jwtprovider

type Claims struct {
	jwt.RegisteredClaims
	Data map[string]any `json:"data,omitempty"`
}

type JWTConfig struct {
	CfgSigningKey     *secure.DefaultCredentialConfig `json:"signingKey,omitempty"`   // SigningKey is the key used to sign JWT tokens
	CfgPrivateKey     *secure.KeyConfig               `json:"privateKey,omitempty"`   // PKCS#8 private key for asymmetric algorithms (RSA, ECDSA, EdDSA)
	CfgPublicKey      *secure.KeyConfig               `json:"publicKey,omitempty"`    // PEM PKIX public key for asymmetric algorithms (RSA, ECDSA, EdDSA)
	SigningAlgorithm  string                          `json:"signingAlgorithm"`       // SigningAlgorithm: HS256/HS384/HS512, RS256/RS384/RS512, ES256/ES384/ES512, EdDSA
	ExpirationSeconds int                             `json:"expirationSeconds"`      // ExpirationSeconds
	Issuer            string                          `json:"issuer"`                 // Issuer is the issuer of the token
	Audience          string                          `json:"audience"`               // Audience is the audience of the token
	KeyID             string                          `json:"keyID"`                  // KeyID for JWKS support
	MaxTokenSize      int                             `json:"maxTokenSize,omitempty"` // Max token size
	// Enhanced validation flags
	RequireIssuer   bool `json:"requireIssuer"`   // Mandatory issuer validation
	RequireAudience bool `json:"requireAudience"` // Mandatory audience validation

	// User token tracking
	TrackUserTokens bool `json:"trackUserTokens"`           // Enable user token tracking
	MaxUserSessions int  `json:"maxUserSessions,omitempty"` // Maximum concurrent sessions per user (0 = unlimited)
	// contains filtered or unexported fields
}

type JWTParser interface {
	ParseToken(tokenString string) (*Claims, error)
}

type JWTProvider interface {
	JWTParser
	JWTSigner
	JWTRevoker
	JWTRefresher
	GetRevocationManager() *RevocationManager
	GetActiveUserTokens(userID string) ([]string, error)
	RevokeAllUserTokens(userID string) error
	GetUserSessionCount(userID string) int
}

type JWTRefresher interface {
	Refresh(string) (string, error)
}

type JWTRevoker interface {
	RevokeToken(tokenString string) error
	RevokeTokenByID(tokenID string, expiresAt time.Time) error
	IsTokenRevoked(tokenID string) bool
}

type JWTSigner interface {
	GenerateToken(string, map[string]any) (string, error)
}

type MemoryRevocationBackend struct {
	// contains filtered or unexported fields
}

type ProviderOpts func(*jwtProvider)

type RevocationBackend interface {
	// RevokeToken revokes a token by its ID with an optional expiration time
	RevokeToken(tokenID string, expiresAt time.Time) error

	// IsTokenRevoked checks if a token is revoked
	IsTokenRevoked(tokenID string) bool

	// RevokeAllUserTokens revokes all tokens for a specific user
	RevokeAllUserTokens(userID string, issuedBefore time.Time) error

	// GetRevokedTokens returns all revoked tokens (for admin purposes)
	GetRevokedTokens() ([]RevokedToken, error)

	// CleanupExpired removes expired revocation entries
	CleanupExpired() error

	// Close closes the backend and releases resources
	Close() error

	// TrackUserToken associates a token with a user
	TrackUserToken(userID, tokenID string, expiresAt time.Time)

	// GetUserTokens returns all active tokens for a user
	GetUserTokens(userID string) []string
}

type RevocationManager struct {
	// contains filtered or unexported fields
}

type RevokedToken struct {
	TokenID   string    `json:"tokenId"`
	UserID    string    `json:"userId,omitempty"`
	RevokedAt time.Time `json:"revokedAt"`
	ExpiresAt time.Time `json:"expiresAt"`
}

type TokenMetadata struct {
	TokenID   string    `json:"tokenId"`
	UserID    string    `json:"userId"`
	IssuedAt  time.Time `json:"issuedAt"`
	ExpiresAt time.Time `json:"expiresAt"`
	ClientIP  string    `json:"clientIP,omitempty"`  // For security audit
	UserAgent string    `json:"userAgent,omitempty"` // For device tracking
}