auth

type AccessToken string

type AccessTokenCredential struct {
	Token AccessToken
	Type  TokenType
}

type AccessTokenCredentialSource interface {
	AccessTokenCredential(ctx context.Context, client *http.Client) (AccessTokenCredential, error)
}

type AccessTokenSource interface {
	AccessToken(ctx context.Context, client *http.Client) (AccessToken, error)
	// MakeToken probably better to use `crypto.AsymDecryption` here than roll our own since this should be
	// more closely linked to what happens in KAS in terms of crypto params
	MakeToken(func(jwk.Key) ([]byte, error)) ([]byte, error)
}

type DPoPTransport struct {
	// Base is the underlying transport. If nil, http.DefaultTransport is used.
	Base http.RoundTripper

	// DPoPKey is the private key used to sign DPoP proofs.
	DPoPKey jwk.Key

	// TokenSource provides access tokens for resource requests.
	// For resource requests (any URL other than TokenEndpoint), the transport
	// sets Authorization: DPoP <token> and includes the ath claim binding the
	// proof to the access token. Requests to TokenEndpoint get neither.
	//
	// When TokenSource also implements AccessTokenCredentialSource and reports a
	// non-DPoP scheme for a resource request, the transport instead sets
	// Authorization: Bearer <token> and sends no DPoP proof, matching the
	// credential interceptor so a bearer token source is not forced onto DPoP.
	TokenSource AccessTokenSource

	// TokenEndpoint is the OAuth token endpoint URL.
	// Requests to this endpoint are treated as token requests
	// and do not include the ath claim.
	//
	// TokenEndpoint must not be mutated after the transport is first used:
	// isTokenEndpointRequest caches the parsed URL (and NewDPoPHTTPClient
	// pre-parses it at construction), so a later change would not take effect
	// and would race with the cached read.
	TokenEndpoint string
	// contains filtered or unexported fields
}

type TokenAddingInterceptor struct {
	// contains filtered or unexported fields
}

type TokenType string