auth

type APIKeyConfig struct {
	// Keys is a list of static secrets accepted via the Authorization: Bearer <token>
	// header or X-API-Key header.
	Keys []string `yaml:"keys,omitempty" toml:"keys,omitempty"`
}

type Authenticator interface {
	// Authenticate inspects the request. Returns a (possibly updated) request and a non-nil Sender on success.
	// On failure it must write the appropriate HTTP error to the ResponseWriter
	// and return (r, nil).
	Authenticate(w http.ResponseWriter, r *http.Request) (*http.Request, *identity.Sender)
}

type Config struct {
	Password         PasswordConfig `yaml:"password,omitempty" toml:"password,omitempty"`
	JWT              JWTConfig      `yaml:"jwt,omitempty" toml:"jwt,omitempty"`
	APIKeys          APIKeyConfig   `yaml:"api_keys,omitempty" toml:"api_keys,omitempty"`
	OIDC             OIDCConfig     `yaml:"oidc,omitempty" toml:"oidc,omitempty"`
	IdentityResolver ResolverConfig `yaml:"identity_resolver,omitempty" toml:"identity_resolver,omitempty"`
}

type EnterpriseUser struct {
	identity.Sender

	// Department is the organisational department (e.g. "engineering",
	// "hr", "finance"). Empty if unknown.
	Department string

	// Groups lists the group memberships for this user (e.g.
	// ["platform-team", "on-call", "sre"]). May be empty.
	Groups []string

	// Attributes holds arbitrary key-value metadata about the user.
	// Useful for customer-specific fields that don't warrant a
	// dedicated struct field (e.g. "cost_center", "manager_email").
	Attributes map[string]string
}

type IdentityResolver interface {
	// Resolve looks up the enterprise identity for the given sender.
	// Implementations MUST be safe for concurrent use.
	//
	// If the user cannot be found, implementations should return
	// the original sender unchanged (not an error), so that the
	// system degrades gracefully to unauthenticated behavior.
	Resolve(ctx context.Context, req ResolveRequest) (EnterpriseUser, error)
}

type JWTConfig struct {
	// TrustedIssuers is a list of OIDC issuer URLs whose JWTs are accepted.
	TrustedIssuers []string `yaml:"trusted_issuers,omitempty" toml:"trusted_issuers,omitempty"`

	// AllowedAudiences is an optional list of expected "aud" claim values.
	// When non-empty, JWT tokens must have an audience matching at least one entry.
	AllowedAudiences []string `yaml:"allowed_audiences,omitempty" toml:"allowed_audiences,omitempty"`
}

type NoopResolver struct{}

type OIDCConfig struct {
	// IssuerURL is the OIDC provider's discovery URL (e.g. "https://accounts.google.com",
	// "https://your-tenant.okta.com", "https://dev-xxx.auth0.com").
	IssuerURL string `yaml:"issuer_url,omitempty" toml:"issuer_url,omitempty"`

	// ClientID is the OAuth 2.0 Client ID.
	ClientID string `yaml:"client_id,omitempty" toml:"client_id,omitempty"`

	// ClientSecret is the OAuth 2.0 Client Secret.
	ClientSecret string `yaml:"client_secret,omitempty" toml:"client_secret,omitempty"`

	// AllowedDomains restricts login to users from these domains (if supported
	// by the provider via the "hd" parameter, like Google Workspace).
	// When empty, any account from the provider is allowed.
	AllowedDomains []string `yaml:"allowed_domains,omitempty" toml:"allowed_domains,omitempty"`

	// CookieSecret is a 32+ byte key used to HMAC-sign session cookies.
	// If empty, a random key is generated at startup.
	CookieSecret string `yaml:"cookie_secret,omitempty" toml:"cookie_secret,omitempty"`

	// RedirectURL is the full URL of /auth/callback registered in the provider.
	// If empty, it's auto-detected from the incoming request Host header.
	RedirectURL string `yaml:"redirect_url,omitempty" toml:"redirect_url,omitempty"`
}

type OIDCHandler struct {
	// contains filtered or unexported fields
}

type PasswordConfig struct {
	// Enabled turns on password protection. The password is resolved in order:
	//   1. Value field (below)
	//   2. AGUI_PASSWORD environment variable
	//   3. OS keyring (for local/desktop use)
	//   4. Auto-generated random password (logged at startup)
	Enabled bool `yaml:"enabled,omitempty" toml:"enabled,omitempty"`

	// Value is the plaintext shared secret. Prefer AGUI_PASSWORD env var
	// for cloud/container deployments where keyring is unavailable.
	Value string `yaml:"value,omitempty" toml:"value,omitempty"`
}

type ResolveRequest struct {
	// Sender is the raw identity from the messenger or auth layer.
	// At minimum, Sender.ID is populated.
	Sender identity.Sender

	// Platform is the originating platform (e.g. "slack", "agui",
	// "teams", "telegram"). Implementations may use this to choose
	// different resolution strategies per platform.
	Platform string

	// PlatformUserID is the original platform-specific user identifier
	// (e.g. Slack "U_ABC123", Google OAuth subject).
	//
	// If empty, resolvers should fall back to Sender.ID.
	PlatformUserID string
}

type ResolverConfig struct {
	// Resolvers is an ordered list of resolver strategies.
	// Valid types: "noop", "jwt_claims", "static"
	Resolvers []ResolverEntry `yaml:"resolvers,omitempty" toml:"resolvers,omitempty"`
}

type ResolverEntry struct {
	// Type identifies the resolver implementation.
	// Supported: "noop", "jwt_claims", "static"
	Type string `yaml:"type" toml:"type"`

	// Config holds type-specific configuration as key-value pairs.
	// For "jwt_claims":  role_claim, groups_claim, dept_claim
	// For "noop":        unused
	Config map[string]string `yaml:"config,omitempty" toml:"config,omitempty"`
}