authn

type Authenticator struct {
	Type         string
	Authenticate func(*http.Request) error
	Forbidden    func(w http.ResponseWriter, r *http.Request, err error)

	// ShareValueSlice writes the WWW-Authenticate value from a single slice
	// shared across requests instead of allocating one per unauthenticated
	// response. Type is fixed at construction, so this is safe as long as
	// nothing mutates the response header value slice in place. Off by
	// default; see header.SetShared.
	ShareValueSlice bool
}

type BasicAuthenticator struct {
	Realm        string
	Authenticate func(r *http.Request, username, password string) error

	// ShareValueSlice writes the WWW-Authenticate value from a single slice
	// shared across requests instead of allocating one per unauthenticated
	// response. The value is fixed at construction (it depends only on Realm),
	// so this is safe as long as nothing mutates the response header value
	// slice in place. Off by default; see header.SetShared.
	ShareValueSlice bool
}

type ForwardAuthenticator struct {
	URL                 *url.URL
	Client              *http.Client
	AuthRequestHeaders  []string
	AuthResponseHeaders []string
}

type ForwardServerError struct {
	Response         *http.Response
	OriginError      error
	StatusCode       int
	IsTransportError bool
}

type JWTAuthenticator struct {
	// Key verifies the token signature. See JWT for accepted types.
	Key any

	// Algorithms is the set of accepted signature algorithms. It is required;
	// when empty every request is rejected.
	Algorithms []jose.SignatureAlgorithm

	// Issuer and Audience, when set, must match the token's "iss" and "aud"
	// claims respectively.
	Issuer   string
	Audience string

	// Leeway tolerates clock skew when checking the time-based claims "exp",
	// "nbf" and "iat". Defaults to jwt.DefaultLeeway (1 minute).
	Leeway time.Duration

	// Realm is reported in the WWW-Authenticate challenge on rejection.
	Realm string

	// Now overrides the clock used for claim validation. Defaults to time.Now;
	// mainly useful for tests.
	Now func() time.Time

	// ShareValueSlice shares the fixed WWW-Authenticate value slice across
	// rejected responses instead of allocating one per request. See
	// Authenticator.ShareValueSlice.
	ShareValueSlice bool
}