oauth2

type APIKeyAuthConfig struct {
	In    string `json:"in"`
	Name  string `json:"name"`
	Value string `json:"value"`
}

type AccessRequestHook func(ctx context.Context, requester fosite.AccessRequester) error

type AssertionJWTReader interface {
	x.FositeStorer
	GetClientAssertionJWT(ctx context.Context, jti string) (*BlacklistedJTI, error)
	SetClientAssertionJWTRaw(context.Context, *BlacklistedJTI) error
}

type BlacklistedJTI struct {
	JTI    string         `db:"-"`
	ID     string         `db:"signature"`
	Expiry time.Time      `db:"expires_at"`
	NID    gofrsuuid.UUID `db:"nid"`
}

type CreateVerifiableCredentialRequestBody struct {
	Format string                     `json:"format"`
	Types  []string                   `json:"types"`
	Proof  *VerifiableCredentialProof `json:"proof"`
}

type CredentialSupportedDraft00 struct {
	// OpenID Connect Verifiable Credentials Format
	//
	// Contains the format that is supported by this authorization server.
	Format string `json:"format"`

	// OpenID Connect Verifiable Credentials Types
	//
	// Contains the types of verifiable credentials supported.
	Types []string `json:"types"`

	// OpenID Connect Verifiable Credentials Cryptographic Binding Methods Supported
	//
	// Contains a list of cryptographic binding methods supported for signing the proof.
	CryptographicBindingMethodsSupported []string `json:"cryptographic_binding_methods_supported"`

	// OpenID Connect Verifiable Credentials Cryptographic Suites Supported
	//
	// Contains a list of cryptographic suites methods supported for signing the proof.
	CryptographicSuitesSupported []string `json:"cryptographic_suites_supported"`
}

type Handler struct {
	// contains filtered or unexported fields
}

type InternalRegistry interface {
	client.Registry
	jwk.Registry
	trust.Registry
	x.RegistryWriter
	x.RegistryLogger
	consent.Registry
	persistence.Provider
	Registry
	FlowCipher() *aead.XChaCha20Poly1305
}

type Introspection struct {
	// Active is a boolean indicator of whether or not the presented token
	// is currently active.  The specifics of a token's "active" state
	// will vary depending on the implementation of the authorization
	// server and the information it keeps about its tokens, but a "true"
	// value return for the "active" property will generally indicate
	// that a given token has been issued by this authorization server,
	// has not been revoked by the resource owner, and is within its
	// given time window of validity (e.g., after its issuance time and
	// before its expiration time).
	//
	// required: true
	Active bool `json:"active"`

	// Scope is a JSON string containing a space-separated list of
	// scopes associated with this token.
	Scope string `json:"scope,omitempty"`

	// ID is aclient identifier for the OAuth 2.0 client that
	// requested this token.
	ClientID string `json:"client_id"`

	// Subject of the token, as defined in JWT [RFC7519].
	// Usually a machine-readable identifier of the resource owner who
	// authorized this token.
	Subject string `json:"sub"`

	// ObfuscatedSubject is set when the subject identifier algorithm was set to "pairwise" during authorization.
	// It is the `sub` value of the ID Token that was issued.
	ObfuscatedSubject string `json:"obfuscated_subject,omitempty"`

	// Expires at is an integer timestamp, measured in the number of seconds
	// since January 1 1970 UTC, indicating when this token will expire.
	ExpiresAt int64 `json:"exp"`

	// Issued at is an integer timestamp, measured in the number of seconds
	// since January 1 1970 UTC, indicating when this token was
	// originally issued.
	IssuedAt int64 `json:"iat"`

	// NotBefore is an integer timestamp, measured in the number of seconds
	// since January 1 1970 UTC, indicating when this token is not to be
	// used before.
	NotBefore int64 `json:"nbf"`

	// Username is a human-readable identifier for the resource owner who
	// authorized this token.
	Username string `json:"username,omitempty"`

	// Audience contains a list of the token's intended audiences.
	Audience []string `json:"aud"`

	// IssuerURL is a string representing the issuer of this token
	Issuer string `json:"iss"`

	// TokenType is the introspected token's type, typically `Bearer`.
	TokenType string `json:"token_type"`

	// TokenUse is the introspected token's use, for example `access_token` or `refresh_token`.
	TokenUse string `json:"token_use"`

	// Extra is arbitrary data set by the session.
	Extra map[string]interface{} `json:"ext,omitempty"`
}

type RefreshTokenHookRequest struct {
	// Subject is the identifier of the authenticated end-user.
	Subject string `json:"subject"`
	// Session is the request's session..
	Session *Session `json:"session"`
	// Requester is a token endpoint's request context.
	Requester Requester `json:"requester"`
	// ClientID is the identifier of the OAuth 2.0 client.
	ClientID string `json:"client_id"`
	// GrantedScopes is the list of scopes granted to the OAuth 2.0 client.
	GrantedScopes []string `json:"granted_scopes"`
	// GrantedAudience is the list of audiences granted to the OAuth 2.0 client.
	GrantedAudience []string `json:"granted_audience"`
}

type Registry interface {
	OAuth2Storage() x.FositeStorer
	OAuth2Provider() fosite.OAuth2Provider
	AudienceStrategy() fosite.AudienceMatchingStrategy
	AccessTokenJWTStrategy() jwk.JWTSigner
	OpenIDConnectRequestValidator() *openid.OpenIDConnectRequestValidator
	AccessRequestHooks() []AccessRequestHook
	OAuth2ProviderConfig() fosite.Configurator
}

type Request struct {
	// ClientID is the identifier of the OAuth 2.0 client.
	ClientID string `json:"client_id"`
	// RequestedScopes is the list of scopes requested to the OAuth 2.0 client.
	RequestedScopes []string `json:"requested_scopes"`
	// GrantedScopes is the list of scopes granted to the OAuth 2.0 client.
	GrantedScopes []string `json:"granted_scopes"`
	// GrantedAudience is the list of audiences granted to the OAuth 2.0 client.
	GrantedAudience []string `json:"granted_audience"`
	// GrantTypes is the requests grant types.
	GrantTypes []string `json:"grant_types"`
	// Payload is the requests payload.
	Payload map[string][]string `json:"payload"`
}

type Requester struct {
	// ClientID is the identifier of the OAuth 2.0 client.
	ClientID string `json:"client_id"`
	// GrantedScopes is the list of scopes granted to the OAuth 2.0 client.
	GrantedScopes []string `json:"granted_scopes"`
	// GrantedAudience is the list of audiences granted to the OAuth 2.0 client.
	GrantedAudience []string `json:"granted_audience"`
	// GrantTypes is the requests grant types.
	GrantTypes []string `json:"grant_types"`
}

type Session struct {
	*openid.DefaultSession `json:"id_token"`
	Extra                  map[string]interface{} `json:"extra"`
	KID                    string                 `json:"kid"`
	ClientID               string                 `json:"client_id"`
	ConsentChallenge       string                 `json:"consent_challenge"`
	ExcludeNotBeforeClaim  bool                   `json:"exclude_not_before_claim"`
	AllowedTopLevelClaims  []string               `json:"allowed_top_level_claims"`
	MirrorTopLevelClaims   bool                   `json:"mirror_top_level_claims"`

	Flow *flow.Flow `json:"-"`
}

type TokenHookRequest struct {
	// Session is the request's session..
	Session *Session `json:"session"`
	// Requester is a token endpoint's request context.
	Request Request `json:"request"`
}

type TokenHookResponse struct {
	// Session is the session data returned by the hook.
	Session flow.AcceptOAuth2ConsentRequestSession `json:"session"`
}

type VerifableCredentialClaims struct {
	jwt.RegisteredClaims
	VerifiableCredential VerifiableCredentialClaim `json:"vc"`
}

type VerifiableCredentialClaim struct {
	Context []string       `json:"@context"`
	Subject map[string]any `json:"credentialSubject"`
	Type    []string       `json:"type"`
}

type VerifiableCredentialPrimingResponse struct {
	Format         string `json:"format"`
	Nonce          string `json:"c_nonce"`
	NonceExpiresIn int64  `json:"c_nonce_expires_in"`

	fosite.RFC6749ErrorJson
}

type VerifiableCredentialProof struct {
	ProofType string `json:"proof_type"`
	JWT       string `json:"jwt"`
}

type VerifiableCredentialResponse struct {
	Format     string `json:"format"`
	Credential string `json:"credential_draft_00"`
}