auth

type APIKeyStore interface {
	CreateAPIKey(ctx context.Context, key *db.APIKey) error
	GetAPIKeyByHash(ctx context.Context, hash string) (*db.APIKey, error)
	TouchAPIKey(ctx context.Context, id uuid.UUID) error
}

type AdminAuth struct {
	TM   *TokenManager
	Keys APIKeyStore
	// RBAC resolves a session's or key's bindings; nil grants nothing (fail closed)
	RBAC *Resolver
	// Insecure disables authentication entirely (development only)
	Insecure bool
	// LoginPath is where unauthenticated browser requests are redirected
	LoginPath string
}

type AgentAuth struct {
	Verifier *AgentVerifier
}

type AgentClaims struct {
	AgentID   uuid.UUID
	TaskQueue string
	Version   int
	Worker    bool
	ExpiresAt time.Time
}

type AgentStateStore interface {
	GetAgentAuthState(ctx context.Context, id uuid.UUID) (*db.AgentAuthState, error)
}

type AgentTokenClaims struct {
	TaskQueue string `json:"tq"`
	Version   int    `json:"ver"`
	// Worker marks the short-lived secondary token of a kubernetes run's worker pods;
	// it cannot be rotated into a long-lived one
	Worker bool `json:"wrk,omitempty"`
	jwt.RegisteredClaims
}

type AgentVerifier struct {
	// contains filtered or unexported fields
}

type BackupTicketClaims struct {
	JobID      uuid.UUID `json:"job_id"`
	AgentID    uuid.UUID `json:"agent_id"`
	TargetID   uuid.UUID `json:"target_id"`
	Datastore  string    `json:"datastore"`
	Namespace  string    `json:"namespace"`
	BackupType string    `json:"backup_type"` // e.g. "host"
	BackupID   string    `json:"backup_id"`   // e.g. "agent-123"
	BackupTime int64     `json:"backup_time"` // unix timestamp
	// Issued is when the run's first ticket was minted; refreshes and sub-tickets carry
	// it over so a run cannot keep itself alive forever
	Issued int64 `json:"issued,omitempty"`
	jwt.RegisteredClaims
}

type Binding struct {
	Role        string      `json:"role"`
	Permissions []string    `json:"permissions"`
	Selector    db.Selector `json:"selector"`
}

type BindingStore interface {
	BindingsFor(ctx context.Context, email string, groups, claims []string) ([]*db.RoleBinding, error)
	GetRole(ctx context.Context, name string) (*db.Role, error)
}

type CookieOptions struct {
	// Secure marks cookies as HTTPS-only; enable whenever PublicURL is https
	Secure bool
}

type Identity struct {
	Subject string
	Email   string
	Name    string
	Groups  []string
	// EmailUnverified is set when the IdP says email_verified=false; allowed_emails
	// never matches such an identity (a missing claim is taken as verified)
	EmailUnverified bool
	// Claims are the values of the configured binding claims as "<claim>=<value>",
	// which "claim" role bindings match
	Claims []string
}

type LoginStateClaims struct {
	State string `json:"state"`
	Nonce string `json:"nonce"`
	Next  string `json:"next,omitempty"`
	jwt.RegisteredClaims
}

type OIDC struct {
	// contains filtered or unexported fields
}

type OIDCConfig = config.OIDCConfig

type PermissionGroup struct {
	Resource    string   `json:"resource"`
	Permissions []string `json:"permissions"`
}

type Principal struct {
	Kind     PrincipalKind
	Subject  string
	Email    string
	Name     string
	Bindings []Binding
}

type PrincipalKind string

type Resolver struct {
	// contains filtered or unexported fields
}

type SessionClaims struct {
	Email  string   `json:"email,omitempty"`
	Name   string   `json:"name,omitempty"`
	Groups []string `json:"groups,omitempty"`
	// EmailUnverified: the IdP said email_verified=false, so user bindings on the
	// email never match
	EmailUnverified bool `json:"email_unverified,omitempty"`
	// BindingClaims are the identity's "<claim>=<value>" pairs for claim bindings
	BindingClaims []string `json:"binding_claims,omitempty"`
	jwt.RegisteredClaims
}

type TokenManager struct {
	// contains filtered or unexported fields
}