scimtoken

type API struct {
	// contains filtered or unexported fields
}

type APIConfig struct {
	// BasePath prefixes every endpoint (default: "/api/v1"), matching the
	// organization API's, so the endpoints sit under
	// {BasePath}/organizations/{slug}/scim-tokens.
	BasePath string
	// Organizations resolves the organization slug in the path. Required.
	Organizations SlugResolver
	// Caller identifies the authenticated principal (default:
	// requestprincipal.PrincipalUUID, set by requestprincipal.Middleware).
	Caller func(ctx context.Context) (uuid.UUID, error)
	// Logger is the logger (default: slog.Default()).
	Logger *slog.Logger
}

type CredentialOptions struct {
	// Scopes are the SCIM scopes granted to a tenant token. Default:
	// scim.ScopeFull.
	Scopes []string

	// Platform authenticates platform operator credentials. It is
	// consulted only for bearer tokens that are not in this package's
	// token format, and its credential must have scim.Scope.Platform set;
	// any other credential is refused. When nil, which is the default,
	// only tenant tokens are accepted.
	Platform func(r *http.Request) (scim.Credential, error)
}

type IssueInput struct {
	Slug string `path:"slug" doc:"Organization slug"`
	Body struct {
		Description      string `json:"description,omitempty" maxLength:"255" doc:"Optional note, such as the identity provider"`
		ExpiresInSeconds int64  `json:"expires_in_seconds,omitempty" minimum:"0" doc:"Lifetime in seconds; 0 or absent means no expiry"`
	}
}

type IssueOptions struct {
	// Description is an optional note, such as the identity provider's
	// name.
	Description string
	// ExpiresIn bounds the token's lifetime. Zero means no expiry.
	ExpiresIn time.Duration
}

type IssueOutput struct {
	Body *Issued
}

type Issued struct {
	Token    string `json:"token"`
	Metadata Token  `json:"metadata"`
	// Revoked lists the tokens the rotation revoked (N-2 and older).
	Revoked []uuid.UUID `json:"revoked,omitempty"`
}

type ListOutput struct {
	Body struct {
		Tokens []Token `json:"tokens"`
	}
}

type Option func(*Service)

type RevokeInput struct {
	Slug    string `path:"slug" doc:"Organization slug"`
	TokenID string `path:"token_id" format:"uuid" doc:"Token ID"`
}

type Service struct {
	// contains filtered or unexported fields
}

type SlugInput struct {
	Slug string `path:"slug" doc:"Organization slug"`
}

type SlugResolver interface {
	ResolveSlug(ctx context.Context, slug string) (*orgsvc.Organization, bool, error)
}

type Status string

type Token struct {
	ID             uuid.UUID  `json:"id"`
	OrganizationID uuid.UUID  `json:"organization_id"`
	Generation     int        `json:"generation"`
	Prefix         string     `json:"prefix"`
	Description    string     `json:"description,omitempty"`
	CreatedBy      *uuid.UUID `json:"created_by,omitempty"`
	CreatedAt      time.Time  `json:"created_at"`
	LastUsedAt     *time.Time `json:"last_used_at,omitempty"`
	ExpiresAt      *time.Time `json:"expires_at,omitempty"`
	RevokedAt      *time.Time `json:"revoked_at,omitempty"`
	RevokedBy      *uuid.UUID `json:"revoked_by,omitempty"`
	Status         Status     `json:"status"`
}