auth

type ApiKeyDetails struct {
	DisplayName      string    `json:"displayName"`
	OwnedByWorkspace string    `json:"ownedByWorkspace"`
	ExpiresAt        time.Time `json:"expiresAt,omitzero"`
	// ExpiresOn is the expiry date, set only by a meshStack that does not send the expiry time
	// yet. It is not turned into a time: the date of an ephemeral key is the day it expires on,
	// not the last day it works.
	ExpiresOn        string                   `json:"expiresOn,omitzero"`
	Permissions      []string                 `json:"permissions"`
	PermissionGroups client.ApiKeyPermissions `json:"-"`
}

type ApiKeyStatus struct {
	ClientId uuid.UUID      `json:"clientId"`
	Details  *ApiKeyDetails `json:"details,omitzero"`
}

type Credential struct {
	credential.Credential

	// Sources must never carry a secret, as a status shows them.
	Sources []string
	// Stored is set for the credential the profile stores, and not for one that settings provide.
	Stored bool
	// contains filtered or unexported fields
}

type CredentialStatus struct {
	Profile   profile.Name        `json:"profile"`
	Endpoint  xurl.URL            `json:"endpoint"`
	Kind      credential.Name     `json:"credential"`
	Sources   []string            `json:"sources"`
	Workspace meshstack.Workspace `json:"workspace,omitzero"`
	// Token is read from the cached access token without verifying it, and is nil while none is
	// cached.
	Token *TokenStatus `json:"token,omitzero"`

	// OidcLogin is set for a browser login. ApiKey is set for an API key, and for an API token that
	// an API key minted.
	OidcLogin *OidcLoginStatus `json:"oidcLogin,omitzero"`
	ApiKey    *ApiKeyStatus    `json:"apiKey,omitzero"`

	Unused []UnusedCredential `json:"unusedCredentials,omitzero"`
}

type OidcLoginStatus struct {
	Issuer      xurl.URL              `json:"issuer"`
	AccessLevel meshstack.AccessLevel `json:"accessLevel"`
	// SessionEndsAt is an upper bound, as a logout or an administrator can end the session
	// earlier.
	SessionEndsAt time.Time `json:"sessionEndsAt,omitzero"`
}

type ResolveSessionOptions struct {
	SettingSources

	// Version of the calling front end and GitHubRepo, as "<org>/<repo>", where its releases live.
	// Both are required: together they are the User-Agent, and they name the release to check against.
	Version    string
	GitHubRepo string
}

type Session struct {
	CurrentProfile *profile.Profile

	Credential Credential
	Client     func() (client.Client, error)
	MeshInfo   func() (client.MeshInfo, error)
	// contains filtered or unexported fields
}

type SettingSources = setting.Sources

type StoreFunc func(context.Context) error

type TokenStatus struct {
	ExpiresAt   time.Time             `json:"expiresAt,omitzero"`
	User        string                `json:"user,omitzero"`
	Email       string                `json:"email,omitzero"`
	Workspace   meshstack.Workspace   `json:"workspace,omitzero"`
	ClientId    string                `json:"clientId,omitzero"`
	AccessLevel meshstack.AccessLevel `json:"accessLevel,omitzero"`
}

type UnusedCredential struct {
	Kind credential.Name `json:"credential"`
	// Selected is set for the credential the profile selects, which a flag or the environment
	// replaces.
	Selected bool `json:"selected,omitzero"`
	// ClientId is set for an API key.
	ClientId string `json:"clientId,omitzero"`
	// Token is the cached token of a browser login or an API token.
	Token *TokenStatus `json:"token,omitzero"`
}