identity

type Issuer interface {
	// Match checks if this issuer can authenticate tokens from a given issuer URL
	Match(ctx context.Context, url string) bool

	// Authenticate ID token and return Principal on success. The ID token's signature
	// is verified in the call -- invalid signature must result in an error.
	Authenticate(ctx context.Context, token string, opts ...config.InsecureOIDCConfigOption) (Principal, error)
}

type IssuerPool []Issuer

type Principal interface {
	// Name is the email or subject of OIDC ID token. This value must match the
	// value signed in the proof of private key possession challenge.
	Name(ctx context.Context) string

	// Embed all SubjectAltName and custom x509 extension information into
	// certificate.
	Embed(ctx context.Context, cert *x509.Certificate) error
}