identity

type AAuthVerifier interface {
	// VerifyAAuth verifies an AAuth token and returns the agent identity.
	VerifyAAuth(ctx context.Context, token string) (*AgentIdentity, error)
}

type AgentIdentity struct {
	// AgentID uniquely identifies the agent
	AgentID string `json:"agent_id"`

	// MissionID identifies the current mission (optional)
	MissionID string `json:"mission_id,omitempty"`

	// Issuer is the authorization server that authenticated the agent
	Issuer string `json:"iss"`

	// Capabilities are what the agent can do
	Capabilities []string `json:"capabilities,omitempty"`

	// Scopes are the granted OAuth scopes
	Scopes []string `json:"scopes,omitempty"`

	// DelegatedBy indicates which agent delegated to this one (for sub-agents)
	DelegatedBy string `json:"delegated_by,omitempty"`

	// AAuthToken is the original AAuth access token
	AAuthToken string `json:"aauth_token,omitempty"`

	// VerifiedAt is when the AAuth token was verified
	VerifiedAt time.Time `json:"verified_at,omitempty"`
}

type ComposeOptions struct {
	// AAuthToken is the AAuth access token (required)
	AAuthToken string

	// IDJAGAssertion is the ID-JAG assertion for human identity (optional)
	IDJAGAssertion string

	// IncludeWorkload indicates whether to extract workload identity
	IncludeWorkload bool

	// TraceID for distributed tracing
	TraceID string
}

type ComposedIdentity struct {
	// Human identity (from ID-JAG delegation)
	Human *HumanIdentity `json:"human,omitempty"`

	// Agent identity (from AAuth)
	Agent *AgentIdentity `json:"agent"`

	// Workload identity (from SPIFFE)
	Workload *WorkloadIdentity `json:"workload,omitempty"`

	// BindingID uniquely identifies this composed identity binding
	BindingID string `json:"binding_id"`

	// BoundAt is when the identities were linked
	BoundAt time.Time `json:"bound_at"`

	// ExpiresAt is when the binding expires (earliest of component expirations)
	ExpiresAt time.Time `json:"expires_at,omitempty"`

	// TraceID for distributed tracing
	TraceID string `json:"trace_id,omitempty"`
}

type Composer struct {
	// contains filtered or unexported fields
}

type ComposerOption func(*Composer)

type HumanIdentity struct {
	// Subject is the human user's identifier
	Subject string `json:"sub"`

	// Issuer is the identity provider that authenticated the human
	Issuer string `json:"iss"`

	// Email is the user's email (optional)
	Email string `json:"email,omitempty"`

	// Name is the user's display name (optional)
	Name string `json:"name,omitempty"`

	// Roles are the user's roles from the IdP
	Roles []string `json:"roles,omitempty"`

	// IDJAGToken is the original ID-JAG assertion token
	IDJAGToken string `json:"idjag_token,omitempty"`

	// VerifiedAt is when the ID-JAG assertion was verified
	VerifiedAt time.Time `json:"verified_at,omitempty"`
}

type IDJAGVerifier interface {
	// VerifyIDJAG verifies an ID-JAG assertion and returns the human identity.
	VerifyIDJAG(ctx context.Context, assertion string) (*HumanIdentity, error)
}

type WorkloadIdentity struct {
	// SPIFFEID is the SPIFFE identifier (e.g., spiffe://domain/path)
	SPIFFEID string `json:"spiffe_id"`

	// TrustDomain is the SPIFFE trust domain
	TrustDomain string `json:"trust_domain,omitempty"`

	// ServiceName is the service name from the SPIFFE ID path
	ServiceName string `json:"service_name,omitempty"`

	// SVID is the X.509 SVID certificate (PEM encoded, optional)
	SVID string `json:"svid,omitempty"`

	// VerifiedAt is when the SPIFFE identity was verified
	VerifiedAt time.Time `json:"verified_at,omitempty"`
}

type WorkloadVerifier interface {
	// VerifyWorkload extracts and verifies the workload identity.
	VerifyWorkload(ctx context.Context) (*WorkloadIdentity, error)
}