inauth

type AccessKey struct {

	// Unique identifier for this access key.
	// Generated as a semi-sequential hex string (e.g., "67f3a1b2c3d4e5f6").
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" toml:"id,omitempty"`
	// The secret key used to sign AccessToken payloads.
	// Generated as a 48-character base62 string. Must be kept confidential.
	Secret string `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty" toml:"secret,omitempty"`
	// The user or service principal this key belongs to.
	User string `protobuf:"bytes,3,opt,name=user,proto3" json:"user,omitempty" toml:"user,omitempty"`
	// The type of credential. Accepted values:
	//   - "User": human user access key (created via NewUserAccessKey).
	//   - "App":  machine/service access key (created via NewAppAccessKey).
	//
	// The type affects token validation; for example, "App" tokens enforce
	// a strict 60-second issued-at (iat) window to prevent replay attacks.
	Type string `protobuf:"bytes,4,opt,name=type,proto3" json:"type,omitempty" toml:"type,omitempty"`
	// The lifecycle state of this access key (e.g., "active", "disabled").
	State string `protobuf:"bytes,5,opt,name=state,proto3" json:"state,omitempty" toml:"state,omitempty"`
	// The names of RBAC roles assigned to this key. Role definitions are
	// registered separately via AccessKeyManager.SetRole() and map to a
	// set of permissions.
	Roles []string `protobuf:"bytes,6,rep,name=roles,proto3" json:"roles,omitempty" toml:"roles,omitempty"`
	// Fine-grained permission scopes granted to this key. Scopes are checked
	// via the Allow() method, which requires ALL specified scopes to be present.
	// Example scopes might include resource-level or action-level identifiers.
	Scopes []string `protobuf:"bytes,11,rep,name=scopes,proto3" json:"scopes,omitempty" toml:"scopes,omitempty"`
	// Optional. A human-readable description of this access key's purpose.
	Description string `protobuf:"bytes,13,opt,name=description,proto3" json:"description,omitempty" toml:"description,omitempty"`
	// contains filtered or unexported fields
}

type AccessKeyManager struct {
	// contains filtered or unexported fields
}

type AccessToken struct {
	Header TokenHeader

	Claims AuthClaims
	// contains filtered or unexported fields
}

type AppCredential interface {
	AuthToken() string
}

type AppValidator interface {
	Verify(keyMgr *AccessKeyManager) error
	AccessKey() *AccessKey
	Allow(scopes ...string) bool
}

type AuthClaims struct {
	Jti string `json:"jti,omitempty" toml:"jti,omitempty"` // JWT ID
	Iat int64  `json:"iat" toml:"iat"`                     // Issued At Time
	Exp int64  `json:"exp" toml:"exp"`
	Sub string `json:"sub,omitempty" toml:"sub,omitempty"`

	State string `json:"state,omitempty" toml:"state,omitempty"`
}

type Role struct {

	// The unique name identifier of the role (e.g., "admin", "viewer").
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty" toml:"name,omitempty"`
	// Optional. A human-readable title for the role. Typically this
	// is limited to 100 UTF-8 bytes.
	Title string `protobuf:"bytes,2,opt,name=title,proto3" json:"title,omitempty" toml:"title,omitempty"`
	// Optional. A human-readable description for the role.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty" toml:"description,omitempty"`
	// The names of the permissions this role grants when bound to an
	// AccessKey. Permissions are stored as a set within AccessKeyManager
	// for efficient lookup.
	Permissions []string `protobuf:"bytes,7,rep,name=permissions,proto3" json:"permissions,omitempty" toml:"permissions,omitempty"`
	// The lifecycle state of the role (e.g., "active", "disabled").
	State string `protobuf:"bytes,10,opt,name=state,proto3" json:"state,omitempty" toml:"state,omitempty"`
	// contains filtered or unexported fields
}

type Signer interface {
	Name() string
	Sign(signingString string, key any) ([]byte, error)
}

type SignerManager struct {
	// contains filtered or unexported fields
}

type TokenHeader struct {
	Alg string `json:"alg" toml:"alg"`
	Typ string `json:"typ,omitempty" toml:"typ,omitempty"`
	Kid string `json:"kid,omitempty" toml:"kid,omitempty"`
}