auth

type AllowAllPermissionChecker struct{}

type AuthHookConfig struct {
	Validator TokenValidator // The configured token validator (e.g., JWKSTokenValidator)
	// Add other config as needed, e.g., how to extract token (header, param, etc.)
	TokenHeader string // e.g., "Authorization"
	TokenPrefix string // e.g., "Bearer "
}

type JWKSConfig struct {
	// JWKSURL is the URL of the JSON Web Key Set endpoint. (Required)
	JWKSURL string
	// ExpectedIssuer is the required value for the 'iss' claim. (Optional)
	ExpectedIssuer string
	// ExpectedAudience is the required value for the 'aud' claim. (Optional)
	ExpectedAudience string
	// ClockSkew defines the acceptable time difference for validating expiry ('exp') and not before ('nbf') claims. Defaults to 0.
	ClockSkew time.Duration
	// RefreshInterval defines how often to refresh the JWK set from the URL. Defaults to 1 hour.
	RefreshInterval time.Duration
}

type JWKSTokenValidator struct {
	// contains filtered or unexported fields
}

type PermissionChecker interface {
	// CheckPermission verifies if the given principal has the necessary permissions
	// for the specified MCP method and parameters.
	// It should return nil if authorized, or an error (e.g., a *protocol.ErrorPayload
	// with ErrorCodePermissionDenied) if not.
	CheckPermission(ctx context.Context, principal Principal, method string, params interface{}) error
}

type Principal interface {
	// GetClaims returns the claims associated with the principal.
	// The specific type of claims depends on the token format (e.g., map[string]interface{} for JWT).
	GetClaims() interface{}
	// GetSubject returns a unique identifier for the principal (e.g., 'sub' claim from JWT).
	GetSubject() string
}

type TokenValidator interface {
	// ValidateToken attempts to validate the given token string.
	// It returns the authenticated Principal if validation is successful,
	// or an error (potentially a *protocol.ErrorPayload for specific JSON-RPC errors) otherwise.
	ValidateToken(ctx context.Context, tokenString string) (Principal, error)
}