session

type Claims struct {
	Subject    string   `json:"sub"`
	UserUUID   string   `json:"user_uuid"`
	GivenName  string   `json:"given_name"`
	FamilyName string   `json:"family_name"`
	Email      string   `json:"email"`
	Groups     []string `json:"groups"`
}

type Manager struct {
	// contains filtered or unexported fields
}

type OIDCSessionData struct {
	SessionID  string
	CSRFToken  string
	RequestURI string
}

type Repository interface {
	// State operations
	LoadState(ctx context.Context, stateID string) (State, error)
	StoreState(ctx context.Context, state State) error
	DeleteState(ctx context.Context, stateID string) error
	// Session operations
	LoadSession(ctx context.Context, sessionID string) (Session, error)
	StoreSession(ctx context.Context, session Session) error
	ListSessions(ctx context.Context) ([]Session, error)
	DeleteSession(ctx context.Context, session Session) error
}

type Session struct {
	ID                string            // Session ID in our system
	TenantID          string            // Tenant ID for which the session is created
	ProviderID        string            // Provider session ID defined by the OIDC provider (`sid` claim)
	Fingerprint       string            // Fingerprint to bind the session to a specific client
	CSRFToken         string            // CSRF token to prevent CSRF attacks
	Issuer            string            // Issuer of the OIDC tokens
	Claims            Claims            // Claims from the ID token
	AccessToken       string            // Access token from the identity provider
	RefreshToken      string            // Refresh token from the identity provider
	Expiry            time.Time         // Expiry time of the session
	AccessTokenExpiry time.Time         // Expiry time of the Access Token
	LastVisited       time.Time         // The time the user last used the session
	AuthContext       map[string]string // Additional authentication context
}

type State struct {
	ID           string    // State ID to align the auth request with the callback
	TenantID     string    // Tenant ID for which the login is done
	Fingerprint  string    // Fingerprint to bind the login to a specific client
	PKCEVerifier string    // PKCE verifier to validate the PKCE challenge
	RequestURI   string    // Request URI for the eventual redirect
	Expiry       time.Time // Expiry time of the login process
}