session

type Blocklist interface {
	// Block invalidates the token from the context by adding it to blocklist.
	Block(ctx context.Context, token *jwt.Token) error
	// IsBlocked checks if the token from the context is blocked.
	IsBlocked(ctx context.Context, token *jwt.Token) (bool, error)
}

type JWTContent struct {
	Payload map[string]any `json:"payload"`
}

type Manager struct {
	Blocklist
	// contains filtered or unexported fields
}

type Option func(*Manager)

type SSOClaims struct {
	jwt.RegisteredClaims

	OIDCIssuer        string   `json:"oidc_issuer"`
	Email             string   `json:"email,omitempty"`
	Name              string   `json:"name,omitempty"`
	PreferredUsername string   `json:"preferred_username,omitempty"`
	Groups            []string `json:"groups,omitempty"`
}

type SSOIdentity struct {
	Email             string
	Name              string
	PreferredUsername string
	// Groups is read by rbac.GetUser from the token's "groups" claim for group-based policies.
	Groups []string
}

type TokenStore interface {
	// Add adds the shortened token to the blocklist
	Add(ctx context.Context, shortenedToken string) error
	// Exists checks if the shortened token is in the blocklist
	Exists(ctx context.Context, shortenedToken string) (bool, error)
}

type TokenStoreClient interface {
	// GetSecret returns a secret that matches the criteria.
	GetSecret(ctx context.Context, key client.ObjectKey) (*corev1.Secret, error)
	// CreateSecret creates a secret.
	CreateSecret(ctx context.Context, secret *corev1.Secret) (*corev1.Secret, error)
	// UpdateSecret updates a secret.
	UpdateSecret(ctx context.Context, secret *corev1.Secret) (*corev1.Secret, error)
}