credential

type ApiKey struct {
	Endpoint     xurl.URL
	ClientId     uuid.UUID `json:"client_id"`
	ClientSecret string    `json:"client_secret"`

	Cache *struct {
		Token jwt.JWT `json:"token,omitzero"`
	} `json:"-"`
}

type Credential interface {
	Name() Name
	// Identity identifies the credential, so that a cache minted for another one is not used.
	Identity() Identity
	// CachedToken does not check the expiry. The caller does, and calls RefreshCachedToken for an
	// expired token.
	CachedToken(ctx context.Context, getWorkspace getWorkspaceFunc) (token jwt.JWT, found bool)
	// RefreshCachedToken re-mints the token, so a CachedToken call after it finds one.
	RefreshCachedToken(ctx context.Context, client http.Client, getWorkspace getWorkspaceFunc) error
}

type Credentials struct {
	ApiKey    *ApiKey    `json:"apiKey,omitempty"`
	Manual    *Manual    `json:"manual,omitempty"`
	OidcLogin *OidcLogin `json:"oidcLogin,omitempty"`
}

type Identity struct {
	Hash string
}

type Manual struct {
	Endpoint xurl.URL `json:"endpoint"`
	Cache    *struct {
		Token jwt.JWT `json:"token"`
	} `json:"-"`
}

type Name string

type OidcLogin struct {
	Endpoint xurl.URL `json:"endpoint"`
	Issuer   xurl.URL `json:"issuer"`
	ClientId string   `json:"clientId"`
	// AccessLevel is empty for a login of an older CLI, or on a meshStack without access levels.
	AccessLevel meshstack.AccessLevel `json:"accessLevel,omitzero"`
	Cache       *struct {
		RefreshToken     string                  `json:"refreshToken"`
		RefreshExpiresAt time.Time               `json:"refreshExpiresAt,omitzero"`
		ScopedTokens     map[scope.Scope]jwt.JWT `json:"tokens,omitzero"`
	} `json:"-"`
}