auth

type Authenticator interface {
	Authenticate(ctx context.Context, bearerToken string) (Principal, error)
}

type Authorizer interface {
	AuthorizeProject(ctx context.Context, principal Principal, projectName string) error
}

type Error struct {
	// Status is 401 (authentication) or 403 (authorization).
	Status  int
	Message string
}

type Principal struct {
	// Subject is the stable identifier the control plane returned for the
	// token (the TokenReview's user.username).
	Subject string
	// UID and Groups are the rest of the identity the TokenReview resolved.
	//
	// They are not decoration: Milo's authorizer binds policy to a user's ID,
	// not to the username string, so a SubjectAccessReview carrying only
	// Subject is answered "not allowed" even when the caller genuinely has the
	// grant. Carry the whole identity through to the authorization call.
	UID    string
	Groups []string
	// Extra is whatever additional context the control plane attached to the
	// identity. Carried through to authorization rather than dropped.
	Extra map[string][]string
}

type ResourceAttributes struct {
	Namespace string `json:"namespace,omitempty"`
	Verb      string `json:"verb,omitempty"`
	Group     string `json:"group,omitempty"`
	Resource  string `json:"resource,omitempty"`
	Name      string `json:"name,omitempty"`
}

type SARConfig struct {
	// APIURL is the control-plane API base URL the SAR is POSTed to
	// (e.g. https://kubernetes.default.svc). Required unless Reviewer is set.
	APIURL string
	// BearerToken is the ASSISTANT's own service-account token, sent as the
	// Authorization header so the apiserver authenticates the caller. This is
	// distinct from the User in the SAR body (the principal under review).
	// Ignored when Reviewer is injected.
	BearerToken string
	// CACert is the PEM-encoded apiserver CA bundle. Empty falls back to the
	// system roots. Ignored when Reviewer is injected.
	CACert []byte
	// ClientCert/ClientKey are the PEM-encoded client certificate the assistant
	// presents to identify ITSELF to the control plane, as an alternative to
	// BearerToken. Both or neither. Ignored when Reviewer is injected.
	ClientCert []byte
	ClientKey  []byte

	// Group, Resource, Verb are the resourceAttributes the SAR asks about.
	// Empty fields fall back to the Default* constants.
	Group    string
	Resource string
	Verb     string

	// Timeout bounds a single SAR round-trip. Zero uses DefaultSARTimeout.
	Timeout time.Duration
	// CacheTTL bounds how long an ALLOW is reused. Zero uses DefaultSARCacheTTL;
	// a negative value disables the cache (every request round-trips).
	CacheTTL time.Duration

	// Logger records refused reviews. Optional.
	Logger *slog.Logger

	// Reviewer overrides the default HTTP reviewer — tests inject a fake.
	Reviewer SubjectAccessReviewer
	// contains filtered or unexported fields
}

type SubjectAccessReview struct {
	APIVersion string                     `json:"apiVersion"`
	Kind       string                     `json:"kind"`
	Spec       SubjectAccessReviewSpec    `json:"spec"`
	Status     *SubjectAccessReviewStatus `json:"status,omitempty"`
}

type SubjectAccessReviewSpec struct {
	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty"`
	// User is the subject under review — the authenticated principal, NOT the
	// assistant's own identity (that is the client certificate on the HTTP
	// call).
	User string `json:"user,omitempty"`
	// UID and Groups complete the subject's identity. Milo binds policy to a
	// user's ID rather than to the username string, so omitting UID makes an
	// otherwise-valid grant evaluate as "not allowed".
	UID    string   `json:"uid,omitempty"`
	Groups []string `json:"groups,omitempty"`
	// Extra carries the parent-resource context that tells Milo which scope to
	// evaluate the review in. See parentExtra.
	Extra map[string][]string `json:"extra,omitempty"`
}

type SubjectAccessReviewStatus struct {
	Allowed         bool   `json:"allowed"`
	Denied          bool   `json:"denied,omitempty"`
	Reason          string `json:"reason,omitempty"`
	EvaluationError string `json:"evaluationError,omitempty"`
}

type SubjectAccessReviewer interface {
	Review(ctx context.Context, review *SubjectAccessReview) (*SubjectAccessReviewStatus, error)
}

type TokenReview struct {
	APIVersion string             `json:"apiVersion"`
	Kind       string             `json:"kind"`
	Spec       TokenReviewSpec    `json:"spec"`
	Status     *TokenReviewStatus `json:"status,omitempty"`
}

type TokenReviewConfig struct {
	// APIURL is the control-plane API base URL the TokenReview is POSTed to
	// (e.g. https://kubernetes.default.svc). Required unless Reviewer is set.
	APIURL string
	// BearerToken is the ASSISTANT's own service-account token, sent as the
	// Authorization header so the apiserver authenticates the caller. This is
	// distinct from the token in the TokenReview body (the token under review).
	// Ignored when Reviewer is injected.
	BearerToken string
	// CACert is the PEM-encoded apiserver CA bundle. Empty falls back to the
	// system roots. Ignored when Reviewer is injected.
	CACert []byte
	// ClientCert/ClientKey are the PEM-encoded client certificate the assistant
	// presents to identify ITSELF to the control plane, as an alternative to
	// BearerToken. Milo accepts service-account tokens only from its own
	// issuer, so a workload-cluster token is rejected and mTLS is the path that
	// works; see newControlPlaneTransport. Both or neither. Ignored when
	// Reviewer is injected.
	ClientCert []byte
	ClientKey  []byte

	// Timeout bounds a single TokenReview round-trip. Zero uses the default.
	Timeout time.Duration
	// CacheTTL bounds how long a successful resolution is reused. Zero uses the
	// default; a negative value disables the cache (every request round-trips).
	CacheTTL time.Duration

	// Reviewer overrides the default HTTP reviewer — tests inject a fake.
	Reviewer TokenReviewer
	// contains filtered or unexported fields
}

type TokenReviewSpec struct {
	Token string `json:"token,omitempty"`
}

type TokenReviewStatus struct {
	Authenticated bool     `json:"authenticated"`
	User          UserInfo `json:"user,omitempty"`
	Error         string   `json:"error,omitempty"`
}

type TokenReviewer interface {
	Review(ctx context.Context, review *TokenReview) (*TokenReviewStatus, error)
}

type UserInfo struct {
	Username string              `json:"username,omitempty"`
	UID      string              `json:"uid,omitempty"`
	Groups   []string            `json:"groups,omitempty"`
	Extra    map[string][]string `json:"extra,omitempty"`
}