middleware

type AppAuthAuthenticator struct {
	Logger              log.Logger
	RevaGatewaySelector pool.Selectable[gateway.GatewayAPIClient]
}

type Authenticator interface {
	// Authenticate is used to authenticate incoming HTTP requests.
	// The Authenticator may augment the request with user info or anything related to the
	// authentication and return the augmented request.
	Authenticate(*http.Request) (*http.Request, bool)
}

type BasicAuthenticator struct {
	Logger        log.Logger
	UserProvider  backend.UserBackend
	UserCS3Claim  string
	UserOIDCClaim string
}

type OIDCAuthenticator struct {
	Logger     log.Logger
	HTTPClient *http.Client
	OIDCIss    string

	DefaultTokenCacheTTL time.Duration

	AccessTokenVerifyMethod string

	TimeFunc func() time.Time
	// contains filtered or unexported fields
}

type Option func(o *Options)

type Options struct {
	// Logger to use for logging, must be set
	Logger log.Logger
	// PolicySelectorConfig for using the policy selector
	PolicySelector config.PolicySelector
	// HTTPClient to use for communication with the oidcAuth provider
	HTTPClient *http.Client
	// UserProvider backend to use for resolving User
	UserProvider backend.UserBackend
	// UserRoleAssigner to user for assign a users default role
	UserRoleAssigner userroles.UserRoleAssigner
	// SettingsRoleService for the roles API in settings
	SettingsRoleService settingssvc.RoleService
	// PoliciesProviderService for policy evaluation
	PoliciesProviderService policiessvc.PoliciesProviderService
	// OIDCClient to fetch user info and verify tokens, must be set for the oidc_auth middleware
	OIDCClient oidc.OIDCClient
	// OIDCIss is the oidcAuth-issuer
	OIDCIss string
	// RevaGatewaySelector to send requests to the reva gateway
	RevaGatewaySelector pool.Selectable[gateway.GatewayAPIClient]
	// PreSignedURLConfig to configure the middleware
	PreSignedURLConfig config.PreSignedURL
	// UserOIDCClaim to read from the oidc claims
	UserOIDCClaim string
	// UserCS3Claim to use when looking up a user in the CS3 API
	UserCS3Claim string
	// AutoprovisionAccounts when an accountResolver does not exist.
	AutoprovisionAccounts bool
	// EnableBasicAuth to allow basic auth
	EnableBasicAuth bool
	// DefaultAccessTokenTTL is used to calculate the expiration when an access token has no expiration set
	DefaultAccessTokenTTL time.Duration
	// UserInfoCache sets the access token cache store
	UserInfoCache store.Store
	// CredentialsByUserAgent sets the auth challenges on a per user-agent basis
	CredentialsByUserAgent map[string]string
	// AccessTokenVerifyMethod configures how access_tokens should be verified but the oidc_auth middleware.
	// Possible values currently: "jwt" and "none"
	AccessTokenVerifyMethod string
	// JWKS sets the options for fetching the JWKS from the IDP
	JWKS config.JWKS
	// RoleQuotas hold userid:quota mappings. These will be used when provisioning new users.
	// The users will get as much quota as is set for their role.
	RoleQuotas map[string]uint64
	// TraceProvider sets the tracing provider.
	TraceProvider trace.TracerProvider
	// SkipUserInfo prevents the oidc middleware from querying the userinfo endpoint and read any claims directly from the access token instead
	SkipUserInfo    bool
	EventsPublisher events.Publisher
}

type PublicShareAuthenticator struct {
	Logger              log.Logger
	RevaGatewaySelector pool.Selectable[gateway.GatewayAPIClient]
}

type RequestDenied struct {
	Error RequestDeniedError `json:"error"`
}

type RequestDeniedError struct {
	Code    string `json:"code"`
	Message string `json:"message"`
	// The structure of this object is service-specific
	Innererror map[string]interface{} `json:"innererror,omitempty"`
}

type SignedURLAuthenticator struct {
	Logger             log.Logger
	PreSignedURLConfig config.PreSignedURL
	UserProvider       backend.UserBackend
	UserRoleAssigner   userroles.UserRoleAssigner
	Store              microstore.Store
	Now                func() time.Time
}