusted     bool   `json:"trusted"`

	// Unverified is true for a client nobody vouches for, one which registered
	// itself or which is described by a metadata document at its client ID.
	// For the latter DisplayName is the host of that client ID, and
	// ClaimedName is the name the document gives.
	Unverified  bool   `json:"unverified"`
	ClaimedName string `json:"claimed_name,omitempty"`

	Registration *ClientRegistration `json:"-"`
}

type RegistrationClaims struct {
	jwt.RegisteredClaims

	*ClientRegistration
}

type Registry struct {
	StatelessCreator   func(ctx context.Context, signingMethod jwt.SigningMethod, claims jwt.Claims) (string, error)
	StatelessValidator func(token *jwt.Token) (interface{}, error)
	// contains filtered or unexported fields
}

type RegistryData struct {
	Clients []*ClientRegistration `yaml:"clients,flow"`
}

type Secured struct {
	ID              string
	DisplayName     string
	ApplicationType string

	Kid       string
	PublicKey crypto.PublicKey

	TrustedScopes []string

	Registration *ClientRegistration
}