appauth

type AppAccessGrant struct {
	Name        string `json:"name"`
	UID         string `json:"uid,omitempty"`
	User        string `json:"user"`
	Publication string `json:"publication"`
	Revoked     bool   `json:"revoked"`
	Phase       string `json:"phase"`
	// MigrationPending is a read-only hint that the hub migration controller
	// has not yet upgraded this grant's RBAC metadata.
	MigrationPending bool `json:"migrationPending,omitempty"`
}

type AppAccessGrantHandler struct {
	// contains filtered or unexported fields
}

type AppAccessGrantHandlerConfig struct {
	Clients          AppAccessWorkspaceClientFactory
	SARClient        SARFactory
	IdentityApp      IdentityAppResolver
	WorkspaceCluster IdentityWorkspaceCluster
	AccountLookup    IdentityAccountLookup
	Memberships      tenant.MembershipLookup
}

type AppAccessWorkspaceClientFactory func(clusterID string) (dynamic.Interface, error)

type CodeRecord struct {
	Purpose        string
	Ref            InstanceRef
	RedirectHost   string
	RedirectOrigin string
	AppID          string
	Environment    string
	InstanceUID    string
	CodeChallenge  string
	Identity       browsersession.Identity
	ExpiresAt      time.Time
}

type CodeStore interface {
	Put(ctx context.Context, code string, record CodeRecord) error
	// Peek reads a record without consuming it. Implementations return an error
	// when the backing store is unavailable, false when the code is absent or
	// expired, and the record otherwise.
	Peek(ctx context.Context, code string) (CodeRecord, bool, error)
	Take(ctx context.Context, code string) (CodeRecord, bool)
}

type Config struct {
	// PreviewIdentity verifies a workspace service account for a scoped preview.
	// It should return ErrInvalidPreviewIdentity only for caller credential or
	// identity rejection; other errors are treated as transient dependencies.
	PreviewIdentity func(*http.Request, InstanceRef) (browsersession.Identity, error)
	// Sessions is the shared hub browser-session store (portal SSO).
	Sessions *browsersession.Store
	// PreviewSessions stores short-lived one-app browser sessions separately
	// from portal sessions. A separate backend is required for mixed-version
	// hubs because older replicas ignore unknown scoped identity fields.
	PreviewSessions *browsersession.Store
	// SARClient resolves per-workspace SubjectAccessReview clients.
	SARClient SARFactory
	// InstanceHost resolves the published host of the instance a sign-in is
	// for. Redirects are only issued to exactly that host.
	InstanceHost InstanceHostResolver
	// IdentityApp resolves the generic Railgrid Auth descriptor for an
	// instance. Nil leaves the identity flow unregistered.
	IdentityApp IdentityAppResolver
	// IdentityAccountLookup revalidates the platform User record captured by
	// the browser session before issuing or exchanging a Railgrid Auth code.
	// It is required whenever the identity flow is configured.
	IdentityAccountLookup IdentityAccountLookup
	// IdentityWorkspaceMember is required for non-production app sign-ins;
	// production sign-ins are governed by the instance access SAR.
	IdentityWorkspaceMember IdentityWorkspaceMember
	// Codes persists the one-use authorization codes. It defaults to a
	// bounded process-local map, which is only correct for a single hub
	// replica: authorize and exchange are separate requests and a scaled hub
	// serves them from different pods. Supply a shared store (see
	// pkg/hub/sharedstore) whenever the hub runs more than one replica.
	Codes CodeStore
	// PreviewCodes stores scoped handoff and final app-authorization codes in
	// an isolated collection. Ordinary Codes must never be used as a fallback.
	PreviewCodes CodeStore
	// LoginPath is the hub-relative path of the interactive login page an
	// unauthenticated browser is sent to. Defaults to "/ui/login" (the
	// portal SPA is mounted under /ui/).
	LoginPath string
	// BearerIdentity authenticates the Authorization bearer on a request and
	// resolves it to the platform identity. It MUST be the same validator the
	// hub uses to mint browser sessions from a bearer (KCPProxy.BrowserIdentity),
	// so the token endpoint admits exactly the identities the browser flow
	// admits. Nil leaves the token endpoint unregistered.
	BearerIdentity func(*http.Request) (browsersession.Identity, error)
	// TokenKey returns the hub secret (>= 32 bytes, identical on every
	// replica) that app access tokens are HKDF-derived from. Nil leaves both
	// the token and verify endpoints unregistered.
	TokenKey func(context.Context) ([]byte, error)
	// IdentityUnavailable is the sentinel BearerIdentity wraps when the
	// credential was accepted but the identity could not be resolved (a
	// transient hub-side failure). Such errors answer 503 and are not counted
	// as failed verifications. Nil treats every BearerIdentity error as an
	// invalid credential.
	IdentityUnavailable error
	// IdentityIssuer is the absolute issuer URL for Railgrid Auth assertions.
	// NormalizeIdentityIssuer derives it from the public HTTPS hub origin.
	IdentityIssuer string
	// IdentityKeys returns a coherent signing, subject and public-key snapshot.
	// Production uses this instead of the individual callbacks below, so a
	// rotation cannot split a single response across two Secret versions.
	IdentityKeys func(context.Context) (IdentityKeySnapshot, error)
	// IdentitySigningKey returns the current Ed25519 private signing key.
	// The matching public key is exposed by IdentityJWKSPath.
	IdentitySigningKey func(context.Context) (ed25519.PrivateKey, error)
	// IdentityPublicKeys returns the current public key and any still-valid
	// previous public keys. Keeping previous keys available for one assertion
	// lifetime lets app sessions survive an explicit signing-key rotation.
	IdentityPublicKeys func(context.Context) ([]ed25519.PublicKey, error)
	// IdentitySubjectKey returns a purpose-separated secret used to derive
	// stable, opaque app subjects. Keep this key stable across signing-key
	// rotations.
	IdentitySubjectKey func(context.Context) ([]byte, error)
	// ClientIP keys the failed-verification limiter. It should see through
	// the hub's trusted reverse proxies (proxy.ClientIP). Nil uses the
	// connection peer address.
	ClientIP func(*http.Request) string
	// Now and Random are test seams.
	Now    func() time.Time
	Random io.Reader
}

type ExchangeResponse struct {
	Allowed           bool   `json:"allowed"`
	UserID            string `json:"userId"`
	Email             string `json:"email,omitempty"`
	Name              string `json:"name,omitempty"`
	SessionTTLSeconds int64  `json:"sessionTtlSeconds"`
}

type Handler struct {
	// contains filtered or unexported fields
}

type IdentityAccount struct {
	User         string
	Email        string
	RBACIdentity string
	Deleted      bool
}

type IdentityAccountLookup func(context.Context, string) (IdentityAccount, error)

type IdentityApp struct {
	InstanceUID     string
	AppID           string
	Environment     string
	PublishedOrigin string
	Enabled         bool
}

type IdentityAppResolver func(ctx context.Context, ref InstanceRef) (IdentityApp, error)

type IdentityExchangeResponse struct {
	Assertion string              `json:"assertion"`
	ExpiresIn int64               `json:"expiresIn"`
	User      IdentityUserProfile `json:"user"`
}

type IdentityKeySnapshot struct {
	SigningKey ed25519.PrivateKey
	SubjectKey []byte
	PublicKeys []ed25519.PublicKey
}

type IdentityUserLookupConfig struct {
	SARClient        SARFactory
	IdentityApp      IdentityAppResolver
	WorkspaceCluster IdentityWorkspaceCluster
	AccountLookup    IdentityAccountLookup
}

type IdentityUserLookupHandler struct {
	// contains filtered or unexported fields
}

type IdentityUserProfile struct {
	Name string `json:"name,omitempty"`
}

type IdentityWorkspaceCluster func(context.Context, string, string) (string, error)

type IdentityWorkspaceMember func(ctx context.Context, identity browsersession.Identity, ref InstanceRef) (bool, error)

type InstanceHostResolver func(ctx context.Context, ref InstanceRef) (string, error)

type InstanceRef struct {
	Cluster  string // logical cluster ID of the tenant workspace
	Group    string // API group of the instance CRD
	Resource string // REST plural of the instance CRD
	Name     string // instance name
}

type MintRequest struct {
	Cluster    string `json:"cluster"`
	Group      string `json:"group"`
	Resource   string `json:"resource"`
	Name       string `json:"name"`
	TTLSeconds int64  `json:"ttlSeconds,omitempty"`
}

type MintResponse struct {
	Token     string    `json:"token"`
	ExpiresAt time.Time `json:"expiresAt"`
	Host      string    `json:"host"`
}

type SARFactory func(clusterID string) (authorizationv1client.SubjectAccessReviewInterface, error)

type VerifyResponse struct {
	Allowed           bool   `json:"allowed"`
	UserID            string `json:"userId"`
	SessionTTLSeconds int64  `json:"sessionTtlSeconds"`
}