policies

type AuthorizationList map[string]bool

type AuthorizationMap map[string]string

type MatchBearer struct {
	Token           string            `json:"token,omitempty"`             // Raw bearer token
	JWTAlg          string            `json:"jwt_alg,omitempty"`           // JWT algorithm
	JWTSecretBase64 string            `json:"jwt_secret_base64,omitempty"` // JWT secret key or shared secret
	JWTKeyBase64    string            `json:"jwt_key_base64,omitempty"`    // JWT public key
	Authorizations  AuthorizationList `json:"authorizations,omitempty"`
}

type MatchContext struct {
	*Policies
	Request *http.Request
}

type Matcher struct {
	// A matcher matches if all of its defined matchers succeeds. if nothing
	// defined, it does not match
	Meta           map[string]string `json:"meta,omitempty"`                   // Metadata
	Authorizations AuthorizationMap  `json:"authorizations,omitempty"`         // Transform authorizations
	DefAuthz       AuthorizationList `json:"default_authorizations,omitempty"` // Default authorizations
	Always         bool              `json:"always,omitempty"`                 // Always match (conditioned to other defined matchers)
	Never          bool              `json:"never,omitempty"`                  // Never match, can be used to disable a matcher
	Skip           bool              `json:"skip,omitempty"`                   // Skip matches other than always and never
	All            []*Matcher        `json:"all,omitempty"`                    // All must match
	Any            []*Matcher        `json:"any,omitempty"`                    // Any must match
	None           []*Matcher        `json:"none,omitempty"`                   // None must match
	Bearer         []*MatchBearer    `json:"bearer,omitempty"`                 // A bearer token in the list should match
	Origin         []string          `json:"origin,omitempty"`                 // One of these origins must match the Origin header
	Policy         *PolicyRef        `json:"policy,omitempty"`                 // Match policy by name, fail if it does not exist
}

type Policies struct {
	ByName map[string]*Policy
	ByPath map[string]*Policy
}

type Policy struct {
	Name                 string     `json:"name"` // Must correspond to file name
	PolicyDir            string     `json:"-"`
	Match                []*Matcher `json:"match,omitempty"` // Policy match if any matcher succeeds
	DefaultAuthorization string     `json:"default_authorization,omitempty"`
}

type PolicyMatcher interface {
	Matching(mc *MatchContext) (bool, error)
}

type PolicyNotFoundError struct {
	Name string
}

type PolicyRef PolicyRefImplem

type PolicyRefImplem struct {
	Name           string           `json:"name"`
	Authorizations AuthorizationMap `json:"authorizations,omitempty"` // Authorization transformation
}