authmode

type AuthMode string

type AuthenticateRequestData struct {
	// URL of the original request.
	URL string `json:"url,omitempty"`
	// Request headers.
	Headers map[string]string `json:"headers"`
	// Raw request body.
	Request json.RawMessage `json:"request"`
	// Remote address.
	RemoteAddr string `json:"-"`
}

type AuthenticatedOutput struct {
	ID               string
	Mode             AuthMode
	SessionVariables map[string]any
}

type Authenticator interface {
	// Authenticate validates and authenticates the token from the auth webhook request.
	Authenticate(ctx context.Context, body *AuthenticateRequestData) (AuthenticatedOutput, error)
}

type ClientIPLocation uint8

type HasuraV2PostRequestBody struct {
	Variables     map[string]any `json:"variables"`
	OperationName string         `json:"operationName,omitempty"`
	Query         string         `json:"query"`
}

type RelyAuthAllowListConfig struct {
	// List of allowed patterns.
	Include *goenvconf.EnvStringSlice `json:"include,omitempty" yaml:"include,omitempty"`
	// List of disallowed patterns.
	Exclude *goenvconf.EnvStringSlice `json:"exclude,omitempty" yaml:"exclude,omitempty"`
}

type RelyAuthAllowListMatcherRule struct {
	// List of regular expressions that are allowed to access.
	Include []*goutils.RegexpMatcher
	// List of regular expressions that are denied to access.
	Exclude []*goutils.RegexpMatcher
}

type RelyAuthHeaderRules map[string]RelyAuthAllowListMatcherRule

type RelyAuthIPAllowList struct {
	goutils.ValidateIPOptions

	Headers                []string
	Location               ClientIPLocation
	TrustedProxyIPPrefixes []*net.IPNet
	NumTrustedProxies      int32
}

type RelyAuthIPAllowListConfig struct {
	RelyAuthAllowListConfig `yaml:",inline"`

	// The location of the IP to select. Default is the X-Forwarded-For header.
	Location ClientIPLocation `json:"location,omitempty" yaml:"location,omitempty"`
	// Allow public IPs only.
	PublicOnly bool `json:"publicOnly,omitempty" yaml:"publicOnly,omitempty"`
	// The exact number of trusted reverse proxies between this server and the public internet. Required if location=x_forwarded_for.
	NumTrustedProxies int32 `json:"numTrustedProxies,omitempty" yaml:"numTrustedProxies,omitempty"`
	// Proxy IPs must be in these trusted proxy prefixes. Ignore if empty. This configuration is available if location=x_forwarded_for.
	TrustedProxyIPPrefixes []string `json:"trustedProxyIpPrefixes,omitempty" yaml:"trustedProxyIpPrefixes,omitempty"`
	// The client IP could be in this header list. Required if location=header.
	Headers []string `json:"headers,omitempty" yaml:"headers,omitempty"`
}

type RelyAuthModeInterface interface {
	goutils.IsZeroer

	// GetMode returns the auth mode of the current config.
	GetMode() AuthMode
	// Validate if the current instance is valid.
	Validate() error
}

type RelyAuthSecurityRules struct {
	// Configure the list of allowed IPs.
	AllowedIPs *RelyAuthIPAllowList
	// Configure the list of extra header rules.
	HeaderRules RelyAuthHeaderRules
}

type RelyAuthSecurityRulesConfig struct {
	// Configure the list of allowed IPs.
	AllowedIPs *RelyAuthIPAllowListConfig `json:"allowedIPs,omitempty" yaml:"allowedIPs,omitempty"`
	// Configure the map of header rules.
	HeaderRules map[string]RelyAuthAllowListConfig `json:"headerRules,omitempty" yaml:"headerRules,omitempty"`
}

type RelyAuthSettings struct {
	// The interval in seconds to reload JSON web keys from the remote URL.
	// If the value is zero or negative, disables the process.
	ReloadInterval int `json:"reloadInterval,omitempty" yaml:"reloadInterval,omitempty" jsonschema:"minimum=0,default=0"`
}

type RelyAuthentication struct {
	RelyAuthenticator

	SecurityRules *RelyAuthSecurityRules
}

type RelyAuthenticator interface {
	Authenticator

	// IDs returns identities of this authenticator.
	IDs() []string
	// GetMode returns the auth mode of the current authenticator.
	Mode() AuthMode
	// Close handles the resources cleaning.
	Close() error
}

type RelyAuthenticatorOption func(*RelyAuthenticatorOptions)

type RelyAuthenticatorOptions struct {
	GetEnv           goenvconf.GetEnvFunc
	Logger           *slog.Logger
	HTTPClient       *gohttpc.Client
	CustomAttributes []attribute.KeyValue
	// Prefix is used to create unique JWKS registration keys, allowing multiple authenticators
	// to register the same JWKS URL independently.
	Prefix string
}