session

type Claims struct {
	Subject    string   `json:"sub"`
	UserUUID   string   `json:"user_uuid"`
	GivenName  string   `json:"given_name"`
	FamilyName string   `json:"family_name"`
	Email      string   `json:"email"`
	Groups     []string `json:"groups"`
}

type Manager struct {
	// contains filtered or unexported fields
}

type ManagerOption func(*Manager)

type OIDCSessionData struct {
	SessionID  string
	TenantID   string
	CSRFToken  string
	RequestURI string
	ErrorURI   string // Error URI for redirecting to UI error page on failure (optional)
}

type Repository interface {
	// State operations
	LoadState(ctx context.Context, stateID string) (State, error)
	StoreState(ctx context.Context, state State) error
	DeleteState(ctx context.Context, stateID string) error

	// Session operations
	ListSessions(ctx context.Context) ([]Session, error)
	LoadSession(ctx context.Context, sessionID string) (Session, error)
	LoadSessionByProviderID(ctx context.Context, providerID string) (Session, error)
	StoreSession(ctx context.Context, session Session) error
	DeleteSession(ctx context.Context, session Session) error
	IsActive(ctx context.Context, sessionID string) (bool, error)
	BumpActive(ctx context.Context, sessionID string, timeout time.Duration) error
}

type Session struct {
	ID                string            // Session ID in our system
	TenantID          string            // Tenant ID for which the session is created
	ProviderID        string            // Provider session ID defined by the OIDC provider (`sid` claim)
	CSRFToken         string            // CSRF token to prevent CSRF attacks
	Issuer            string            // Issuer of the OIDC tokens
	Claims            Claims            // Claims from the ID token
	AccessToken       string            // Access token from the identity provider
	RefreshToken      string            // Refresh token from the identity provider
	Expiry            time.Time         // Expiry time of the session
	AccessTokenExpiry time.Time         // Expiry time of the Access Token
	AuthContext       map[string]string // Additional authentication context
}

type State struct {
	ID             string    // State ID to align the auth request with the callback
	TenantID       string    // Tenant ID for which the login is done
	PKCEVerifier   string    // PKCE verifier to validate the PKCE challenge
	RequestURI     string    // Request URI for the eventual redirect
	ErrorURI       string    // Error URI for redirecting to UI error page on failure (optional)
	Expiry         time.Time // Expiry time of the login process
	LoginCSRFToken string    // CSRF token to prevent CSRF attacks
}