auth

type BasicFeatureGate struct{}

type Feature string

type FeatureGate interface {
	Allow(ctx context.Context, request FeatureRequest) (bool, error)
}

type FeatureRequest struct {
	OrganizationID string
	MemberID       string
	Feature        Feature
}

type HMACInternalTokenSigner struct {
	Secret                []byte
	ExpectedSourceService string
}

type HMACWebUserTokenSigner struct {
	Secret                []byte
	ExpectedSourceService string
}

type InternalClaims struct {
	UserID         string               `json:"user_id"`
	OrganizationID string               `json:"organization_id"`
	MemberID       string               `json:"member_id"`
	SourceService  string               `json:"source_service"`
	Roles          []string             `json:"roles"`
	Permissions    []string             `json:"permissions"`
	ResourceScopes []ResourceScopeClaim `json:"resource_scopes,omitempty"`
	ExpiresAt      time.Time            `json:"expires_at"`
}

type InternalTokenVerifier interface {
	Verify(token string) (InternalClaims, error)
}

type ResourceScopeClaim struct {
	ResourceType string `json:"resource_type"`
	ResourceID   string `json:"resource_id"`
	AccessLevel  string `json:"access_level"`
}

type WebUserClaims struct {
	UserID        string              `json:"user_id"`
	Email         string              `json:"email"`
	Name          string              `json:"name"`
	SourceService string              `json:"source_service"`
	Purpose       WebUserTokenPurpose `json:"purpose"`
	ExpiresAt     time.Time           `json:"expires_at"`
}

type WebUserTokenPurpose string

type WebUserTokenVerifier interface {
	Verify(token string, expectedPurpose WebUserTokenPurpose) (WebUserClaims, error)
}