provider

type AuthConfig struct {
	Header          string   `json:"header,omitempty"`
	Prefix          string   `json:"prefix,omitempty"`
	Encoding        string   `json:"encoding,omitempty"`
	Algorithm       string   `json:"algorithm,omitempty"`
	Username        string   `json:"username,omitempty"`
	Issuer          string   `json:"issuer,omitempty"`
	Audience        []string `json:"audience,omitempty"`
	TopicARN        string   `json:"topic_arn,omitempty"`
	ExpectedEmail   string   `json:"expected_email,omitempty"`
	ExpectedSubject string   `json:"expected_subject,omitempty"`
}

type AuthType string

type Base struct {
	ProviderName     string
	ProviderDefaults Defaults
}

type CallerField string

type Defaults struct {
	Auth         AuthType
	Envelope     EnvelopeType
	AuthConfig   AuthConfig
	TypeFrom     envelope.FieldSelector
	IDFrom       envelope.FieldSelector
	CallerFields []CallerField
	// NativeProtocol marks providers that speak their own webhook protocol:
	// the envelope decoder is fixed and field selectors do not apply.
	NativeProtocol bool
	// CallerSecret marks providers whose signing secret is issued by the
	// external provider and supplied by the caller at creation time. Such
	// secrets are write-only: they cannot be revealed, rotated, or revoked
	// independently of the trigger.
	CallerSecret bool
}

type EnvelopeType string

type Handshake struct {
	Status int
	Body   map[string]string
}

type Provider interface {
	Name() string
	Defaults() Defaults
	// Decoder returns the envelope decoder for the trigger's configured
	// envelope type. Native-protocol providers ignore the envelope type.
	Decoder(envelopeType EnvelopeType) (envelope.Decoder, error)
	// Verifier returns the shared-secret verifier for the trigger's auth
	// mechanism, or nil for mechanisms that do not verify against managed
	// secrets (none, bearer_jwt, sns_signature).
	Verifier(auth AuthType, cfg AuthConfig) signature.Verifier
	// Handshake inspects a decoded event and returns a non-nil response when
	// the request is a protocol handshake rather than an event delivery.
	Handshake(event *envelope.Event) (*Handshake, error)
	// RejectStatus returns the HTTP status for an envelope decode failure.
	// http.StatusAccepted means record the rejection and acknowledge the
	// delivery; other statuses surface the error to the sender.
	RejectStatus(err error) int
}