aauthrs

type Authenticator struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Resource is this resource server's identifier (https, host only,
	// e.g. "https://api.example.com"): the aud of the person and auth
	// tokens it accepts and the iss of the resource tokens it issues.
	// Required.
	Resource string

	// TrustedIssuers are the Person Servers and Access Servers whose
	// person and auth tokens this resource accepts. Tokens from any other
	// issuer are refused before any key discovery. Required.
	TrustedIssuers []string

	// AccessMode is the credential the resource requires
	// (aauth.AccessMode*): AccessModeAuthToken (the default) serves only
	// auth tokens; AccessModePersonToken also serves person tokens when
	// the route requires no scopes; AccessModeAgentToken also serves bare
	// agent tokens when the route requires no scopes.
	AccessMode string

	// Scopes returns the scopes a request requires. An auth token must
	// grant all of them; a resource token requests them. Nil requires
	// none.
	Scopes func(r *http.Request) []string

	// Key signs resource tokens, and KeyID is its kid (default: the RFC
	// 7638 thumbprint). Required unless AccessMode is
	// AccessModeAgentToken.
	Key   crypto.Signer
	KeyID string

	// Audience, for four-party access, is the resource's Access Server:
	// resource tokens are addressed to it. Empty means three-party: the
	// Person Server named by the presented token.
	Audience string

	// Resolver locates person and auth token issuer keys. Default: a
	// JWKS resolver (aauth.JWKSResolver) over HTTPClient and JWKSCache.
	// It is always restricted to TrustedIssuers.
	Resolver aauth.KeyResolver
	// AgentResolver locates agent token keys (AccessModeAgentToken).
	// Default: a JWKS resolver over HTTPClient and JWKSCache.
	AgentResolver aauth.KeyResolver
	// HTTPClient performs key discovery. Default: aauth.DiscoveryClient,
	// which reaches only public https destinations; a client supplied here
	// should apply the same egress admission. Local development needs a
	// client that can reach the local issuer.
	HTTPClient *http.Client
	// JWKSCache caches discovered key sets. Default: a new cache.
	JWKSCache *aauth.JWKSCache

	// Signature tunes HTTP message signature verification: the validity
	// window, the clock, and components agents must cover beyond the base
	// set. The zero value uses the library defaults.
	Signature aauth.RequestVerifyOptions

	// CheckSubject is the resource's record check for a person (draft
	// §9.4.3.2): it confirms or establishes the resource's record for
	// (iss, sub). Its error rejects the request.
	CheckSubject func(ctx context.Context, iss, sub string) error

	// Resolve, when set, runs on every accepted request: it may map the
	// principal to an application principal (setting PrincipalID or
	// Organization) or reject the request. Its error is returned from
	// Authenticate unchanged: a *requestprincipal.Error is that response,
	// any other error a 500.
	Resolve func(ctx context.Context, p *requestprincipal.RequestPrincipal) error

	// Limiter, when set, rate-limits resource token issuance per agent
	// key (key "aauth-rs:resource-token:<thumbprint>"); a refusal is a
	// 429 with Retry-After.
	Limiter aauth.Limiter

	// Metadata supplies the display members (name, description, logos,
	// ...) of aauth-resource.json; issuer and jwks_uri are filled in.
	Metadata aauth.ServerMetadata
	// ScopeDescriptions are published in aauth-resource.json for consent
	// screens.
	ScopeDescriptions map[string]string
	// JWKSPath is the path of the resource's JWKS (default
	// DefaultJWKSPath).
	JWKSPath string

	// InsecureSkipIdentifierCheck accepts http and port-bearing
	// identifiers, for development and tests. Never set it in production.
	InsecureSkipIdentifierCheck bool
}