auth

type AAuthClaims struct {
	jwt.RegisteredClaims

	// Scope is the space-separated list of granted scopes.
	Scope string `json:"scope,omitempty"`

	// Act contains the actor (agent) information for delegation tokens.
	Act map[string]any `json:"act,omitempty"`
}

type AAuthConfig struct {
	// Enabled controls whether AAuth token validation is enabled.
	Enabled bool

	// IssuerURL is the URL of the AAuth issuer (PeopleServer).
	// Used for token validation and JWKS fetching.
	IssuerURL string

	// Audience is the expected audience claim in AAuth tokens.
	// Typically the URL of this service.
	Audience string

	// JWKSURL is the URL to fetch public keys for token verification.
	// If not set, defaults to {IssuerURL}/.well-known/jwks.json
	JWKSURL string
}

type AAuthVerifier struct {
	// contains filtered or unexported fields
}

type ACL struct {
	// contains filtered or unexported fields
}

type AgentAuthClaims = agentauth.TokenClaims

type AgentAuthConfig struct {
	// Enabled controls whether agent authentication is enabled.
	Enabled bool

	// IDJAGEnabled enables ID-JAG token verification (automatic auth).
	IDJAGEnabled bool

	// IDJAGIssuers maps issuer URLs to JWKS URLs for ID-JAG verification.
	// If JWKS URL is empty, defaults to {issuer}/.well-known/jwks.json
	IDJAGIssuers map[string]string

	// IDJAGAudience is the expected audience for ID-JAG tokens.
	IDJAGAudience string

	// AAuthEnabled enables AAuth token verification (human consent).
	AAuthEnabled bool

	// AAuthIssuers maps issuer URLs to JWKS URLs for AAuth verification.
	// If JWKS URL is empty, defaults to {issuer}/.well-known/jwks.json
	AAuthIssuers map[string]string

	// AAuthAudience is the expected audience for AAuth tokens.
	AAuthAudience string

	// SensitiveActions require AAuth (human consent).
	// Default: write, delete, update, create, send, upload, admin
	SensitiveActions []string

	// ActionPolicy maps specific actions to required protocols.
	// Overrides default behavior for specific actions.
	ActionPolicy map[string]agentauth.Protocol
}

type AgentAuthProtocol = agentauth.Protocol

type AgentAuthVerifier struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Enabled controls whether authentication is required for the web UI.
	Enabled bool

	// SessionSecret is the secret key for signing session cookies.
	// Must be at least 32 bytes when auth is enabled.
	SessionSecret string

	// CookieDomain optionally restricts cookies to a specific domain.
	CookieDomain string

	// GitHub holds GitHub OAuth configuration.
	GitHub OAuthProviderConfig

	// Google holds Google OAuth configuration.
	Google OAuthProviderConfig

	// AllowedEmails is a list of exact email addresses allowed to login.
	AllowedEmails []string

	// AllowedDomains is a list of email domains allowed to login (e.g., "@company.com").
	AllowedDomains []string
}

type Handlers struct {
	// contains filtered or unexported fields
}

type HandlersConfig struct {
	Config    *Config
	Sessions  *SessionManager
	Providers *Providers
	ACL       *ACL
	Assets    fs.FS
	Logger    *slog.Logger
}

type LoginData struct {
	HasGitHub bool
	HasGoogle bool
	Error     string
}

type Middleware struct {
	// contains filtered or unexported fields
}

type OAuthProviderConfig struct {
	// ClientID is the OAuth client ID.
	ClientID string

	// ClientSecret is the OAuth client secret.
	ClientSecret string
}

type Provider string

type Providers struct {
	// contains filtered or unexported fields
}

type SessionManager struct {
	// contains filtered or unexported fields
}

type User struct {
	Email     string    `json:"email"`
	Name      string    `json:"name"`
	Picture   string    `json:"picture"`
	Provider  string    `json:"provider"`
	LoginTime time.Time `json:"login_time"`
}