appauth

type CodeRecord struct {
	Purpose      string
	Ref          InstanceRef
	RedirectHost string
	Identity     browsersession.Identity
	ExpiresAt    time.Time
}

type CodeStore interface {
	Put(ctx context.Context, code string, record CodeRecord) error
	Take(ctx context.Context, code string) (CodeRecord, bool)
}

type Config struct {
	// PreviewIdentity verifies a workspace service account for a scoped preview.
	// It should return ErrInvalidPreviewIdentity only for caller credential or
	// identity rejection; other errors are treated as transient dependencies.
	PreviewIdentity func(*http.Request, InstanceRef) (browsersession.Identity, error)
	// Sessions is the shared hub browser-session store (portal SSO).
	Sessions *browsersession.Store
	// PreviewSessions stores short-lived one-app browser sessions separately
	// from portal sessions. A separate backend is required for mixed-version
	// hubs because older replicas ignore unknown scoped identity fields.
	PreviewSessions *browsersession.Store
	// SARClient resolves per-workspace SubjectAccessReview clients.
	SARClient SARFactory
	// InstanceHost resolves the published host of the instance a sign-in is
	// for. Redirects are only issued to exactly that host.
	InstanceHost InstanceHostResolver
	// Codes persists the one-use authorization codes. It defaults to a
	// bounded process-local map, which is only correct for a single hub
	// replica: authorize and exchange are separate requests and a scaled hub
	// serves them from different pods. Supply a shared store (see
	// pkg/hub/sharedstore) whenever the hub runs more than one replica.
	Codes CodeStore
	// PreviewCodes stores scoped handoff and final app-authorization codes in
	// an isolated collection. Ordinary Codes must never be used as a fallback.
	PreviewCodes CodeStore
	// LoginPath is the hub-relative path of the interactive login page an
	// unauthenticated browser is sent to. Defaults to "/ui/login" (the
	// portal SPA is mounted under /ui/).
	LoginPath string
	// BearerIdentity authenticates the Authorization bearer on a request and
	// resolves it to the platform identity. It MUST be the same validator the
	// hub uses to mint browser sessions from a bearer (KCPProxy.BrowserIdentity),
	// so the token endpoint admits exactly the identities the browser flow
	// admits. Nil leaves the token endpoint unregistered.
	BearerIdentity func(*http.Request) (browsersession.Identity, error)
	// TokenKey returns the hub secret (>= 32 bytes, identical on every
	// replica) that app access tokens are HKDF-derived from. Nil leaves both
	// the token and verify endpoints unregistered.
	TokenKey func(context.Context) ([]byte, error)
	// IdentityUnavailable is the sentinel BearerIdentity wraps when the
	// credential was accepted but the identity could not be resolved (a
	// transient hub-side failure). Such errors answer 503 and are not counted
	// as failed verifications. Nil treats every BearerIdentity error as an
	// invalid credential.
	IdentityUnavailable error
	// ClientIP keys the failed-verification limiter. It should see through
	// the hub's trusted reverse proxies (proxy.ClientIP). Nil uses the
	// connection peer address.
	ClientIP func(*http.Request) string
	// Now and Random are test seams.
	Now    func() time.Time
	Random io.Reader
}

type ExchangeResponse struct {
	Allowed           bool   `json:"allowed"`
	UserID            string `json:"userId"`
	Email             string `json:"email,omitempty"`
	Name              string `json:"name,omitempty"`
	SessionTTLSeconds int64  `json:"sessionTtlSeconds"`
}

type Handler struct {
	// contains filtered or unexported fields
}

type InstanceHostResolver func(ctx context.Context, ref InstanceRef) (string, error)

type InstanceRef struct {
	Cluster  string // logical cluster ID of the tenant workspace
	Group    string // API group of the instance CRD
	Resource string // REST plural of the instance CRD
	Name     string // instance name
}

type MintRequest struct {
	Cluster    string `json:"cluster"`
	Group      string `json:"group"`
	Resource   string `json:"resource"`
	Name       string `json:"name"`
	TTLSeconds int64  `json:"ttlSeconds,omitempty"`
}

type MintResponse struct {
	Token     string    `json:"token"`
	ExpiresAt time.Time `json:"expiresAt"`
	Host      string    `json:"host"`
}

type SARFactory func(clusterID string) (authorizationv1client.SubjectAccessReviewInterface, error)

type VerifyResponse struct {
	Allowed           bool   `json:"allowed"`
	UserID            string `json:"userId"`
	SessionTTLSeconds int64  `json:"sessionTtlSeconds"`
}