oauth

type AuthorizationServerMetadata struct {
	// Issuer defines the authorization server's identifier, which is a URL that uses the "https" scheme and has no query or fragment components.
	Issuer string `json:"issuer,omitempty"`

	// AuthorizationEndpoint defines the URL of the authorization server's authorization endpoint [RFC6749]
	AuthorizationEndpoint string `json:"authorization_endpoint,omitempty"`

	// ResponseTypesSupported defines what response types a client can request
	ResponseTypesSupported []string `json:"response_types_supported,omitempty"`

	// ResponseModesSupported defines what response modes a client can request
	// Currently supports
	// - query for response_type=code
	// - direct_post for response_type=["vp_token", "vp_token id_token"]
	// TODO: is `form_post` something we want in the future?
	ResponseModesSupported []string `json:"response_modes_supported,omitempty"`

	// TokenEndpoint defines the URL of the authorization server's token endpoint [RFC6749].
	TokenEndpoint string `json:"token_endpoint,omitempty"`

	// GrantTypesSupported is a list of the OAuth 2.0 grant type values that this authorization server supports.
	GrantTypesSupported []string `json:"grant_types_supported,omitempty"`

	// PreAuthorizedGrantAnonymousAccessSupported indicates whether anonymous access (requests without client_id) for pre-authorized code grant flows.
	// See https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-oauth-20-authorization-serv
	PreAuthorizedGrantAnonymousAccessSupported bool `json:"pre-authorized_grant_anonymous_access_supported,omitempty"`

	// PresentationDefinitionEndpoint defines the URL of the authorization server's presentation definition endpoint.
	// See https://nuts-foundation.gitbook.io/drafts/rfc/rfc021-vp_token-grant-type
	PresentationDefinitionEndpoint string `json:"presentation_definition_endpoint,omitempty"`

	// PresentationDefinitionUriSupported specifies whether the Wallet supports the transfer of presentation_definition by reference, with true indicating support.
	// If omitted, the default value is true. (hence pointer, or add custom unmarshalling)
	PresentationDefinitionUriSupported *bool `json:"presentation_definition_uri_supported,omitempty"`

	// VPFormatsSupported is an object containing a list of key value pairs, where the key is a string identifying a Credential format supported by the Wallet.
	VPFormatsSupported map[string]map[string][]string `json:"vp_formats_supported,omitempty"`

	// VPFormats is an object containing a list of key value pairs, where the key is a string identifying a Credential format supported by the Verifier.
	// TODO: Remove. VPFormatsSupported is the correct param, but the OpenID4VP spec is ambiguous so support both for now.
	VPFormats map[string]map[string][]string `json:"vp_formats,omitempty"`

	// ClientIdSchemesSupported defines the `client_id_schemes` currently supported.
	// If omitted, the default value is `pre-registered` (referring to the client), which is currently not supported.
	ClientIdSchemesSupported []string `json:"client_id_schemes_supported,omitempty"`

	// DIDMethodsSupported is a JSON array containing a list of the DID Methods (without scheme 'did:') that are supported by the Authorization Server.
	// Note: this is a custom parameter, not part of the OpenID4VC specifications.
	DIDMethodsSupported []string `json:"did_methods_supported,omitempty"`

	// DPoPSigningAlgValuesSupported is a JSON array containing a list of the DPoP proof JWS signing algorithms ("alg" values) supported by the token endpoint.
	DPoPSigningAlgValuesSupported []string `json:"dpop_signing_alg_values_supported,omitempty"`

	// RequireSignedRequestObject specifies if the authorization server requires the use of signed request objects.
	RequireSignedRequestObject bool `json:"require_signed_request_object,omitempty"`

	// RequestObjectSigningAlgValuesSupported is a JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core].
	// These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter).
	RequestObjectSigningAlgValuesSupported []string `json:"request_object_signing_alg_values_supported,omitempty"`
}

type EntityStatementMetadata struct {
	// OpenIDProvider: the metadata of the OpenID provider
	OpenIDProvider AuthorizationServerMetadata `json:"openid_provider"`
}

type ErrorCode string

type OAuth2Error struct {
	// Code is the error code as defined by the OAuth2 specification.
	Code ErrorCode `json:"error"`
	// Description is a human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred.
	Description string `json:"error_description,omitempty"`
	// InternalError is the underlying error, may be omitted. It is not intended to be returned to the client, only to be logged.
	InternalError error `json:"-"`
	// RedirectURI is the redirect URI that should be used to redirect the client to, in case the user-agent is a browser.
	// It should not be set if the user-agent is not a browser, or there is no redirect_uri (because the request was malformed), this field is empty.
	// When the field is set, the user-agent is redirected to the specified URI with the error code and description as query parameters.
	// If it's not set, the error code and description are returned in the response body (plain text or JSON).
	RedirectURI *url.URL `json:"-"`
}

type OAuthClientMetadata struct {
	// RedirectURIs lists all URIs that the client may use in any redirect-based flow.
	// From https://www.rfc-editor.org/rfc/rfc7591.html
	RedirectURIs []string `json:"redirect_uris,omitempty"`

	// TODO: What do we use? Must provide a value if its not "client_secret_basic"
	// TokenEndpointAuthMethod indicator of the requested authentication method for the token endpoint.
	// If unspecified or omitted, the default is "client_secret_basic", denoting the HTTP Basic authentication scheme as specified in Section 2.3.1 of OAuth 2.0.
	// Examples are: none, client_secret_post, client_secret_basic, tls_client_auth.
	// From https://www.rfc-editor.org/rfc/rfc7591.html
	// TODO: Can "tls_client_auth" replace /n2n/ for pre-authorized_code flow? https://www.rfc-editor.org/rfc/rfc8705.html
	TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty"`

	// GrantTypes lists all supported grant_types. Defaults to "authorization_code" if omitted.
	// From https://www.rfc-editor.org/rfc/rfc7591.html
	GrantTypes []string `json:"grant_types,omitempty"`

	// ResponseTypes lists all supported response_types. Defaults to "code". Must contain the values corresponding to listed GrantTypes.
	// From https://www.rfc-editor.org/rfc/rfc7591.html
	ResponseTypes []string `json:"response_types,omitempty"`

	// Scope contains a space-separated list of scopes the client can request.
	// From https://www.rfc-editor.org/rfc/rfc7591.html
	// TODO: I don't see the use for this. The idea is that an AS does not assign scopes to a client that it does not support (or wants to request at any time), but seems like unnecessary complexity for minimal safety.
	Scope string `json:"scope,omitempty"`

	// Contacts contains an array of strings representing ways to contact people responsible for this client, typically email addresses.
	// From https://www.rfc-editor.org/rfc/rfc7591.html
	// TODO: remove? Can plug DID docs contact info.
	Contacts []string `json:"contacts,omitempty"`

	// JwksURI URL string referencing the client's JSON Web Key (JWK) Set [RFC7517] document, which contains the client's public keys.
	// From https://www.rfc-editor.org/rfc/rfc7591.html
	// TODO: remove? Can list the DID's keys. Could be useful if authorization without DIDs/VCs is needed.
	// TODO: In EBSI it is a required field for the Service Wallet Metadata https://api-conformance.ebsi.eu/docs/ct/providers-and-wallets-metadata#service-wallet-metadata
	JwksURI string `json:"jwks_uri,omitempty"`
	// Jwks includes the JWK Set of a client. Mutually exclusive with JwksURI.
	// From https://www.rfc-editor.org/rfc/rfc7591.html
	Jwks any `json:"jwks,omitempty"`

	// SoftwareID is a unique identifier string (e.g., a Universally Unique Identifier (UUID)) assigned by the client developer.
	// From https://www.rfc-editor.org/rfc/rfc7591.html
	SoftwareID string `json:"software_id,omitempty"`
	// SoftwareVersion is a version identifier string for the client software identified by "software_id".
	// From https://www.rfc-editor.org/rfc/rfc7591.html
	// TODO: Including a software_id + software_version could provide us with some upgrade paths in the future.
	SoftwareVersion string `json:"software_version,omitempty"`

	// CredentialOfferEndpoint contains a URL where the pre-authorized_code flow offers a credential.
	// https://openid.bitbucket.io/connect/openid-4-verifiable-credential-issuance-1_0.html#name-client-metadata
	// TODO: openid4vci duplicate. Also defined on /.well-known/openid-credential-wallet to be /n2n/identity/{did}/openid4vci/credential_offer
	CredentialOfferEndpoint string `json:"credential_offer_endpoint,omitempty"`

	/*********** OpenID4VP ***********/
	// VPFormats lists the vp_formats supported by the client. See additional comments on vpFormatsSupported.
	// https://openid.bitbucket.io/connect/openid-4-verifiable-presentations-1_0.html#name-verifier-metadata-client-me
	VPFormats map[string]map[string][]string `json:"vp_formats,omitempty"`

	// ClientIdScheme is a string identifying the Client Identifier scheme. The value range defined by this specification is
	// pre-registered, redirect_uri, entity_id, did. If omitted, the default value is pre-registered.
	// https://openid.bitbucket.io/connect/openid-4-verifiable-presentations-1_0.html#name-verifier-metadata-client-me
	ClientIdScheme string `json:"client_id_scheme,omitempty"`
}

type Oauth2ErrorWriter struct {
	HtmlPageTemplate *template.Template
}

type OpenIDConfiguration struct {
	// Issuer: an url representing the issuer of the entity statement
	// for now we keep it teh same as the subject, eg the subject/tenant
	Issuer string `json:"iss"`
	// Subject: an url representing the subject of the entity statement
	Subject string `json:"sub"`
	// IssuedAt: the time the entity statement was issued
	IssuedAt int64 `json:"iat"`
	// Expiration: the time after which the entity statement may no longer be processed
	Expiration int64 `json:"exp"`
	// JWKs is the JSON Web Key Set of the entity statement. Contains keys of all DIDs for the subject
	JWKs jwk.Set `json:"jwks"`
	// Metadata: the metadata of the entity statement
	Metadata EntityStatementMetadata `json:"metadata"`
}

type OpenIDCredentialIssuerMetadata struct {
	// - CredentialIssuer: an url representing the credential issuer
	CredentialIssuer string `json:"credential_issuer"`
	// - CredentialEndpoint: an url representing the credential endpoint
	CredentialEndpoint string `json:"credential_endpoint"`
	// - AuthorizationServers: a slice of urls representing the authorization servers (optional)
	AuthorizationServers []string `json:"authorization_servers,omitempty"`
	// - Display: a slice of maps where each map represents the display information (optional)
	Display []map[string]string `json:"display,omitempty"`
}

type Redirect struct {
	// RedirectURI is the URI to redirect the user-agent to.
	RedirectURI string `json:"redirect_uri"`
}

type TokenResponse struct {
	AccessToken string  `json:"access_token"`
	DPoPKid     *string `json:"dpop_kid,omitempty"`
	ExpiresAt   *int    `json:"expires_at,omitempty"`
	ExpiresIn   *int    `json:"expires_in,omitempty"`
	TokenType   string  `json:"token_type"`
	Scope       *string `json:"scope,omitempty"`
	// contains filtered or unexported fields
}