security

type AdminSettings struct {
	// Username is the username for the admin user.
	Username string
	// Password is the password for the admin user.
	Password string
	// Email is the email address for the admin user.
	// This is used in jwt claims.
	Email string
}

type AdminUsecase interface {
	// BasicAuth authenticates the user using basic authentication with username and password.
	BasicAuth(ctx context.Context, username, password string) (LoginResult, error)
}

type BasicAuthSettings struct {
	// Pepper is a server-side secret mixed into every basic-auth password hash.
	// It must be a long, random value set once and kept stable for the lifetime of the
	// stored credentials. When empty, basic-auth user creation and password login are disabled.
	Pepper string
}

type Config struct {
	// JWTSettings holds the configuration settings for JSON Web Tokens (JWT).
	JWTSettings JWTSettings
	// AdminSettings holds the configuration settings for admin authentication.
	AdminSettings AdminSettings
	// BasicAuthSettings holds the configuration settings for DB-backed basic-auth users.
	BasicAuthSettings BasicAuthSettings
	// OAuthSettings holds the configuration settings for OAuth2 authentication.
	OAuthSettings *OAuthSettings
}

type JWTSettings struct {
	SigningKey string
	Issuer     string
	Expiration time.Duration
	// RefreshExpiration is the lifetime of refresh tokens issued alongside access tokens.
	// Zero means refresh tokens are disabled.
	RefreshExpiration time.Duration
	Audience          []string
}

type LoginResult struct {
	Token        string
	RefreshToken string
	ExpiresAt    time.Time
	Email        string
	Groups       []string // provider group/org memberships, added as labels to the user on login
}

type OAuth2Usecase interface {
	// AuthCodeURL generates the OAuth2 authorization URL with a unique state parameter.
	// cliRedirect is an optional loopback redirect URI (e.g. http://127.0.0.1:PORT/callback)
	// to be encoded into the state JWT; on callback the server redirects to it instead of
	// returning JSON. Empty string preserves the legacy JSON behavior.
	AuthCodeURL(cliRedirect string) (string, error)
	// CLIRedirectFromState extracts the loopback redirect URI from a state JWT, if any.
	CLIRedirectFromState(state string) (string, error)
	// Exchange exchanges the OAuth2 authorization code for an access token.
	Exchange(ctx context.Context, state, code string) (LoginResult, error)
}

type OAuthSettings struct {
	// ClientID is the OAuth2 client ID for GitHub authentication.
	ClientID string
	// Secret is the OAuth2 client secret for GitHub authentication.
	Secret string
	// CallbackURL is the URL to which GitHub will redirect after authentication.
	CallbackURL string
	// AllowedRedirectHosts is the list of additional hostnames that the
	// /api/v1/auth/github/authcode endpoint will accept as redirect targets,
	// in addition to the always-allowed loopback hosts (127.0.0.1, ::1,
	// localhost). Use this to allowlist the web UI deployment (e.g.
	// "opampcommander-alpha.minuk.dev"). Empty by default.
	AllowedRedirectHosts []string
	// JWTSettings holds the JWT configuration settings.
	// This is used for the state parameter in OAuth2 authentication.
	JWTSettings JWTSettings
}

type OAuthStateClaims struct {
	jwt.RegisteredClaims

	// CLIRedirect, when non-empty, signals the callback handler to redirect the browser
	// to this loopback URI (with token query params) instead of returning JSON.
	CLIRedirect string `json:"cliRedirect,omitempty"`
}

type OPAMPClaims struct {
	jwt.RegisteredClaims

	Email string `json:"email"`
	// TokenType is "access" or "refresh". Empty value is treated as "access" for backward compatibility.
	TokenType string `json:"tokenType,omitempty"`
}

type PasswordHasher struct {
	// contains filtered or unexported fields
}

type Service struct {
	// contains filtered or unexported fields
}

type UnsupportedTokenTypeError struct {
	TokenType string
}

type Usecase interface {
	// ValidateToken validates the provided JWT token string and returns the claims if valid.
	ValidateToken(tokenString string) (*OPAMPClaims, error)
	// Refresh exchanges a valid refresh token for a new access token (and rotated refresh token).
	Refresh(refreshToken string) (LoginResult, error)

	// AdminUsecase returns the use case for admin authentication.
	AdminUsecase
	// OAuth2Usecase returns the use case for OAuth2 authentication.
	OAuth2Usecase
}

type User struct {
	// Authenticated indicates if the user is authenticated
	Authenticated bool
	// Email is the primary email of the user
	// If the user is not authenticated, this will be nil
	Email *string
}