security

type Authorizer interface {
	// Enforce checks whether the subject (sub) is permitted to access resource (obj) with action (act).
	Enforce(ctx context.Context, sub, obj, act string) (bool, error)
}

type CaptchaStore interface {
	// Set stores the captcha value associated with the given id.
	// Set 存储与给定 id 关联的验证码值。
	Set(id string, value string) error

	// Get retrieves the captcha value associated with the given id.
	// If clear is true, the captcha value will be deleted after reading.
	// Get 获取与给定 id 关联的验证码值。如果 clear 为 true，则读取后清除。
	Get(id string, clear bool) string

	// Verify checks whether the answer matches the stored captcha value.
	// If clear is true, the captcha value will be deleted upon verification.
	// Verify 校验答案是否与存储的验证码相符。如果 clear 为 true，校验后清除。
	Verify(id, answer string, clear bool) bool
}

type Container = runtimecontract.Container

type JWTClaims struct {
	SubjectID   int64
	SubjectType string
	SubjectName string
	Roles       []string
	Permissions []string // Fine-grained permissions (e.g. "order:create", "user:delete")
	ExpiresAt   int64
	IssuedAt    int64
	Issuer      string
	Audience    string
}

type JWTService interface {
	// Sign signs one set of JWT claims.
	//
	// Sign 对一组 JWT claims 进行签发。
	Sign(claims JWTClaims) (string, error)

	// Verify verifies one JWT token and returns claims.
	//
	// Verify 校验一个 JWT token 并返回 claims。
	Verify(token string) (*JWTClaims, error)

	// NewClaims builds one standard JWT claims object.
	//
	// NewClaims 构建一份标准 JWT claims。
	NewClaims(subjectID int64, subjectType, subjectName string, roles []string, ttlSeconds int64) JWTClaims
}

type ServiceAuthConfig struct {
	Mode        string
	ServiceName string
	Namespace   string
	Environment string

	MTLSEnabled    bool
	MTLSCertFile   string
	MTLSKeyFile    string
	MTLSCAFile     string
	MTLSServerName string

	TokenSecret   string
	TokenExpiry   int64
	TokenIssuer   string
	TokenAudience string

	AllowedServices []string
}

type ServiceAuthProvider interface {
	ServiceProvider

	// CreateAuthenticator creates a service authenticator from config.
	//
	// CreateAuthenticator 根据配置创建服务认证器。
	CreateAuthenticator(cfg *ServiceAuthConfig) (ServiceAuthenticator, error)
}

type ServiceAuthenticator interface {
	// Authenticate authenticates the current request and returns the resolved service identity.
	//
	// Authenticate 认证当前请求并返回解析出的服务身份。
	Authenticate(ctx context.Context) (*ServiceIdentity, error)
}

type ServiceIdentity struct {
	ServiceID   string
	ServiceName string
	Namespace   string
	Environment string
	Metadata    map[string]string
}

type ServicePeerCertificateAuthenticator interface {
	// AuthenticatePeerCertificate authenticates the peer certificate and returns the resolved service identity.
	//
	// AuthenticatePeerCertificate 校验对端证书并返回解析出的服务身份。
	AuthenticatePeerCertificate(ctx context.Context, cert *x509.Certificate) (*ServiceIdentity, error)
}

type ServiceProvider = runtimecontract.ServiceProvider

type ServiceTokenIssuer interface {
	// GenerateToken generates a token for the target service.
	//
	// GenerateToken 为目标服务生成令牌。
	GenerateToken(ctx context.Context, targetService string) (string, error)
}

type ServiceTokenVerifier interface {
	// VerifyToken verifies a token and returns the resolved service identity.
	//
	// VerifyToken 校验令牌并返回解析出的服务身份。
	VerifyToken(ctx context.Context, token string) (*ServiceIdentity, error)
}

type TLSCertificateLoader interface {
	LoadCertificate(certFile, keyFile string) (*tls.Certificate, error)
	LoadCA(caFile string) (*x509.CertPool, error)
}