jwt

type CNFClaim struct {
	// JKT is the JWK thumbprint of the DPoP public key (RFC 7638).
	JKT string `json:"jkt,omitempty"`
}

type Claims struct {
	jwt.RegisteredClaims

	// PrincipalID is the unique identifier for the authenticated principal.
	PrincipalID uuid.UUID `json:"pid,omitempty"`

	// PrincipalType is the type of principal (human, application, agent, service).
	// Empty string defaults to "human" for backward compatibility.
	PrincipalType string `json:"pty,omitempty"`

	// Email is the principal's email address (primarily for human principals).
	Email string `json:"email,omitempty"`

	// Name is the principal's display name.
	Name string `json:"name,omitempty"`

	// OrganizationID is the current organization context (optional).
	OrganizationID *uuid.UUID `json:"org_id,omitempty"`

	// OrganizationSlug is the current organization slug (optional).
	OrganizationSlug string `json:"org_slug,omitempty"`

	// Role is the principal's role in the current organization (optional).
	Role string `json:"role,omitempty"`

	// ClientID is the OAuth client/application ID that obtained this token.
	// This is the "azp" (authorized party) claim from OAuth 2.0.
	// Used for per-application rate limiting and audit logging.
	ClientID string `json:"azp,omitempty"`

	// Scopes are the OAuth scopes granted to this token.
	Scopes []string `json:"scp,omitempty"`

	// Permissions are fine-grained permissions (optional).
	Permissions []string `json:"perms,omitempty"`

	// IsPlatformAdmin indicates cross-organization admin access.
	IsPlatformAdmin bool `json:"platform_admin,omitempty"`

	// TokenType distinguishes access tokens from refresh tokens.
	TokenType TokenType `json:"type,omitempty"`

	// TokenFamily is used for refresh token rotation tracking.
	TokenFamily string `json:"family,omitempty"`

	// Confirmation contains the DPoP binding (cnf claim with jkt).
	// When set, the token is bound to a specific DPoP key pair.
	Confirmation *CNFClaim `json:"cnf,omitempty"`
}

type Config struct {
	// Secret is the symmetric key used for HS256 signing.
	// Either Secret or PrivateKey must be provided.
	Secret []byte //nolint:gosec // G117: field holds runtime secret value

	// PrivateKey is the RSA or ECDSA private key for RS256/ES256 signing.
	// Either Secret or PrivateKey must be provided.
	PrivateKey any

	// PublicKey is the RSA or ECDSA public key for RS256/ES256 verification.
	// Required when PrivateKey is set.
	PublicKey any

	// Algorithm specifies the signing algorithm.
	// Supported: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512
	// Defaults to HS256.
	Algorithm string

	// Issuer is the JWT "iss" claim value.
	Issuer string

	// Audience is the JWT "aud" claim value.
	Audience []string

	// AccessTokenExpiry is the duration before access tokens expire.
	// Defaults to 15 minutes.
	AccessTokenExpiry time.Duration

	// RefreshTokenExpiry is the duration before refresh tokens expire.
	// Defaults to 7 days.
	RefreshTokenExpiry time.Duration

	// RefreshTokenRotation enables automatic refresh token rotation.
	// When enabled, a new refresh token is issued on each refresh.
	RefreshTokenRotation bool
}

type DPoPBinding struct {
	// Thumbprint is the JWK thumbprint of the DPoP key pair.
	Thumbprint string
}

type Service struct {
	// contains filtered or unexported fields
}

type TokenOptions struct {
	// DPoPThumbprint binds the token to a DPoP key pair.
	// When set, the token will include a cnf.jkt claim.
	DPoPThumbprint string

	// Audience replaces the configured audience on this token, for example to
	// address it to one application when several share a signing key.
	Audience []string
}

type TokenPair struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
	ExpiresIn    int64  `json:"expires_in"` // Access token expiry in seconds
}

type TokenType string