authn

type Authenticator struct {
	Type         string
	Authenticate func(*http.Request) error
	Forbidden    func(w http.ResponseWriter, r *http.Request, err error)

	// ShareValueSlice writes the WWW-Authenticate value from a single slice
	// shared across requests instead of allocating one per unauthenticated
	// response. Type is fixed at construction, so this is safe as long as
	// nothing mutates the response header value slice in place. Off by
	// default; see header.SetShared.
	ShareValueSlice bool
}

type BasicAuthenticator struct {
	Realm        string
	Authenticate func(r *http.Request, username, password string) error

	// ShareValueSlice writes the WWW-Authenticate value from a single slice
	// shared across requests instead of allocating one per unauthenticated
	// response. The value is fixed at construction (it depends only on Realm),
	// so this is safe as long as nothing mutates the response header value
	// slice in place. Off by default; see header.SetShared.
	ShareValueSlice bool
}

type ForwardAuthenticator struct {
	URL                 *url.URL
	Client              *http.Client
	AuthRequestHeaders  []string
	AuthResponseHeaders []string
}

type ForwardServerError struct {
	Response         *http.Response
	OriginError      error
	StatusCode       int
	IsTransportError bool
}

type JWKS struct {
	// URL is the jwks_uri to fetch the key set from. Required.
	URL string

	// Client fetches the key set. Defaults to an *http.Client with a 10s
	// timeout. Give it a tighter timeout or a custom transport as needed.
	Client *http.Client

	// RefreshInterval is how long a fetched set is served before it is treated
	// as stale and refetched (in the background) on the next use. Defaults to
	// 15m.
	RefreshInterval time.Duration

	// MinRefreshInterval rate-limits unknown-kid refetches: a token whose kid is
	// absent from the cached set triggers a refetch only if at least this long
	// has passed since the last fetch. It stops a flood of tokens bearing bogus
	// kids from hammering the jwks_uri. Defaults to 1m.
	MinRefreshInterval time.Duration

	// MaxResponseBytes caps how many bytes of the JWKS response body are read,
	// defending against a hostile or runaway endpoint. Defaults to 1 MiB.
	MaxResponseBytes int64

	// Now overrides the clock used for cache aging; mainly for tests. Defaults
	// to time.Now.
	Now func() time.Time
	// contains filtered or unexported fields
}

type JWTAuthenticator struct {
	// Key verifies the token signature. See JWT for accepted types. Ignored when
	// KeySource is set.
	Key any

	// KeySource, when set, supplies the verification key dynamically at request
	// time (e.g. a rotating remote JWKS via JWKS) and takes precedence over Key.
	// The token's "kid" header is passed to it so it can select or refresh keys.
	KeySource KeySource

	// Algorithms is the set of accepted signature algorithms. It is required;
	// when empty every request is rejected.
	Algorithms []SignatureAlgorithm

	// Issuer and Audience, when set, must match the token's "iss" and "aud"
	// claims respectively.
	Issuer   string
	Audience string

	// Leeway tolerates clock skew when checking the time-based claims "exp",
	// "nbf" and "iat". Defaults to jwt.DefaultLeeway (1 minute).
	Leeway time.Duration

	// Realm is reported in the WWW-Authenticate challenge on rejection.
	Realm string

	// Now overrides the clock used for claim validation. Defaults to time.Now;
	// mainly useful for tests.
	Now func() time.Time

	// ShareValueSlice shares the fixed WWW-Authenticate value slice across
	// rejected responses instead of allocating one per request. See
	// Authenticator.ShareValueSlice.
	ShareValueSlice bool
}

type KeySource interface {
	VerificationKey(ctx context.Context, kid string) (any, error)
}

type SignatureAlgorithm string