auth

type APIKeyStore interface {
	CreateAPIKey(ctx context.Context, key *db.APIKey) error
	GetAPIKeyByHash(ctx context.Context, hash string) (*db.APIKey, error)
	TouchAPIKey(ctx context.Context, id uuid.UUID) error
}

type AdminAuth struct {
	TM   *TokenManager
	Keys APIKeyStore
	// Insecure disables authentication entirely (development only)
	Insecure bool
	// LoginPath is where unauthenticated browser requests are redirected
	LoginPath string
}

type AgentAuth struct {
	Verifier *AgentVerifier
}

type AgentClaims struct {
	AgentID   uuid.UUID
	TaskQueue string
	Version   int
	Worker    bool
	ExpiresAt time.Time
}

type AgentStateStore interface {
	GetAgentAuthState(ctx context.Context, id uuid.UUID) (*db.AgentAuthState, error)
}

type AgentTokenClaims struct {
	TaskQueue string `json:"tq"`
	Version   int    `json:"ver"`
	// Worker marks the short-lived secondary token of a kubernetes run's worker pods;
	// it cannot be rotated into a long-lived one
	Worker bool `json:"wrk,omitempty"`
	jwt.RegisteredClaims
}

type AgentVerifier struct {
	// contains filtered or unexported fields
}

type BackupTicketClaims struct {
	JobID      uuid.UUID `json:"job_id"`
	AgentID    uuid.UUID `json:"agent_id"`
	TargetID   uuid.UUID `json:"target_id"`
	Datastore  string    `json:"datastore"`
	Namespace  string    `json:"namespace"`
	BackupType string    `json:"backup_type"` // e.g. "host"
	BackupID   string    `json:"backup_id"`   // e.g. "agent-123"
	BackupTime int64     `json:"backup_time"` // unix timestamp
	// Issued is when the run's first ticket was minted; refreshes and sub-tickets carry
	// it over so a run cannot keep itself alive forever
	Issued int64 `json:"issued,omitempty"`
	jwt.RegisteredClaims
}

type CookieOptions struct {
	// Secure marks cookies as HTTPS-only; enable whenever PublicURL is https
	Secure bool
}

type Identity struct {
	Subject string
	Email   string
	Name    string
	Groups  []string
	// EmailUnverified is set when the IdP says email_verified=false; allowed_emails
	// never matches such an identity (a missing claim is taken as verified)
	EmailUnverified bool
}

type LoginStateClaims struct {
	State string `json:"state"`
	Nonce string `json:"nonce"`
	Next  string `json:"next,omitempty"`
	jwt.RegisteredClaims
}

type OIDC struct {
	// contains filtered or unexported fields
}

type OIDCConfig = config.OIDCConfig

type Principal struct {
	Kind    PrincipalKind
	Subject string
	Email   string
	Name    string
}

type PrincipalKind string

type SessionClaims struct {
	Email  string   `json:"email,omitempty"`
	Name   string   `json:"name,omitempty"`
	Groups []string `json:"groups,omitempty"`
	jwt.RegisteredClaims
}

type TokenManager struct {
	// contains filtered or unexported fields
}