remoteauth

type Discovery struct {
	Issuer                string `json:"issuer"`
	AuthorizationEndpoint string `json:"authorization_endpoint"`
	TokenEndpoint         string `json:"token_endpoint"`
	JWKSURI               string `json:"jwks_uri"`
}

type DispatchVerifier struct {
	Invite *StoreVerifier
	OIDC   *OIDCVerifier
}

type Identity struct {
	Principal string
	Role      string
	JTI       string
}

type Issuer struct {
	DB  *store.DB
	Key []byte
}

type OIDCConfig struct {
	Issuer         string
	Audience       string
	JWKSURL        string
	PrincipalClaim string
	AllowClaim     string
	AllowValue     string
	RoleClaim      string
	OrgValue       string
	Provision      string
}

type OIDCLoginRequest struct {
	Issuer         string
	ClientID       string
	Server         string
	Name           string
	DataDir        string
	PrincipalClaim string
	CAFile         string
	ServerName     string
	MakeDefault    bool
	// Scopes are requested in addition to openid and profile. Blank entries and
	// duplicates are dropped. offline_access is not included unless listed here.
	Scopes []string
	// OpenBrowser is called with the authorization URL. Nil prints the URL and
	// tries the OS opener. Tests can complete the redirect themselves.
	OpenBrowser func(url string) error
	Timeout     time.Duration
	HTTP        *http.Client
}

type OIDCVerifier struct {
	DB     *store.DB
	Config OIDCConfig
	HTTP   *http.Client
	// contains filtered or unexported fields
}

type StoreVerifier struct {
	DB  *store.DB
	Key []byte
}

type User struct {
	Principal string   `json:"principal"`
	TokenHash string   `json:"token_hash"`
	Scopes    []string `json:"scopes,omitempty"`
}

type UsersFile struct {
	SchemaVersion int    `json:"schema_version"`
	Users         []User `json:"users"`
}

type Verifier interface {
	Verify(token string) (Identity, error)
}