verify

type Authenticator interface {
	VerifyRequest(r *http.Request) (Claims, error)
}

type Authority interface {
	Authenticator
	PermissionChecker
	SessionChecker
}

type Claims struct {
	// Kind is the credential class: iam.ActorUser or iam.ActorDelegated for a
	// token, and from *authkit.Client also iam.ActorAPIKey and
	// iam.ActorRemoteApplication.
	Kind iam.ActorKind
	// JOSEType is the token's typ header ("access+jwt",
	// "delegated-access+jwt", "remote-application-access+jwt"); empty for an
	// API key.
	JOSEType string
	// Issuer is the validated iss.
	Issuer string

	// UserID is a local user: set only for an issuer registered IsLocal.
	UserID string
	// Subject is another issuer's user. It is meaningful only with Issuer and
	// never names a local user.
	Subject string
	// DelegatedSubject is a delegated token's delegated_sub, whose authority
	// is Permissions: the user who minted a token of this deployment, else an
	// external actor. It never sets UserID.
	DelegatedSubject string
	// SessionID (sid) or DeviceKeyID names the sign-in a native token, or a
	// delegated token AuthKit minted from one, was minted from; the session
	// check refuses the token once it is revoked.
	SessionID   string
	DeviceKeyID string
	// APIKeyID is the key an API-key credential resolved to.
	APIKeyID string
	// RemoteApplicationID is the stored application behind a remote
	// application token or its delegation, resolved from the validated iss.
	RemoteApplicationID string
	// Group binds a machine credential's authority to the group it was
	// granted in: set for API keys, remote applications and their
	// delegations; nil otherwise.
	Group *PermissionScope

	// Permissions are the credential's permission strings: an API key's or
	// application's stored grants, or a delegated token's grant (bounded by
	// the application's stored ceiling when an application issued it). Native
	// user tokens carry none; their authority is read live (Can).
	Permissions []string
	// Attributes is the attributes claim, each value raw JSON for the
	// consuming service to decode; AuthKit assigns no key a meaning.
	Attributes map[string]json.RawMessage
	// Entitlements is the issuer's token-time entitlements snapshot.
	Entitlements []string
	// RootRole is the user's root-group role at mint ("root:admin"), for
	// display only: UI and content visibility without a database call. It is
	// stale up to the token lifetime and never authorizes anything; every
	// permission check reads the role live.
	RootRole string

	Email         string
	EmailVerified bool
	Username      string

	// AMR, ACR and AuthTime describe the sign-in the token carries.
	AMR      []string
	ACR      string
	AuthTime time.Time
	// TwoFAEnrollment marks a token that reaches only AuthKit's 2FA
	// enrollment routes; every verifier refuses it elsewhere.
	TwoFAEnrollment bool
	// MFAEnrolled is whether the user had a usable second factor at mint.
	MFAEnrolled bool
	JTI         string

	// CertificateThumbprint (cnf x5t#S256) or JWKThumbprint (cnf jkt) is a
	// delegated token's sender binding, already matched against this
	// request's TLS peer certificate or DPoP proof; empty for a bearer token.
	CertificateThumbprint string
	JWKThumbprint         string
}

type IssuerKeyStatus = jwks.Status

type IssuerOptions struct {
	// JWKSURI is fetched on first use and refreshed in the background when
	// its keys expire or an unknown kid arrives. Expired keys keep verifying
	// while refreshes fail, up to MaxStale.
	JWKSURI string
	// Keys are static PEM public keys, each with its kid. Replace them by
	// calling AddIssuer again.
	Keys []iam.RemoteApplicationKey
	// KeySource is read live on every verification: a co-located, rotating
	// key source such as AuthKit's own.
	KeySource keys.Source

	// CacheTTL is how long fetched JWKS keys are fresh (default 10m).
	CacheTTL time.Duration
	// MaxStale bounds how long after the last successful fetch JWKS keys
	// keep verifying while refreshes fail, so a peer's key revocation cannot
	// be suppressed by blocking the fetch. Past it the issuer's tokens fail
	// with 503 issuer_keys_unavailable. Default 4h; never below CacheTTL.
	MaxStale time.Duration

	// IsLocal marks the issuer whose users are this host's own: only its
	// access tokens set Claims.UserID (others set Subject).
	IsLocal bool
}

type PermissionChecker interface {
	Can(ctx context.Context, a iam.Actor, ref iam.GroupRef, perm iam.Perm) (bool, error)
	// KnownPermission reports whether perm is registered.
	KnownPermission(perm iam.Perm) bool
}

type PermissionScope struct {
	GroupID         string
	AuthorityIssuer string
	Persona         iam.Persona
}

type ServiceJWTVerifyOption func(*serviceJWTConfig)

type SessionChecker interface {
	// CheckSession: the session or device key the token was minted from is
	// still active. A user's token carries one, and so does a delegated
	// token AuthKit minted from it.
	CheckSession(ctx context.Context, cl Claims) error
	// CheckRecentSignIn: CheckSession, and the user's own token, signed in
	// recently enough for a sensitive action, with the second factor when
	// the account has one.
	CheckRecentSignIn(ctx context.Context, cl Claims) error
}

type Verifier struct {
	// contains filtered or unexported fields
}

type VerifierOption func(*verifierConfig)