agentauth

type AAuthConfig struct {
	// Enabled enables AAuth authorization.
	Enabled bool `json:"enabled" yaml:"enabled"`

	// AgentID is the AAuth agent identifier (e.g., "aauth:agent@example.com").
	AgentID string `json:"agent_id" yaml:"agent_id"`

	// PersonServer is the Person Server URL.
	PersonServer string `json:"person_server" yaml:"person_server"`

	// PrivateKey is the path/URI to the private key.
	PrivateKey string `json:"private_key" yaml:"private_key"`

	// KeyID is the key identifier.
	KeyID string `json:"key_id,omitempty" yaml:"key_id,omitempty"`

	// Algorithm is the signing algorithm (default: ES256).
	Algorithm string `json:"algorithm,omitempty" yaml:"algorithm,omitempty"`

	// DefaultAudience is the default audience for tokens.
	DefaultAudience []string `json:"default_audience,omitempty" yaml:"default_audience,omitempty"`

	// DefaultInteractionType is the default interaction type.
	DefaultInteractionType string `json:"default_interaction_type,omitempty" yaml:"default_interaction_type,omitempty"`

	// DefaultMissionDuration is the default mission duration.
	DefaultMissionDuration time.Duration `json:"default_mission_duration,omitempty" yaml:"default_mission_duration,omitempty"`
}

type AAuthProvider struct {
	// contains filtered or unexported fields
}

type AAuthProviderOption func(*AAuthProvider)

type ActorClaims struct {
	// Subject is the actor's identifier (e.g., user ID).
	Subject string `json:"sub"`

	// Issuer is the actor's identity provider.
	Issuer string `json:"iss,omitempty"`
}

type AuthRequest struct {
	// Scopes are the requested scopes.
	Scopes []string `json:"scopes"`

	// Resource is the target resource (optional).
	Resource string `json:"resource,omitempty"`

	// Audience is the intended audience (optional).
	Audience []string `json:"audience,omitempty"`

	// Subject is the subject being represented (for delegation).
	Subject string `json:"subject,omitempty"`

	// MissionName is a human-readable name for the mission (AAuth).
	MissionName string `json:"mission_name,omitempty"`

	// MissionDescription describes what the agent will do (AAuth).
	MissionDescription string `json:"mission_description,omitempty"`

	// Duration is the requested authorization duration.
	Duration time.Duration `json:"duration,omitempty"`

	// InteractionType is the AAuth interaction type.
	InteractionType string `json:"interaction_type,omitempty"`

	// RedirectURI is the callback URI for consent flow.
	RedirectURI string `json:"redirect_uri,omitempty"`

	// State is an opaque value for CSRF protection.
	State string `json:"state,omitempty"`

	// ForceProtocol overrides policy-based protocol selection.
	ForceProtocol Protocol `json:"force_protocol,omitempty"`

	// Metadata contains additional request metadata.
	Metadata map[string]any `json:"metadata,omitempty"`
}

type AuthResult struct {
	// Status is the authorization status.
	Status AuthStatus `json:"status"`

	// Protocol indicates which protocol was used.
	Protocol Protocol `json:"protocol"`

	// Token is the access token (if approved).
	Token string `json:"token,omitempty"`

	// TokenType is the token type (e.g., "Bearer", "DPoP").
	TokenType string `json:"token_type,omitempty"`

	// ExpiresAt is when the token expires.
	ExpiresAt time.Time `json:"expires_at,omitempty"`

	// Scopes are the granted scopes.
	Scopes []string `json:"scopes,omitempty"`

	// ConsentURI is the URI for human consent (if pending).
	ConsentURI string `json:"consent_uri,omitempty"`

	// StatusURI is the URI to poll for consent status.
	StatusURI string `json:"status_uri,omitempty"`

	// PollInterval is the recommended polling interval.
	PollInterval time.Duration `json:"poll_interval,omitempty"`

	// Message is a human-readable message.
	Message string `json:"message,omitempty"`

	// Metadata contains protocol-specific metadata.
	Metadata map[string]any `json:"metadata,omitempty"`
}

type AuthStatus string

type CacheConfig struct {
	// Enabled enables token caching.
	Enabled bool `json:"enabled" yaml:"enabled"`

	// TTL is the cache TTL (default: token expiry - 1 minute).
	TTL time.Duration `json:"ttl,omitempty" yaml:"ttl,omitempty"`

	// MaxSize is the maximum cache size.
	MaxSize int `json:"max_size,omitempty" yaml:"max_size,omitempty"`
}

type Config struct {
	// AgentID is the agent's identifier.
	AgentID string `json:"agent_id" yaml:"agent_id"`

	// Policy defines authorization routing rules.
	Policy *Policy `json:"policy" yaml:"policy"`

	// IDJAG is the ID-JAG provider configuration.
	IDJAG *IDJAGConfig `json:"idjag,omitempty" yaml:"idjag,omitempty"`

	// AAuth is the AAuth provider configuration.
	AAuth *AAuthConfig `json:"aauth,omitempty" yaml:"aauth,omitempty"`

	// Consent configures the consent flow.
	Consent *ConsentConfig `json:"consent,omitempty" yaml:"consent,omitempty"`

	// Cache configures token caching.
	Cache *CacheConfig `json:"cache,omitempty" yaml:"cache,omitempty"`
}

type ConsentConfig struct {
	// Mode is the consent flow mode.
	Mode ConsentMode `json:"mode" yaml:"mode"`

	// RedirectURI is the callback URI for redirect flow.
	RedirectURI string `json:"redirect_uri,omitempty" yaml:"redirect_uri,omitempty"`

	// ListenAddr is the address for the callback server (redirect flow).
	ListenAddr string `json:"listen_addr,omitempty" yaml:"listen_addr,omitempty"`

	// PollInterval is the polling interval for deferred flow.
	PollInterval time.Duration `json:"poll_interval,omitempty" yaml:"poll_interval,omitempty"`

	// PollTimeout is the maximum time to wait for consent.
	PollTimeout time.Duration `json:"poll_timeout,omitempty" yaml:"poll_timeout,omitempty"`

	// ShowQRCode shows a QR code for the consent URI (CLI).
	ShowQRCode bool `json:"show_qr_code,omitempty" yaml:"show_qr_code,omitempty"`

	// OpenBrowser automatically opens the consent URI in a browser.
	OpenBrowser bool `json:"open_browser,omitempty" yaml:"open_browser,omitempty"`

	// OnConsentRequired is called when consent is required.
	// Allows custom UI handling.
	OnConsentRequired func(consentURI string) `json:"-" yaml:"-"`
}

type ConsentHandler interface {
	// StartConsent initiates a consent flow.
	// Returns the consent URI for the user to visit.
	StartConsent(ctx context.Context, req *AuthRequest) (consentURI string, state string, err error)

	// HandleCallback handles the consent callback.
	HandleCallback(ctx context.Context, code, state string) (*AuthResult, error)

	// ServeHTTP handles HTTP callbacks (implements http.Handler).
	ServeHTTP(w http.ResponseWriter, r *http.Request)
}

type ConsentMode string

type HybridProvider struct {
	// contains filtered or unexported fields
}

type HybridProviderOption func(*HybridProvider)

type IDJAGConfig struct {
	// Enabled enables ID-JAG authorization.
	Enabled bool `json:"enabled" yaml:"enabled"`

	// Issuer is the assertion issuer (agent's identity).
	Issuer string `json:"issuer" yaml:"issuer"`

	// TokenEndpoint is the authorization server's token endpoint.
	TokenEndpoint string `json:"token_endpoint" yaml:"token_endpoint"`

	// PrivateKey is the path/URI to the private key for signing.
	// Supports: file path, vault URI (op://, bw://), env:// prefix.
	PrivateKey string `json:"private_key" yaml:"private_key"`

	// KeyID is the key identifier.
	KeyID string `json:"key_id,omitempty" yaml:"key_id,omitempty"`

	// Algorithm is the signing algorithm (default: ES256).
	Algorithm string `json:"algorithm,omitempty" yaml:"algorithm,omitempty"`

	// DefaultAudience is the default audience for assertions.
	DefaultAudience []string `json:"default_audience,omitempty" yaml:"default_audience,omitempty"`

	// AssertionTTL is the assertion lifetime (default: 5m).
	AssertionTTL time.Duration `json:"assertion_ttl,omitempty" yaml:"assertion_ttl,omitempty"`
}

type IDJAGProvider struct {
	// contains filtered or unexported fields
}

type IDJAGProviderOption func(*IDJAGProvider)

type Policy struct {
	// Mode is the overall policy mode.
	Mode PolicyMode `json:"mode" yaml:"mode"`

	// DefaultProtocol is used when no scope policy matches (hybrid mode).
	DefaultProtocol Protocol `json:"default_protocol" yaml:"default_protocol"`

	// ScopePolicies define per-scope authorization rules.
	ScopePolicies []ScopePolicy `json:"scope_policies,omitempty" yaml:"scope_policies,omitempty"`

	// SensitiveScopes always require AAuth/human consent.
	// Shorthand for adding AAuth policies for each scope.
	SensitiveScopes []string `json:"sensitive_scopes,omitempty" yaml:"sensitive_scopes,omitempty"`

	// AutoScopes always use ID-JAG/automatic authorization.
	// Shorthand for adding ID-JAG policies for each scope.
	AutoScopes []string `json:"auto_scopes,omitempty" yaml:"auto_scopes,omitempty"`
}

type PolicyMatcher struct {
	// contains filtered or unexported fields
}

type PolicyMode string

type Protocol string

type Provider interface {
	// Authorize requests authorization for the given scopes.
	// Returns AuthResult with token if approved, or consent info if pending.
	Authorize(ctx context.Context, req *AuthRequest) (*AuthResult, error)

	// CheckConsent checks the status of a pending consent request.
	CheckConsent(ctx context.Context, statusURI string) (*AuthResult, error)

	// WaitForConsent polls for consent approval with timeout.
	WaitForConsent(ctx context.Context, statusURI string, timeout time.Duration) (*AuthResult, error)

	// Revoke revokes an existing authorization.
	Revoke(ctx context.Context, token string) error

	// Protocol returns the protocol this provider implements.
	Protocol() Protocol

	// HTTPClient returns an HTTP client that automatically adds authorization.
	HTTPClient(ctx context.Context, req *AuthRequest) (*http.Client, error)
}

type ScopePolicy struct {
	// Pattern is the scope pattern to match.
	// Supports wildcards: "calendar:*", "admin:**", "email:read"
	Pattern string `json:"pattern" yaml:"pattern"`

	// Protocol is the protocol to use for matching scopes.
	Protocol Protocol `json:"protocol" yaml:"protocol"`

	// RequireConsent forces human consent even for ID-JAG.
	RequireConsent bool `json:"require_consent,omitempty" yaml:"require_consent,omitempty"`

	// InteractionType is the AAuth interaction type for this scope.
	InteractionType string `json:"interaction_type,omitempty" yaml:"interaction_type,omitempty"`

	// MaxDuration is the maximum authorization duration for this scope.
	MaxDuration string `json:"max_duration,omitempty" yaml:"max_duration,omitempty"`

	// Description describes what this scope allows.
	Description string `json:"description,omitempty" yaml:"description,omitempty"`

	// Priority determines matching order (higher = checked first).
	Priority int `json:"priority,omitempty" yaml:"priority,omitempty"`
}

type TokenClaims struct {
	// Protocol indicates which protocol verified this token.
	Protocol Protocol `json:"protocol"`

	// Issuer is the token issuer.
	Issuer string `json:"iss"`

	// Subject is the token subject (agent ID).
	Subject string `json:"sub"`

	// Audience is the token audience.
	Audience []string `json:"aud"`

	// Scopes are the granted scopes (space-separated in token).
	Scopes []string `json:"scopes"`

	// ExpiresAt is when the token expires.
	ExpiresAt time.Time `json:"exp"`

	// IssuedAt is when the token was issued.
	IssuedAt time.Time `json:"iat"`

	// Actor contains delegation information (who the agent acts for).
	Actor *ActorClaims `json:"act,omitempty"`

	// Raw contains the raw claims map for protocol-specific data.
	Raw map[string]any `json:"raw,omitempty"`
}

type TokenRefresher interface {
	// Refresh refreshes an expired or expiring token.
	Refresh(ctx context.Context, token string) (*AuthResult, error)

	// NeedsRefresh returns true if the token should be refreshed.
	NeedsRefresh(expiresAt time.Time) bool
}

type TokenVerifier struct {
	// contains filtered or unexported fields
}

type VerifierConfig struct {
	// IDJAGEnabled enables ID-JAG token verification.
	IDJAGEnabled bool `json:"idjag_enabled" yaml:"idjag_enabled"`

	// IDJAGIssuers maps issuer URLs to JWKS URLs for ID-JAG verification.
	// If JWKS URL is empty, defaults to {issuer}/.well-known/jwks.json
	IDJAGIssuers map[string]string `json:"idjag_issuers" yaml:"idjag_issuers"`

	// IDJAGAudience is the expected audience for ID-JAG tokens.
	IDJAGAudience string `json:"idjag_audience" yaml:"idjag_audience"`

	// AAuthEnabled enables AAuth token verification.
	AAuthEnabled bool `json:"aauth_enabled" yaml:"aauth_enabled"`

	// AAuthIssuers maps issuer URLs to JWKS URLs for AAuth verification.
	// If JWKS URL is empty, defaults to {issuer}/.well-known/jwks.json
	AAuthIssuers map[string]string `json:"aauth_issuers" yaml:"aauth_issuers"`

	// AAuthAudience is the expected audience for AAuth tokens.
	AAuthAudience string `json:"aauth_audience" yaml:"aauth_audience"`

	// ActionPolicy routes actions to protocols.
	// Key is the action name (e.g., "chat", "write", "delete").
	// Value is the required protocol for that action.
	ActionPolicy map[string]Protocol `json:"action_policy" yaml:"action_policy"`

	// DefaultProtocol is used when no action policy matches.
	// Defaults to ProtocolIDJAG (automatic).
	DefaultProtocol Protocol `json:"default_protocol" yaml:"default_protocol"`

	// SensitiveActions require AAuth (human consent).
	// These override ActionPolicy.
	SensitiveActions []string `json:"sensitive_actions" yaml:"sensitive_actions"`

	// CacheTTL is how long to cache JWKS keys.
	CacheTTL time.Duration `json:"cache_ttl" yaml:"cache_ttl"`
}