identity

type APIError struct {
	Method  string
	Path    string
	Status  int
	Code    int
	ID      string
	Message string
	Body    string
}

type Action string

type AppKind string

type AppOutput struct {
	AppID          string   `json:"app_id"`
	ClientID       string   `json:"client_id"`
	RedirectURIs   []string `json:"redirect_uris,omitempty"`
	PostLogoutURIs []string `json:"post_logout_uris,omitempty"`
	LoginURI       string   `json:"login_uri,omitempty"`
	// ClientSecret is set for a web app whose secret is in the KeyStore.
	ClientSecret string `json:"-"`
	// BrokerUser / BrokerToken / BrokerTokenExpires describe an
	// AppNativeBroker's account and its CURRENT token. The token is the
	// idp_broker_token the product's server runs with.
	BrokerUser         string    `json:"broker_user,omitempty"`
	BrokerToken        string    `json:"-"`
	BrokerTokenID      string    `json:"broker_token_id,omitempty"`
	BrokerTokenExpires time.Time `json:"broker_token_expires,omitempty"`
}

type Application struct {
	// Name is the application's natural key.
	Name string
	Kind AppKind

	// RedirectURIs and PostLogoutURIs are compared LITERALLY by the issuer, so
	// a changed host silently breaks the callback until this converges. With
	// DevMode they are globs.
	RedirectURIs   []string
	PostLogoutURIs []string

	// LoginURI is the app's own sign-in route. When set the issuer redirects
	// /oauth/v2/authorize INTO the app (login V2) instead of rendering its own
	// pages. It is set per application, so two apps sharing an instance each
	// point at their own route. Empty restores the issuer-hosted login.
	LoginURI string

	// DevMode permits plain-http redirect URIs and turns them into globs. Only
	// for a loopback dev IdP.
	DevMode bool

	// IDTokenRoleAssertion / IDTokenUserinfoAssertion put the project roles
	// and the profile claims into the ID token. The access token always
	// carries the roles claim.
	IDTokenRoleAssertion     bool
	IDTokenUserinfoAssertion bool

	// AdoptClientID pins the client id the application must have; see the
	// package comment.
	AdoptClientID string

	// RegenerateSecret mints a new client secret for an AppWeb whose secret is
	// not in the KeyStore. It invalidates the previous secret, so it is never
	// done implicitly for an application that already existed.
	RegenerateSecret bool

	// Broker configures the broker account of an AppNativeBroker.
	Broker *BrokerAccount
}

type BrokerAccount struct {
	// Username defaults to "broker-" plus a slug of the application name.
	Username string
}

type Change struct {
	Action Action
	Kind   string
	Name   string
	Detail string
}

type Credential interface {
	// contains filtered or unexported methods
}

type CredentialFunc func(ctx context.Context) (string, error)

type DirKeyStore struct{ Dir string }

type FileOutputs struct{ Path string }

type KeyStore interface {
	// Load returns the stored value, or (nil, nil) when none is stored.
	Load(ctx context.Context, name string) ([]byte, error)
	// Save durably replaces the value. An error means the value was NOT
	// stored; the library then discards what it had just issued and keeps the
	// previous credential.
	Save(ctx context.Context, name string, value []byte) error
}

type Lockout struct {
	MaxPasswordAttempts int
	MaxOTPAttempts      int
}

type LoginPolicy struct {
	AllowUsernamePassword bool
	AllowRegister         bool
	AllowExternalIDP      bool
	ForceMFA              bool
	HidePasswordReset     bool
	AllowDomainDiscovery  bool
	// PasswordlessType is "PASSWORDLESS_TYPE_ALLOWED" or
	// "PASSWORDLESS_TYPE_NOT_ALLOWED"; empty means not allowed.
	PasswordlessType string
	// MFAInitSkipLifetime is how long a user may skip enrolling a second
	// factor; zero never prompts.
	MFAInitSkipLifetime time.Duration
}

type MachineKeyDoc struct {
	Type   string `json:"type"`
	KeyID  string `json:"keyId"`
	Key    string `json:"key"`
	UserID string `json:"userId"`
}

type MachineOutput struct {
	UserID       string    `json:"user_id"`
	KeyID        string    `json:"key_id,omitempty"`
	KeyExpires   time.Time `json:"key_expires,omitempty"`
	TokenID      string    `json:"token_id,omitempty"`
	TokenExpires time.Time `json:"token_expires,omitempty"`
	// Token is the machine user's current personal access token, if it has one.
	Token string `json:"-"`
}

type MachineUser struct {
	// Username is the natural key and a DNS-label-shaped name: it is part of a
	// secret name downstream.
	Username    string
	Name        string
	Description string
	// Roles are the project roles the account holds.
	Roles []string
	// InstanceRoles are instance-level memberships (for example
	// IAM_LOGIN_CLIENT). They are only ever added, never removed.
	InstanceRoles []string
	// Key issues a JSON machine key into the KeyStore and keeps it rotated.
	Key bool
	// Token issues an expiring personal access token into the KeyStore.
	Token bool
}

type MemKeyStore struct {

	// SaveErr, when set, makes every Save fail; tests use it to prove a failed
	// delivery leaves the previous credential intact.
	SaveErr error
	// contains filtered or unexported fields
}

type ObjectError struct {
	Kind string
	Name string
	Err  error
}

type Options struct {
	// BaseURL is the address this process DIALS. Required.
	BaseURL string
	// Host overrides the HTTP Host header. Zitadel resolves which instance a
	// request belongs to from the Host, so when the address you dial (a
	// Service DNS name, a compose service) differs from the domain the
	// instance is registered under, set Host to the latter.
	Host string
	// Issuer pins the issuer string the published outputs carry and the JWT
	// audience for machine-key exchange. Empty reads it from the instance's
	// discovery document, which is right unless discovery is not served at the
	// dialled address.
	Issuer string
	// Credential authenticates the library; it must hold IAM_OWNER. Required.
	Credential Credential
	// OrgID scopes the content to one organization. Empty resolves it: OrgName
	// if set, else the credential's own organization.
	OrgID   string
	OrgName string

	// Keys remembers generated credentials. Required when the Spec generates
	// any (machine keys, tokens, web client secrets, an SMTP password).
	Keys KeyStore
	// Outputs receives the Output at the end of every successful pass.
	Outputs Outputs

	Rotation Rotation

	// Adopt converges an instance that already holds content: the project and
	// every application must already exist and are never created. Objects are
	// matched by natural key (or by a pinned id) and kept whatever their
	// internal ids.
	Adopt bool
	// DryRun computes the Report without writing anything.
	DryRun bool
	// AllowSeedUsers permits Spec.SeedUsers. Local and ephemeral instances only.
	AllowSeedUsers bool
	// SignInCodes mints a one-time password-reset code, returned in the Report,
	// for every declared member who has no credential. Use it where nothing can
	// deliver mail.
	SignInCodes bool
	// HeldSignInCode, when set, reports whether the caller still holds an
	// unexpired code it delivered for a member. Such a member is not minted
	// another: minting invalidates the code they hold, so a converge loop that
	// minted on every pass would change the code under someone about to use it,
	// and no pass would ever be quiet. Nil: every credential-less member gets a
	// fresh code on every pass. Consulted only with SignInCodes.
	HeldSignInCode func(email string) bool
	// KeepSuperseded disables deleting credentials that a newer one has
	// replaced, once the overlap has passed. They are then only reported.
	KeepSuperseded bool

	// ReadyTimeout bounds the wait for the instance to answer its readiness
	// probe (default 2m). RequestTimeout bounds one API call (default 15s) and
	// MaxAttempts the tries one call gets (default 4).
	ReadyTimeout   time.Duration
	RequestTimeout time.Duration
	MaxAttempts    int

	HTTPClient *http.Client
	Logger     *slog.Logger
	// Now is the clock credential lifetimes are judged against.
	Now func() time.Time
}

type Output struct {
	// Issuer is the `iss` the instance mints; the validator's jwt_issuer.
	Issuer string `json:"issuer"`
	// OrgID is the organization the content lives in.
	OrgID string `json:"org_id"`
	// ProjectID is the project id, which is also the token audience.
	ProjectID string `json:"project_id"`
	// Audience is the value a validator must enforce as `aud` (ProjectID).
	Audience string `json:"audience"`
	// RolesClaim is the namespaced claim the project's roles are asserted
	// under: a map of role key to org id to org domain, not a flat list.
	RolesClaim string `json:"roles_claim"`
	// Scopes are what a client must request for an access token that carries
	// the audience and the roles claim.
	Scopes []string `json:"scopes"`
	// JWKS is a snapshot of the instance's public signing keys, for a validator
	// that must start while the issuer is unreachable.
	JWKS json.RawMessage `json:"jwks,omitempty"`
	// Apps are the registered applications by name.
	Apps map[string]AppOutput `json:"apps,omitempty"`
	// Machine are the machine users by username.
	Machine map[string]MachineOutput `json:"machine,omitempty"`
}

type Outputs interface {
	Publish(ctx context.Context, out Output) error
}

type OutputsFunc func(ctx context.Context, out Output) error

type PasswordComplexity struct {
	MinLength        int
	RequireUppercase bool
	RequireLowercase bool
	RequireNumber    bool
	RequireSymbol    bool
}

type Policies struct {
	Login              *LoginPolicy
	PasswordComplexity *PasswordComplexity
	Lockout            *Lockout
}

type ProjectSpec struct {
	// Name is the project's natural key.
	Name string
	// AdoptID pins the id the project must have. See the package comment.
	AdoptID string
	// MustHoldRole makes Zitadel refuse tokens for users who hold no role in the
	// project; ProjectCheck refuses tokens for users whose org was not granted
	// the project. Both default to off.
	MustHoldRole bool
	ProjectCheck bool
}

type Reconciler struct {
	// contains filtered or unexported fields
}

type Report struct {
	// Changes lists every write. A converged instance yields none.
	Changes []Change
	// Warnings are things left alone on purpose: a role nobody declared, a
	// credential that cannot be recovered.
	Warnings    []string
	Retiring    []Retiring
	SignInCodes []SignInCode
	// Credentialed lists the declared members this pass CONFIRMED hold a
	// credential (filled only with Options.SignInCodes): any code a caller
	// holds for them is spent or moot. A member whose check failed is in
	// neither this list nor SignInCodes.
	Credentialed []string
	// Output is the published view, filled even when Options.Outputs is nil.
	Output Output
	DryRun bool
}

type Retiring struct {
	Username    string
	Kind        string // "machine key" or "token"
	ID          string
	DeleteAfter time.Time
}

type Role struct {
	Key         string
	DisplayName string
	Group       string
	// Declared makes the holders of this role a SET converged from the spec:
	// the humans in Members plus the machine users that list the role. A holder
	// not in that set loses THIS role (other roles in the same grant are kept).
	// Leave it false for a role whose members are managed in a console.
	Declared bool
	// Members are the emails that hold the role when Declared is set.
	Members []string
}

type RotateTarget struct {
	// Application rotates the broker token of this native_broker application.
	Application string
	// MachineUser rotates this machine user's key (and token, if it has one).
	MachineUser string
}

type Rotation struct {
	// BrokerTokenTTL is the lifetime of a minted broker token (default 30d); a
	// new one is minted once less than BrokerRenewWithin (default 10d) is left.
	BrokerTokenTTL    time.Duration
	BrokerRenewWithin time.Duration
	// BrokerOverlap is how long a superseded token keeps working (default 10d).
	BrokerOverlap time.Duration
	// MachineKeyTTL (default 90d), MachineKeyRenewWithin (default 30d) and
	// MachineKeyOverlap (default 7d) are the same three for machine keys.
	MachineKeyTTL         time.Duration
	MachineKeyRenewWithin time.Duration
	MachineKeyOverlap     time.Duration
}

type SMTP struct {
	// Host is host:port.
	Host          string
	User          string
	Password      string `json:"-"`
	SenderAddress string
	SenderName    string
	ReplyTo       string
	TLS           bool
}

type SeedUser struct {
	Email      string
	Password   string `json:"-"`
	GivenName  string
	FamilyName string
	Roles      []string
}

type SignInCode struct {
	Email string
	Code  string
	// ExpiresAt is Options.Now at minting plus SignInCodeLifetime.
	ExpiresAt time.Time
}

type Spec struct {
	Project      ProjectSpec
	Roles        []Role
	Applications []Application
	MachineUsers []MachineUser
	Policies     Policies
	// SMTP is the instance mail relay. Nil leaves the instance's mail
	// configuration alone.
	SMTP *SMTP
	// SeedUsers are throwaway accounts for local and ephemeral environments.
	// Reconcile refuses them unless Options.AllowSeedUsers is set.
	SeedUsers []SeedUser
}