clientauth

type Connection struct {
	Identity Identity `json:"identity"`
	// ResourceURL is the optional canonical HTTPS protected-resource identity.
	// It deliberately remains outside Identity so existing credential record keys
	// stay stable across this additive registry metadata change.
	ResourceURL         string              `json:"resource_url,omitempty"`
	IssuerCAFile        string              `json:"issuer_ca_file,omitempty"`
	IssuerAddressPolicy IssuerAddressPolicy `json:"issuer_address_policy,omitempty"`
}

type CredentialBackend string

type CredentialRecord struct {
	Token   Token
	Version credentialstore.Version
}

type CredentialStoreMode string

type CredentialStoreSelection struct {
	Backend     CredentialBackend
	NewlyPinned bool
}

type Credentials struct {
	// contains filtered or unexported fields
}

type EnrollmentConfig struct {
	Registry    *Registry
	Credentials *Credentials
	// ExpectedTarget, when non-nil, is the target's connection snapshot taken
	// BEFORE an interactive step (e.g. a browser OAuth exchange) that can run
	// arbitrarily long. Enroll then requires the target's state at commit
	// time to match this snapshot exactly, returning ErrTargetChanged
	// otherwise -- closing the gap between a reauthentication preflight and
	// its eventual write-back, across which another process could log the
	// target out. A nil ExpectedTarget (the default, used by a fresh
	// enrollment) enrolls unconditionally.
	ExpectedTarget *[]Connection
	// ExpectedCredential, when non-nil, is the SAME identity's own credential
	// snapshot taken at the same preflight time. ExpectedTarget alone cannot
	// detect a newer credential enrolled for the identical identity (the
	// registry's connection metadata is unchanged; only the credential
	// store's version moved), so this closes that half of the same race:
	// Enroll rejects with ErrTargetChanged rather than overwrite a credential
	// newer than the one the caller preflighted against. A credential that
	// was corrupt at preflight time (ExpectedCredentialState.Corrupt) still
	// constrains the repair path -- see checkExpectedCredential -- rather
	// than leaving it entirely unconstrained.
	ExpectedCredential *ExpectedCredentialState
}

type ExistingKeyProvider interface {
	ExistingStoreKey(context.Context) ([]byte, error)
}

type ExpectedCredentialState struct {
	Found bool
	// Corrupt records that the preflight read hit ErrCorrupt for this
	// identity. Version is meaningless when Corrupt is true -- see
	// checkExpectedCredential.
	Corrupt bool
	Version credentialstore.Version
}

type Identity struct {
	Target, Issuer, ClientID, Audience, RedirectURI string
	Scopes                                          []string
}

type IncompleteLogoutError struct{}

type IssuerAddressPolicy string

type KeyProvider interface {
	StoreKey(context.Context) ([]byte, error)
}

type KeyringProvider struct {
	// contains filtered or unexported fields
}

type LoginConfig struct {
	Identity   Identity
	Presenter  Presenter
	HTTPClient *http.Client
	// IssuerAddressPolicy selects the managed issuer transport. It is REQUIRED
	// unless the caller supplies its own HTTPClient (tests and fixtures); the two
	// are mutually exclusive, and there is no unmanaged default. See oidcClient.
	IssuerAddressPolicy IssuerAddressPolicy
	TrustedCAPEM        []byte
	// Registry supplies target-scoped transaction locking to RefreshSource. Login
	// itself does not use it, so browser interaction remains outside the lock.
	Registry *Registry
}

type LoginRequiredCause string

type LoginRequiredError struct{ Cause LoginRequiredCause }

type LogoutConfig struct {
	Registry    *Registry
	Credentials *Credentials
	HTTPClient  func(context.Context, []Connection) (*http.Client, error)
	// HTTPClientForConnection builds an isolated managed client for one retained
	// connection. It prevents roots or address policy from crossing authorities.
	HTTPClientForConnection func(context.Context, Connection) (*http.Client, bool, error)
}

type LogoutIssue struct {
	Identity Identity
	Stage    string
}

type LogoutResult struct {
	Target               string
	Entries              int
	CredentialsDeleted   int
	CredentialsMissing   int
	RegistryDeleted      bool
	RevocationsAttempted int
	RevocationsFailed    int
	// RevocationError is the first cause of a revocation failure (a DNS,
	// discovery, or HTTP error), secret-free. Empty unless RevocationsFailed > 0.
	RevocationError string
	Issues          []LogoutIssue
}

type Presenter interface {
	Present(context.Context, string) (oauthlogin.Result, error)
}

type PresenterFunc func(context.Context, string) (oauthlogin.Result, error)

type RefreshSource struct {
	// contains filtered or unexported fields
}

type Registry struct {
	// contains filtered or unexported fields
}

type Token struct {
	AccessToken, RefreshToken, TokenType string
	Expiry                               string
}