systemauth

type AccessChangeLister interface {
	List(ctx context.Context, since time.Time, limit int) ([]accesschange.Change, error)
}

type AccessChangeResponse struct {
	PrincipalID    string    `json:"principal_id"`
	OrganizationID string    `json:"organization_id,omitempty"`
	ChangedAt      time.Time `json:"changed_at"`
	Reason         string    `json:"reason"`
}

type AccessChangesResponse struct {
	Changes   []AccessChangeResponse `json:"changes"`
	NextSince *time.Time             `json:"next_since,omitempty"`
}

type AppRoleResolver interface {
	EffectiveRoles(ctx context.Context, principalID, organizationID uuid.UUID) (map[string]string, error)
}

type AuthCodeData struct {
	// Signature is the hashed authorization code.
	Signature string

	// ClientID is the client that requested the code.
	ClientID string

	// Subject is the user ID.
	Subject string

	// RedirectURI is the callback URI.
	RedirectURI string

	// Scopes are the requested scopes.
	Scopes []string

	// GrantedScopes are the granted scopes.
	GrantedScopes []string

	// State is the CSRF state parameter.
	State string

	// CodeChallenge is the PKCE code challenge.
	CodeChallenge string

	// CodeChallengeMethod is the PKCE method (S256 or plain).
	CodeChallengeMethod string

	// Nonce is the OpenID Connect nonce.
	Nonce string

	// Session holds the session data.
	Session *StoredSession

	// ExpiresAt is when the code expires.
	ExpiresAt int64

	// Used indicates the code has been exchanged.
	Used bool
}

type AuthMethod string

type AuthSession struct {
	// ID is the session ID.
	ID string `json:"id"`

	// Token is the session token (cookie value).
	Token string `json:"token"`

	// IdentityID is the authenticated identity.
	IdentityID uuid.UUID `json:"identity_id"`

	// Identity contains identity details (optional, may be nil).
	Identity *Identity `json:"identity,omitempty"`

	// AuthenticatedAt is when authentication occurred.
	AuthenticatedAt time.Time `json:"authenticated_at"`

	// ExpiresAt is when the session expires.
	ExpiresAt time.Time `json:"expires_at"`

	// AuthenticationMethods used in this session.
	AuthenticationMethods []AuthMethod `json:"authentication_methods,omitempty"`

	// Active indicates if the session is still valid.
	Active bool `json:"active"`

	// DeviceInfo about the session.
	DeviceInfo *DeviceInfo `json:"device_info,omitempty"`
}

type AuthenticateRequest struct {
	// Method is the authentication method.
	Method AuthMethod `json:"method"`

	// Identifier is the user identifier (email, username, etc.).
	Identifier string `json:"identifier"`

	// Password is used for password authentication.
	Password string `json:"password,omitempty"`

	// OIDCToken is used for OIDC authentication.
	OIDCToken string `json:"oidc_token,omitempty"`

	// OIDCProvider is the OIDC provider name.
	OIDCProvider string `json:"oidc_provider,omitempty"`

	// DeviceInfo contains device/client information.
	DeviceInfo *DeviceInfo `json:"device_info,omitempty"`
}

type AuthenticationProvider interface {
	// Authenticate validates credentials and creates a session.
	Authenticate(ctx context.Context, req *AuthenticateRequest) (*AuthSession, error)

	// ValidateSession validates a session token and returns session info.
	ValidateSession(ctx context.Context, sessionToken string) (*AuthSession, error)

	// RefreshSession extends a session's lifetime.
	RefreshSession(ctx context.Context, sessionToken string) (*AuthSession, error)

	// RevokeSession invalidates a session.
	RevokeSession(ctx context.Context, sessionToken string) error

	// RevokeSessions invalidates all sessions for an identity.
	RevokeSessions(ctx context.Context, identityID uuid.UUID) error

	// ListSessions lists active sessions for an identity.
	ListSessions(ctx context.Context, identityID uuid.UUID) ([]*AuthSession, error)
}

type AuthorizationSession struct {
	// RequestID uniquely identifies this authorization request.
	RequestID string `json:"request_id"`

	// ClientID is the OAuth client requesting authorization.
	ClientID string `json:"client_id"`

	// RedirectURI is the client's callback URL.
	RedirectURI string `json:"redirect_uri"`

	// Scopes requested by the client.
	Scopes []string `json:"scopes"`

	// State is the client's CSRF token.
	State string `json:"state"`

	// Nonce is the OpenID Connect nonce for replay protection.
	Nonce string `json:"nonce,omitempty"`

	// CodeChallenge is the PKCE code challenge.
	CodeChallenge string `json:"code_challenge,omitempty"`

	// CodeChallengeMethod is the PKCE challenge method.
	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`

	// UserID is set after authentication.
	UserID string `json:"user_id,omitempty"`

	// ConsentGranted is set after user consents to scopes.
	ConsentGranted bool `json:"consent_granted"`

	// GrantedScopes are the scopes the user consented to.
	GrantedScopes []string `json:"granted_scopes,omitempty"`

	// CreatedAt is when this session was created.
	CreatedAt time.Time `json:"created_at"`

	// ExpiresAt is when this session expires.
	ExpiresAt time.Time `json:"expires_at"`
}

type AuthorizeInput struct {
	ResponseType        string `query:"response_type" required:"true" enum:"code,token" doc:"OAuth 2.0 response type"`
	ClientID            string `query:"client_id" required:"true" doc:"Client identifier"`
	RedirectURI         string `query:"redirect_uri" doc:"URI to redirect after authorization"`
	Scope               string `query:"scope" doc:"Space-separated list of requested scopes"`
	State               string `query:"state" doc:"Opaque value for CSRF protection"`
	CodeChallenge       string `query:"code_challenge" doc:"PKCE code challenge"`
	CodeChallengeMethod string `query:"code_challenge_method" enum:"S256,plain" doc:"PKCE code challenge method"`
	Nonce               string `query:"nonce" doc:"OpenID Connect nonce for replay protection"`
}

type AuthorizeOutput struct {
	Location string `header:"Location" doc:"Redirect URI with authorization code or token"`
}

type Backchannel struct {
	// contains filtered or unexported fields
}

type BackchannelOption func(*Backchannel)

type Client struct {
	// ID is the client identifier.
	ID string `json:"id"`

	// Secret is the client secret (never serialized).
	Secret string `json:"-"`

	// SecretHash is the bcrypt hash of the secret.
	SecretHash string `json:"secret_hash,omitempty"`

	// RotatedSecretHashes are the bcrypt hashes of other secrets that are
	// still active, accepted during a secret rotation.
	RotatedSecretHashes []string `json:"-"`

	// Type is "public" or "confidential".
	Type ClientType `json:"type"`

	// Name is a human-readable name.
	Name string `json:"name"`

	// Description is an optional description.
	Description string `json:"description,omitempty"`

	// RedirectURIs are allowed redirect URIs.
	RedirectURIs []string `json:"redirect_uris"`

	// GrantTypes are allowed grant types.
	GrantTypes []string `json:"grant_types"`

	// ResponseTypes are allowed response types.
	ResponseTypes []string `json:"response_types"`

	// Scopes are allowed scopes.
	Scopes []string `json:"scopes"`

	// Audience restricts the token audience.
	Audience []string `json:"audience,omitempty"`

	// AccessTokenLifetime overrides the default for this client.
	AccessTokenLifetime *time.Duration `json:"access_token_lifetime,omitempty"`

	// RefreshTokenLifetime overrides the default for this client.
	RefreshTokenLifetime *time.Duration `json:"refresh_token_lifetime,omitempty"`

	// Metadata holds arbitrary client metadata.
	Metadata map[string]any `json:"metadata,omitempty"`

	// ManagedPrincipalsEnabled allows this client to create and sign in
	// managed principals. It takes effect only when the deployment also
	// enables managed principals (see Server.ManagedPrincipalsAllowed).
	ManagedPrincipalsEnabled bool `json:"managed_principals_enabled,omitempty"`

	// LoginTokenTTL overrides the deployment's default lifetime of reusable
	// login tokens for this client's managed principals; nil uses it.
	LoginTokenTTL *time.Duration `json:"login_token_ttl,omitempty"`

	// BackchannelLogoutURI is the client's endpoint for OIDC Back-Channel
	// Logout tokens, which also carry access-change events (ADR-010). It
	// must be an https URL (http is allowed for loopback hosts); empty means
	// the client receives none.
	BackchannelLogoutURI string `json:"backchannel_logout_uri,omitempty"`

	// CreatedAt is when the client was created.
	CreatedAt time.Time `json:"created_at"`

	// UpdatedAt is when the client was last updated.
	UpdatedAt time.Time `json:"updated_at"`
}

type ClientConfig struct {
	// ID is the client identifier.
	ID string `json:"id" yaml:"id" jsonschema:"required,description=Unique client identifier"`

	// Secret is the client secret (for confidential clients).
	// Supports environment variable expansion: ${CLIENT_SECRET}
	Secret string `json:"secret,omitempty" yaml:"secret,omitempty" jsonschema:"description=Client secret (supports env var expansion)"`

	// Type is "public" or "confidential".
	Type string `json:"type" yaml:"type" jsonschema:"required,enum=public,enum=confidential,description=Client type"`

	// Name is a human-readable name.
	Name string `json:"name" yaml:"name" jsonschema:"required,description=Human-readable client name"`

	// Description is an optional description.
	Description string `json:"description,omitempty" yaml:"description,omitempty" jsonschema:"description=Client description"`

	// RedirectURIs are allowed redirect URIs.
	RedirectURIs []string `json:"redirect_uris,omitempty" yaml:"redirect_uris,omitempty" jsonschema:"description=Allowed redirect URIs"`

	// GrantTypes are allowed grant types.
	// Options: "authorization_code", "refresh_token", "client_credentials"
	GrantTypes []string `json:"grant_types,omitempty" yaml:"grant_types,omitempty" jsonschema:"description=Allowed OAuth grant types"`

	// ResponseTypes are allowed response types.
	// Options: "code", "token"
	ResponseTypes []string `json:"response_types,omitempty" yaml:"response_types,omitempty" jsonschema:"description=Allowed OAuth response types"`

	// Scopes are allowed scopes.
	Scopes []string `json:"scopes,omitempty" yaml:"scopes,omitempty" jsonschema:"description=Allowed OAuth scopes"`

	// Audience restricts the token audience.
	Audience []string `json:"audience,omitempty" yaml:"audience,omitempty" jsonschema:"description=Allowed token audiences"`

	// AccessTokenLifetime overrides the default for this client.
	AccessTokenLifetime *Duration `` /* 155-byte string literal not displayed */

	// RefreshTokenLifetime overrides the default for this client.
	RefreshTokenLifetime *Duration `` /* 143-byte string literal not displayed */

	// ManagedPrincipals allows this client to create and sign in managed
	// principals (humans without an email, ADR-005). It takes effect only
	// when the deployment's managed_principals.enabled is also set.
	ManagedPrincipals bool `` /* 155-byte string literal not displayed */

	// BackchannelLogoutURI is where SystemAuth sends this client OIDC
	// Back-Channel Logout tokens, which also carry access-change events
	// (ADR-010). An https URL; http only for loopback hosts.
	BackchannelLogoutURI string `` /* 162-byte string literal not displayed */

	// LoginTokenTTL overrides the deployment's default lifetime of reusable
	// login tokens issued for this client's managed principals, for example
	// a school year. It never exceeds managed_principals.login_token_max_ttl.
	LoginTokenTTL *Duration `` /* 161-byte string literal not displayed */
}

type ClientManager interface {
	// CreateClient creates a new OAuth client.
	CreateClient(ctx context.Context, client *Client) error

	// GetClientByID retrieves a client by ID.
	GetClientByID(ctx context.Context, id string) (*Client, error)

	// UpdateClient updates an existing client.
	UpdateClient(ctx context.Context, client *Client) error

	// DeleteClient deletes a client.
	DeleteClient(ctx context.Context, id string) error

	// ListClients returns all clients.
	ListClients(ctx context.Context) ([]*Client, error)
}

type ClientType string

type Config struct {
	// Issuer is the OAuth/OIDC issuer URL (required).
	// Example: "https://auth.example.com"
	Issuer string `json:"issuer" yaml:"issuer" jsonschema:"required,format=uri,description=OAuth/OIDC issuer URL"`

	// Database configures persistent storage.
	// If nil, in-memory storage is used (suitable for embedded mode).
	Database *DatabaseConfig `json:"database,omitempty" yaml:"database,omitempty" jsonschema:"description=Database configuration for persistent storage"`

	// Keys configures signing key management.
	Keys KeyConfig `json:"keys,omitempty" yaml:"keys,omitempty" jsonschema:"description=Signing key configuration"`

	// Tokens configures token lifetimes.
	Tokens TokenConfig `json:"tokens,omitempty" yaml:"tokens,omitempty" jsonschema:"description=Token lifetime configuration"`

	// Clients defines statically configured OAuth clients.
	Clients []ClientConfig `json:"clients,omitempty" yaml:"clients,omitempty" jsonschema:"description=Static OAuth client configurations"`

	// Federation configures SystemAuth integration.
	Federation *FederationConfig `json:"federation,omitempty" yaml:"federation,omitempty" jsonschema:"description=SystemAuth federation configuration"`

	// Features enables/disables optional features.
	Features FeatureConfig `json:"features,omitempty" yaml:"features,omitempty" jsonschema:"description=Feature flags"`

	// SocialLogin enables "log in with GitHub/Google" on this server.
	// If nil, no social login routes are mounted.
	SocialLogin *SocialLoginConfig `` /* 134-byte string literal not displayed */

	// Authz selects the authorization mode (ADR-008): "rbac" (the default)
	// or "rebac" with an engine. SystemAuth does not build the provider
	// from it: the application passes it to authz/mode.New, so the
	// configuration file stays one document.
	Authz authz.ModeConfig `json:"authz,omitempty" yaml:"authz,omitempty" jsonschema:"description=Authorization mode and relationship engine"`

	// ManagedPrincipals configures managed principals; nil disables them.
	ManagedPrincipals *ManagedPrincipalsConfig `` /* 154-byte string literal not displayed */
}

type ConfigFormat string

type ConsentSession struct {
	AccessToken map[string]any `json:"access_token,omitempty"`
	IDToken     map[string]any `json:"id_token,omitempty"`
}

type ConsentStore interface {
	// HasConsent reports whether principalID has granted clientID every
	// scope in scopes.
	HasConsent(ctx context.Context, principalID, clientID string, scopes []string) (bool, error)

	// SaveConsent records that principalID granted clientID scopes, adding
	// to any scopes granted before.
	SaveConsent(ctx context.Context, principalID, clientID string, scopes []string) error

	// RevokeConsent removes every scope principalID granted clientID.
	RevokeConsent(ctx context.Context, principalID, clientID string) error
}

type CredentialType string

type DatabaseConfig struct {
	// Driver is the database driver: "postgres", "sqlite", "mysql"
	Driver string `json:"driver" yaml:"driver" jsonschema:"required,enum=postgres,enum=sqlite,enum=mysql,description=Database driver"`

	// DSN is the database connection string.
	// Supports environment variable expansion: ${DATABASE_URL}
	DSN string `json:"dsn" yaml:"dsn" jsonschema:"required,description=Database connection string (supports env var expansion)"`
}

type DefaultIdentitySyncHandler struct {
	// contains filtered or unexported fields
}

type DefaultSessionProvider struct {
	// contains filtered or unexported fields
}

type DefaultSessionProviderOption func(*DefaultSessionProvider)

type DeviceInfo struct {
	IPAddress string `json:"ip_address,omitempty"`
	UserAgent string `json:"user_agent,omitempty"`
	DeviceID  string `json:"device_id,omitempty"`
}

type Duration time.Duration

type EmbeddedAuthProvider struct {
	// contains filtered or unexported fields
}

type EmbeddedAuthProviderOption func(*EmbeddedAuthProvider)

type EmbeddedIdentityProvider struct {
	// contains filtered or unexported fields
}

type EmbeddedOAuthClientStore struct {
	// contains filtered or unexported fields
}

type EmbeddedOAuthProvider struct {
	// contains filtered or unexported fields
}

type EntConsentStore struct {
	// contains filtered or unexported fields
}

type EntLoginSessionStore struct {
	// contains filtered or unexported fields
}

type EntLoginStateStore struct {
	// contains filtered or unexported fields
}

type EntOrgsSource struct {
	// contains filtered or unexported fields
}

type EntPrincipalDirectory struct {
	// contains filtered or unexported fields
}

type EntPrincipalDirectoryOption func(*EntPrincipalDirectory)

type EntStorage struct {
	// contains filtered or unexported fields
}

type EntStorageOption func(*EntStorage)

type EntStoreOption func(*entStoreConfig)

type ExternalLogin struct {
	// Provider is the upstream provider name (github, google).
	Provider string
	// Subject is the provider's stable user ID.
	Subject string
	// Email is the provider-reported email.
	Email string
	// EmailVerified reports whether the provider asserts Email is verified.
	EmailVerified bool
	// Name is the display name.
	Name string
	// Username is the provider's handle for the person (the GitHub login),
	// when it has one. It seeds the personal organization's slug.
	Username string
	// AvatarURL is the profile picture URL.
	AvatarURL string
}

type FeatureConfig struct {
	// RequirePKCE requires PKCE for all authorization code flows.
	// Default: true for public clients, configurable for confidential
	RequirePKCE bool `` /* 139-byte string literal not displayed */

	// AllowDynamicRegistration enables RFC 7591 dynamic client registration.
	AllowDynamicRegistration bool `` /* 172-byte string literal not displayed */

	// EnableDeviceFlow enables the device authorization grant (RFC 8628).
	EnableDeviceFlow bool `` /* 155-byte string literal not displayed */

	// EnableJWTAccessTokens issues JWT access tokens instead of opaque tokens.
	EnableJWTAccessTokens bool `` /* 171-byte string literal not displayed */
}

type FederationAuthenticator func(r *http.Request) error

type FederationClient struct {
	// contains filtered or unexported fields
}

type FederationConfig struct {
	// Enabled enables federation mode.
	Enabled bool `json:"enabled" yaml:"enabled" jsonschema:"description=Enable SystemAuth federation"`

	// SystemAuthURL is the SystemAuth server URL.
	SystemAuthURL string `json:"systemauth_url" yaml:"systemauth_url" jsonschema:"format=uri,description=SystemAuth server URL"`

	// AppID is this application's identifier in the federation.
	AppID string `json:"app_id" yaml:"app_id" jsonschema:"description=Application ID in the federation"`

	// ClientID is the OAuth client ID for SystemAuth.
	ClientID string `json:"client_id" yaml:"client_id" jsonschema:"description=OAuth client ID for SystemAuth"`

	// ClientSecret is the OAuth client secret for SystemAuth.
	// Supports environment variable expansion: ${SYSTEMAUTH_SECRET}
	ClientSecret string `json:"client_secret" yaml:"client_secret" jsonschema:"description=OAuth client secret (supports env var expansion)"`
}

type FederationEndpoints struct {
	// contains filtered or unexported fields
}

type FederationHealthResponse struct {
	Status       string            `json:"status"`
	AppID        string            `json:"app_id"`
	Version      string            `json:"version"`
	Capabilities []string          `json:"capabilities"`
	Details      map[string]string `json:"details,omitempty"`
}

type FederationOption func(*FederationEndpoints)

type GlobalIdentity struct {
	ID           uuid.UUID              `json:"id"`
	FederationID uuid.UUID              `json:"federation_id"`
	Email        string                 `json:"email"`
	DisplayName  string                 `json:"display_name"`
	Status       string                 `json:"status"`
	Attributes   map[string]interface{} `json:"attributes,omitempty"`
	CreatedAt    time.Time              `json:"created_at"`
	UpdatedAt    time.Time              `json:"updated_at"`
}

type HumanPrincipal struct {
	ID            uuid.UUID
	Email         string
	EmailVerified bool
	DisplayName   string
	GivenName     string
	FamilyName    string
	AvatarURL     string
	Locale        string
	Active        bool
	// Managed is true while the principal has an active manager
	// relationship (ADR-009), whether or not it has an email.
	Managed   bool
	Metadata  map[string]any
	CreatedAt time.Time
	UpdatedAt time.Time
}

type Identity struct {
	// ID is the unique identifier.
	ID uuid.UUID `json:"id"`

	// State is the identity state (active, inactive, etc.).
	State IdentityState `json:"state"`

	// Traits holds identity attributes (email, name, etc.).
	// In Kratos, this maps to the identity traits.
	Traits IdentityTraits `json:"traits"`

	// Metadata holds administrative metadata.
	Metadata map[string]any `json:"metadata,omitempty"`

	// Credentials holds credential information (password hash, etc.).
	// Note: Sensitive data should not be returned in queries.
	Credentials []IdentityCredential `json:"credentials,omitempty"`

	// CreatedAt is when the identity was created.
	CreatedAt time.Time `json:"created_at"`

	// UpdatedAt is when the identity was last updated.
	UpdatedAt time.Time `json:"updated_at"`
}

type IdentityCredential struct {
	Type        CredentialType `json:"type"`
	Identifiers []string       `json:"identifiers,omitempty"`
}

type IdentityFilter struct {
	Email    string
	State    IdentityState
	PageSize int
	Page     int
}

type IdentityMapping struct {
	ID               uuid.UUID `json:"id"`
	GlobalIdentityID uuid.UUID `json:"global_identity_id"`
	AppID            string    `json:"app_id"`
	LocalPrincipalID uuid.UUID `json:"local_principal_id"`
	MappedAt         time.Time `json:"mapped_at"`
	SyncStatus       string    `json:"sync_status"`
}

type IdentityProvider interface {
	// CreateIdentity creates a new identity.
	CreateIdentity(ctx context.Context, identity *Identity) error

	// GetIdentity retrieves an identity by ID.
	GetIdentity(ctx context.Context, id uuid.UUID) (*Identity, error)

	// GetIdentityByEmail retrieves an identity by email address.
	GetIdentityByEmail(ctx context.Context, email string) (*Identity, error)

	// UpdateIdentity updates an existing identity.
	UpdateIdentity(ctx context.Context, identity *Identity) error

	// DeleteIdentity deletes an identity.
	DeleteIdentity(ctx context.Context, id uuid.UUID) error

	// ListIdentities lists identities with optional filtering.
	ListIdentities(ctx context.Context, filter *IdentityFilter) ([]*Identity, error)
}

type IdentityState string

type IdentitySyncHandler interface {
	// SyncIdentity is called when SystemAuth wants to sync an identity to this app.
	// The handler should create/update/delete the local principal as appropriate.
	SyncIdentity(ctx context.Context, req *IdentitySyncRequest) (*IdentitySyncResponse, error)
}

type IdentitySyncRequest struct {
	Action   string          `json:"action"` // create, update, delete
	Identity *GlobalIdentity `json:"identity"`
}

type IdentitySyncResponse struct {
	LocalPrincipalID uuid.UUID `json:"local_principal_id"`
	Status           string    `json:"status"` // synced, pending, failed
	Error            string    `json:"error,omitempty"`
}

type IdentityTraits struct {
	Email         string `json:"email"`
	EmailVerified bool   `json:"email_verified,omitempty"`
	Name          string `json:"name,omitempty"`
	GivenName     string `json:"given_name,omitempty"`
	FamilyName    string `json:"family_name,omitempty"`
	Picture       string `json:"picture,omitempty"`
	Locale        string `json:"locale,omitempty"`
}

type IntrospectInput struct {
	Token         string `form:"token" required:"true" doc:"The token to introspect"`
	TokenTypeHint string `form:"token_type_hint" enum:"access_token,refresh_token" doc:"Hint about the token type"`

	// Client authentication
	Authorization string `header:"Authorization" doc:"Basic authentication header (client_id:client_secret)"`
}

type IntrospectOutput struct {
	Body IntrospectResponse
}

type IntrospectResponse struct {
	Active    bool   `json:"active" doc:"Whether the token is active"`
	Scope     string `json:"scope,omitempty" doc:"Scopes associated with the token"`
	ClientID  string `json:"client_id,omitempty" doc:"Client that requested the token"`
	Username  string `json:"username,omitempty" doc:"Resource owner username"`
	TokenType string `json:"token_type,omitempty" doc:"Token type"`
	Exp       int64  `json:"exp,omitempty" doc:"Token expiration timestamp"`
	Iat       int64  `json:"iat,omitempty" doc:"Token issue timestamp"`
	Nbf       int64  `json:"nbf,omitempty" doc:"Token not-before timestamp"`
	Sub       string `json:"sub,omitempty" doc:"Subject (user ID)"`
	Aud       string `json:"aud,omitempty" doc:"Intended audience"`
	Iss       string `json:"iss,omitempty" doc:"Token issuer"`
	Jti       string `json:"jti,omitempty" doc:"JWT ID"`
}

type JWKSInput struct{}

type JWKSOutput struct {
	Body jose.JSONWebKeySet
}

type KeyConfig struct {
	// Algorithm is the signing algorithm: "RS256" (default), "ES256"
	Algorithm string `` /* 136-byte string literal not displayed */

	// RotationDays is how often to rotate keys (0 = never)
	RotationDays int `` /* 138-byte string literal not displayed */

	// KeyID is the "kid" published in the JWKS and set on every JWT.
	// Default: the RFC 7638 thumbprint of the key.
	KeyID string `` /* 126-byte string literal not displayed */

	// PrivateKeyFile is the path of a PEM-encoded RSA private key (PKCS#1
	// or PKCS#8, at least 2048 bits). Supports environment variable
	// expansion: ${SYSTEMAUTH_SIGNING_KEY_FILE}
	PrivateKeyFile string `` /* 153-byte string literal not displayed */

	// PrivateKeyPEM is a PEM-encoded RSA private key, normally injected from
	// a secret: ${SYSTEMAUTH_SIGNING_KEY}. Mutually exclusive with
	// PrivateKeyFile.
	PrivateKeyPEM string `` /* 174-byte string literal not displayed */

	// PrivateKey is an optional pre-configured RSA private key. When nil,
	// PrivateKeyPEM or PrivateKeyFile is loaded; when none is set an
	// ephemeral key is generated (development only).
	// This field is not serialized - for programmatic use only.
	PrivateKey *rsa.PrivateKey `json:"-" yaml:"-" jsonschema:"-"`
}

type LoginSession struct {
	// PrincipalID is the authenticated principal.
	PrincipalID uuid.UUID

	// Provider is the upstream provider used to sign in.
	Provider string

	// CreatedAt is when the session was established.
	CreatedAt time.Time

	// ExpiresAt is the absolute session expiry.
	ExpiresAt time.Time
}

type LoginSessionStore interface {
	// Create stores session under token.
	Create(ctx context.Context, token string, session LoginSession) error

	// Get returns the session for token, or ErrLoginSessionNotFound when it
	// is unknown or expired.
	Get(ctx context.Context, token string) (LoginSession, error)

	// Delete removes the session for token. Deleting an unknown token is not
	// an error.
	Delete(ctx context.Context, token string) error
}

type ManagedPrincipalsConfig struct {
	// Enabled allows managed principals in this deployment.
	Enabled bool `json:"enabled" yaml:"enabled" jsonschema:"description=Allow managed principals in this deployment"`

	// LoginTokenTTL is the default lifetime of a reusable login token when
	// neither the request nor the client sets one.
	LoginTokenTTL Duration `` /* 145-byte string literal not displayed */

	// LoginTokenMaxTTL caps the lifetime of every login token; longer
	// requests are clamped.
	LoginTokenMaxTTL Duration `` /* 148-byte string literal not displayed */

	// SingleUseTokenTTL is the default lifetime of a single-use login token.
	SingleUseTokenTTL Duration `` /* 156-byte string literal not displayed */
}

type MembershipsInput struct {
	Authorization string `header:"Authorization" doc:"Bearer access token granted the openid scope"`
	Limit         int    `query:"limit" minimum:"1" maximum:"100" doc:"Page size (default 50)"`
	Cursor        string `query:"cursor" doc:"next_cursor of the previous page"`
}

type MembershipsOutput struct {
	Body MembershipsResponse
}

type MembershipsResponse struct {
	Orgs       []OrgClaim `json:"orgs"`
	NextCursor string     `json:"next_cursor,omitempty"`
}

type MemoryConsentStore struct {
	// contains filtered or unexported fields
}

type MemoryLoginSessionStore struct {
	// contains filtered or unexported fields
}

type MemoryPrincipalDirectory struct {
	// contains filtered or unexported fields
}

type MemoryStorage struct {
	// contains filtered or unexported fields
}

type OAuthAuthorizeRequest struct {
	ClientID            string `json:"client_id"`
	RedirectURI         string `json:"redirect_uri"`
	ResponseType        string `json:"response_type"`
	Scope               string `json:"scope"`
	State               string `json:"state"`
	Nonce               string `json:"nonce,omitempty"`
	CodeChallenge       string `json:"code_challenge,omitempty"`
	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
	Prompt              string `json:"prompt,omitempty"`
	MaxAge              int    `json:"max_age,omitempty"`
	UILocales           string `json:"ui_locales,omitempty"`
	ACRValues           string `json:"acr_values,omitempty"`
}

type OAuthAuthorizeResponse struct {
	// Code is the authorization code (for code flow).
	Code string `json:"code,omitempty"`

	// RedirectTo is the URL to redirect the user to.
	RedirectTo string `json:"redirect_to"`

	// Error information if authorization failed.
	Error            string `json:"error,omitempty"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type OAuthClient struct {
	// ClientID is the unique client identifier.
	ClientID string `json:"client_id"`

	// ClientSecret is the client secret (hashed in storage).
	ClientSecret string `json:"client_secret,omitempty"`

	// ClientName is the human-readable client name.
	ClientName string `json:"client_name,omitempty"`

	// RedirectURIs are the allowed redirect URIs.
	RedirectURIs []string `json:"redirect_uris"`

	// GrantTypes are the allowed grant types.
	GrantTypes []string `json:"grant_types"`

	// ResponseTypes are the allowed response types.
	ResponseTypes []string `json:"response_types"`

	// Scope is the allowed scope.
	Scope string `json:"scope"`

	// Audience are the allowed audiences.
	Audience []string `json:"audience,omitempty"`

	// TokenEndpointAuthMethod is the authentication method for the token endpoint.
	TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty"`

	// Public indicates if this is a public client (no secret).
	Public bool `json:"public"`

	// Metadata holds custom client metadata.
	Metadata map[string]any `json:"metadata,omitempty"`

	// CreatedAt is when the client was created.
	CreatedAt time.Time `json:"created_at,omitzero"`

	// UpdatedAt is when the client was last updated.
	UpdatedAt time.Time `json:"updated_at,omitzero"`
}

type OAuthClientStore interface {
	// CreateClient creates a new OAuth client.
	CreateClient(ctx context.Context, client *OAuthClient) error

	// GetClient retrieves a client by ID.
	GetClient(ctx context.Context, clientID string) (*OAuthClient, error)

	// UpdateClient updates an existing client.
	UpdateClient(ctx context.Context, client *OAuthClient) error

	// DeleteClient deletes a client.
	DeleteClient(ctx context.Context, clientID string) error

	// ListClients lists all clients.
	ListClients(ctx context.Context) ([]*OAuthClient, error)
}

type OAuthConsentAccept struct {
	GrantScopes []string        `json:"grant_scopes"`
	Remember    bool            `json:"remember"`
	RememberFor int             `json:"remember_for,omitempty"`
	Session     *ConsentSession `json:"session,omitempty"`
}

type OAuthConsentReject struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type OAuthConsentRequest struct {
	Challenge       string   `json:"challenge"`
	ClientID        string   `json:"client_id"`
	RequestedScopes []string `json:"requested_scopes"`
	Subject         string   `json:"subject"`
	Skip            bool     `json:"skip"`
}

type OAuthConsentResponse struct {
	RedirectTo string `json:"redirect_to"`
}

type OAuthError struct {
	Error            string `json:"error" doc:"Error code"`
	ErrorDescription string `json:"error_description,omitempty" doc:"Human-readable error description"`
	ErrorURI         string `json:"error_uri,omitempty" doc:"URI with more information about the error"`
}

type OAuthIntrospection struct {
	Active    bool     `json:"active"`
	Scope     string   `json:"scope,omitempty"`
	ClientID  string   `json:"client_id,omitempty"`
	Username  string   `json:"username,omitempty"`
	TokenType string   `json:"token_type,omitempty"`
	Exp       int64    `json:"exp,omitempty"`
	Iat       int64    `json:"iat,omitempty"`
	Nbf       int64    `json:"nbf,omitempty"`
	Sub       string   `json:"sub,omitempty"`
	Aud       []string `json:"aud,omitempty"`
	Iss       string   `json:"iss,omitempty"`
	Jti       string   `json:"jti,omitempty"`
}

type OAuthLoginAccept struct {
	Subject     string         `json:"subject"`
	Remember    bool           `json:"remember"`
	RememberFor int            `json:"remember_for,omitempty"`
	ACR         string         `json:"acr,omitempty"`
	Context     map[string]any `json:"context,omitempty"`
}

type OAuthLoginReject struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type OAuthLoginRequest struct {
	Challenge       string   `json:"challenge"`
	ClientID        string   `json:"client_id"`
	RequestedScopes []string `json:"requested_scopes"`
	Skip            bool     `json:"skip"`
	Subject         string   `json:"subject,omitempty"`
}

type OAuthLoginResponse struct {
	RedirectTo string `json:"redirect_to"`
}

type OAuthProvider interface {

	// Authorize handles the authorization request.
	// Returns an authorization code or error.
	Authorize(ctx context.Context, req *OAuthAuthorizeRequest) (*OAuthAuthorizeResponse, error)

	// Token handles token requests (authorization code, refresh, client credentials).
	Token(ctx context.Context, req *OAuthTokenRequest) (*OAuthTokenResponse, error)

	// Introspect validates and returns information about a token.
	Introspect(ctx context.Context, token string, tokenTypeHint string) (*OAuthIntrospection, error)

	// Revoke revokes an access or refresh token.
	Revoke(ctx context.Context, token string, tokenTypeHint string) error

	// UserInfo returns claims about the authenticated user (OIDC).
	UserInfo(ctx context.Context, accessToken string) (*OAuthUserInfo, error)

	// GetConsentRequest retrieves a pending consent request.
	GetConsentRequest(ctx context.Context, challenge string) (*OAuthConsentRequest, error)

	// AcceptConsent accepts a consent request.
	AcceptConsent(ctx context.Context, challenge string, accept *OAuthConsentAccept) (*OAuthConsentResponse, error)

	// RejectConsent rejects a consent request.
	RejectConsent(ctx context.Context, challenge string, reject *OAuthConsentReject) (*OAuthConsentResponse, error)

	// GetLoginRequest retrieves a pending login request.
	GetLoginRequest(ctx context.Context, challenge string) (*OAuthLoginRequest, error)

	// AcceptLogin accepts a login request.
	AcceptLogin(ctx context.Context, challenge string, accept *OAuthLoginAccept) (*OAuthLoginResponse, error)

	// RejectLogin rejects a login request.
	RejectLogin(ctx context.Context, challenge string, reject *OAuthLoginReject) (*OAuthLoginResponse, error)
}

type OAuthTokenRequest struct {
	GrantType    string `json:"grant_type"`
	Code         string `json:"code,omitempty"`
	RedirectURI  string `json:"redirect_uri,omitempty"`
	RefreshToken string `json:"refresh_token,omitempty"`
	ClientID     string `json:"client_id,omitempty"`
	ClientSecret string `json:"client_secret,omitempty"`
	CodeVerifier string `json:"code_verifier,omitempty"`
	Scope        string `json:"scope,omitempty"`
}

type OAuthTokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int64  `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
	Scope        string `json:"scope,omitempty"`
}

type OAuthUserInfo struct {
	Sub           string `json:"sub"`
	Name          string `json:"name,omitempty"`
	GivenName     string `json:"given_name,omitempty"`
	FamilyName    string `json:"family_name,omitempty"`
	Email         string `json:"email,omitempty"`
	EmailVerified bool   `json:"email_verified,omitempty"`
	Picture       string `json:"picture,omitempty"`
	Locale        string `json:"locale,omitempty"`
	Zoneinfo      string `json:"zoneinfo,omitempty"`
}

type OpenIDConfigInput struct{}

type OpenIDConfigOutput struct {
	Body OpenIDConfiguration
}

type OpenIDConfiguration struct {
	Issuer                            string   `json:"issuer"`
	AuthorizationEndpoint             string   `json:"authorization_endpoint"`
	TokenEndpoint                     string   `json:"token_endpoint"`
	UserinfoEndpoint                  string   `json:"userinfo_endpoint,omitempty"`
	JwksURI                           string   `json:"jwks_uri"`
	RegistrationEndpoint              string   `json:"registration_endpoint,omitempty"`
	IntrospectionEndpoint             string   `json:"introspection_endpoint,omitempty"`
	RevocationEndpoint                string   `json:"revocation_endpoint,omitempty"`
	ScopesSupported                   []string `json:"scopes_supported,omitempty"`
	ResponseTypesSupported            []string `json:"response_types_supported"`
	ResponseModesSupported            []string `json:"response_modes_supported,omitempty"`
	GrantTypesSupported               []string `json:"grant_types_supported,omitempty"`
	SubjectTypesSupported             []string `json:"subject_types_supported"`
	IDTokenSigningAlgValuesSupported  []string `json:"id_token_signing_alg_values_supported"`
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`
	ClaimsSupported                   []string `json:"claims_supported,omitempty"`
	CodeChallengeMethodsSupported     []string `json:"code_challenge_methods_supported,omitempty"`
}

type Option func(*Server)

type OrgClaim struct {
	ID   string `json:"id"`
	Slug string `json:"slug,omitempty"`
	Name string `json:"name,omitempty"`
	// Type is personal, team or enterprise.
	Type string `json:"type,omitempty"`
	// Role is the principal's organization role: owner, admin, member or
	// collaborator.
	Role string `json:"role"`
	// Apps maps each application the principal may open in this
	// organization to the principal's role in it. An application absent
	// from the map is one the principal may not open.
	Apps map[string]string `json:"apps"`
}

type OrgsResult struct {
	Orgs      []OrgClaim
	Truncated bool
}

type OrgsSource interface {
	// OrgsClaim returns the principal's organizations, personal first and
	// then by most recent membership, at most MaxOrgsInToken of them. The
	// compact form omits slug, name and type.
	OrgsClaim(ctx context.Context, principalID uuid.UUID, compact bool) (OrgsResult, error)
	// Memberships returns one page of the principal's organizations in
	// the full form and the same order, limit at most, starting after the
	// organization cursor names ("" for the first page). next is empty on
	// the last page.
	Memberships(ctx context.Context, principalID uuid.UUID, limit int, cursor string) (page []OrgClaim, next string, err error)
}

type PersonalOrgEnsurer interface {
	// EnsurePersonalOrg creates the principal's personal organization when
	// it has none and does nothing otherwise.
	EnsurePersonalOrg(ctx context.Context, p *HumanPrincipal, login ExternalLogin) error
}

type PrincipalDirectory interface {
	// FindByExternalIdentity returns the principal linked to (provider,
	// subject), or ErrPrincipalNotFound.
	FindByExternalIdentity(ctx context.Context, provider, subject string) (*HumanPrincipal, error)

	// FindByVerifiedEmail returns the human principal whose email matches
	// (case-insensitively) and is itself verified, or ErrPrincipalNotFound.
	FindByVerifiedEmail(ctx context.Context, email string) (*HumanPrincipal, error)

	// CreateFromExternal creates a human principal from login, with the
	// email marked verified, and links the external identity. An
	// implementation backed by an organization store also creates the
	// person's personal organization in the same transaction (ADR-006
	// decision 1), so a first login yields both or nothing. It returns
	// ErrEmailConflict if the email is already taken, and
	// ErrExternalIdentityExists if the identity was linked concurrently.
	CreateFromExternal(ctx context.Context, login ExternalLogin) (*HumanPrincipal, error)

	// LinkExternalIdentity links login's identity to an existing principal.
	// It returns ErrExternalIdentityExists if already linked.
	LinkExternalIdentity(ctx context.Context, principalID uuid.UUID, login ExternalLogin) error

	// RecordLogin updates last-login bookkeeping and the provider-reported
	// email on the external identity.
	RecordLogin(ctx context.Context, principalID uuid.UUID, login ExternalLogin, at time.Time) error

	// GetPrincipal returns a principal by ID, or ErrPrincipalNotFound.
	GetPrincipal(ctx context.Context, id uuid.UUID) (*HumanPrincipal, error)
}

type PrincipalStatus interface {
	// PrincipalActive reports whether the principal named by subject is
	// active. Subjects that are not principals this storage holds, such as
	// users an application's session provider names, are not judged and
	// report true.
	PrincipalActive(ctx context.Context, subject string) (bool, error)
}

type Providers struct {
	Identity       IdentityProvider
	Authentication AuthenticationProvider
	OAuth          OAuthProvider
	OAuthClients   OAuthClientStore
}

type ProvidersOption func(*providersConfig)

type RequestGate func(r *http.Request) bool

type RevokeInput struct {
	Token         string `form:"token" required:"true" doc:"The token to revoke"`
	TokenTypeHint string `form:"token_type_hint" enum:"access_token,refresh_token" doc:"Hint about the token type"`

	// Client authentication
	Authorization string `header:"Authorization" doc:"Basic authentication header (client_id:client_secret)"`
}

type RevokeOutput struct{}

type SSOSession struct {
	ID               uuid.UUID `json:"id"`
	GlobalIdentityID uuid.UUID `json:"global_identity_id"`
	AuthTime         time.Time `json:"auth_time"`
	ExpiresAt        time.Time `json:"expires_at"`
	AppsAccessed     []string  `json:"apps_accessed"`
}

type SSOTokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
	Scope        string `json:"scope,omitempty"`
}

type Server struct {
	// contains filtered or unexported fields
}

type Session struct {
	*openid.DefaultSession `json:"oidc"`

	// FamilyIssuedAt is when the grant that started this token family was
	// first exchanged for tokens. Refresh rotation never extends past
	// FamilyIssuedAt + Tokens.RefreshTokenAbsoluteLifetime.
	FamilyIssuedAt time.Time `json:"family_issued_at,omitzero"`

	// AccessClaims are the claims of JWT access tokens.
	AccessClaims *jwt.JWTClaims `json:"access_claims,omitempty"`

	// AccessHeader is the JOSE header of JWT access tokens.
	AccessHeader *jwt.Headers `json:"access_header,omitempty"`
}