session

type Claims struct {
	Subject    string   `json:"sub"`
	UserUUID   string   `json:"user_uuid"`
	GivenName  string   `json:"given_name"`
	FamilyName string   `json:"family_name"`
	Email      string   `json:"email"`
	Groups     []string `json:"groups"`
}

type Manager struct {
	// contains filtered or unexported fields
}

type OIDCSessionData struct {
	SessionID  string
	TenantID   string
	CSRFToken  string
	RequestURI string
}

type Repository interface {
	// State operations
	LoadState(ctx context.Context, stateID string) (State, error)
	StoreState(ctx context.Context, state State) error
	DeleteState(ctx context.Context, stateID string) error

	// Session operations
	ListSessions(ctx context.Context) ([]Session, error)
	LoadSession(ctx context.Context, sessionID string) (Session, error)
	LoadSessionByProviderID(ctx context.Context, providerID string) (Session, error)
	StoreSession(ctx context.Context, session Session) error
	DeleteSession(ctx context.Context, session Session) error
	IsActive(ctx context.Context, sessionID string) (bool, error)
	BumpActive(ctx context.Context, sessionID string, timeout time.Duration) error
}

type Session struct {
	ID                string            // Session ID in our system
	TenantID          string            // Tenant ID for which the session is created
	ProviderID        string            // Provider session ID defined by the OIDC provider (`sid` claim)
	Fingerprint       string            // Fingerprint to bind the session to a specific client
	CSRFToken         string            // CSRF token to prevent CSRF attacks
	Issuer            string            // Issuer of the OIDC tokens
	Claims            Claims            // Claims from the ID token
	AccessToken       string            // Access token from the identity provider
	RefreshToken      string            // Refresh token from the identity provider
	Expiry            time.Time         // Expiry time of the session
	AccessTokenExpiry time.Time         // Expiry time of the Access Token
	AuthContext       map[string]string // Additional authentication context
}

type State struct {
	ID           string    // State ID to align the auth request with the callback
	TenantID     string    // Tenant ID for which the login is done
	Fingerprint  string    // Fingerprint to bind the login to a specific client
	PKCEVerifier string    // PKCE verifier to validate the PKCE challenge
	RequestURI   string    // Request URI for the eventual redirect
	Expiry       time.Time // Expiry time of the login process
}