authmode

type AuthMode string

type AuthenticateRequestData struct {
	// URL of the original request.
	URL string `json:"url,omitempty"`
	// Request headers.
	Headers map[string]string `json:"headers"`
	// Raw request body.
	Request json.RawMessage `json:"request"`
}

type AuthenticatedOutput struct {
	ID               string
	Mode             AuthMode
	SessionVariables map[string]any
}

type Authenticator interface {
	// Authenticate validates and authenticates the token from the auth webhook request.
	Authenticate(ctx context.Context, body *AuthenticateRequestData) (AuthenticatedOutput, error)
}

type HasuraV2PostRequestBody struct {
	Variables     map[string]any `json:"variables"`
	OperationName string         `json:"operationName,omitempty"`
	Query         string         `json:"query"`
}

type RelyAuthAllowedIPs struct {
	Headers    []string
	AllowedIPs []*net.IPNet
}

type RelyAuthDefinitionInterface interface {
	goutils.IsZeroer

	// GetMode returns the auth mode of the current config.
	GetMode() AuthMode
	// Validate if the current instance is valid.
	Validate() error
}

type RelyAuthHeaderRules map[string][]*goutils.RegexpMatcher

type RelyAuthIPAllowListConfig struct {
	Headers  []string                 `json:"headers,omitempty" yaml:"headers,omitempty"`
	Patterns goenvconf.EnvStringSlice `json:"patterns" yaml:"patterns"`
}

type RelyAuthSecurityRules struct {
	// Configure the list of allowed IPs.
	AllowedIPs *RelyAuthAllowedIPs
	// Configure the list of extra header rules.
	HeaderRules RelyAuthHeaderRules
}

type RelyAuthSecurityRulesConfig struct {
	// Configure the list of allowed IPs.
	AllowedIPs *RelyAuthIPAllowListConfig `json:"allowedIPs,omitempty" yaml:"allowedIPs,omitempty"`
	// Configure the map of header rules.
	HeaderRules map[string]goenvconf.EnvStringSlice `json:"headerRules,omitempty" yaml:"headerRules,omitempty"`
}

type RelyAuthSettings struct {
	// The interval in seconds to reload JSON web keys from the remote URL.
	// If the value is zero or negative, disables the process.
	ReloadInterval int `json:"reloadInterval,omitempty" yaml:"reloadInterval,omitempty" jsonschema:"minimum=0,default=0"`
}

type RelyAuthentication struct {
	RelyAuthenticator

	SecurityRules *RelyAuthSecurityRules
}

type RelyAuthenticator interface {
	Authenticator

	// IDs returns identities of this authenticator.
	IDs() []string
	// GetMode returns the auth mode of the current authenticator.
	Mode() AuthMode
	// Close handles the resources cleaning.
	Close() error
}

type RelyAuthenticatorOption func(*RelyAuthenticatorOptions)

type RelyAuthenticatorOptions struct {
	CustomEnvGetter  func(ctx context.Context) goenvconf.GetEnvFunc
	Logger           *slog.Logger
	HTTPClient       *gohttpc.Client
	CustomAttributes []attribute.KeyValue
	// Prefix is used to create unique JWKS registration keys, allowing multiple authenticators
	// to register the same JWKS URL independently.
	Prefix string
}