identity

type Cluster struct {
	// Review asks the API server whether a token is genuine and for
	// which audiences, and returns the authenticated username.
	Review func(ctx context.Context, token string, audiences []string) (string, error)
	// Audience the token must have been minted for. Without one, every
	// mounted ServiceAccount token in the cluster is a valid caller.
	Audience string
	// Name of this cluster, put into the subject so that the same
	// namespace and name on two clusters are two callers.
	Name string
	// Groups the workload is treated as holding. A TokenReview says WHO,
	// never what they may do: the policy is not reachable from here, so
	// a listener states what a proven workload is entitled to.
	Groups []string
}

type Issuer struct {
	// URL is the issuer, exactly as it appears in a token's `iss`.
	URL string
	// Audience the token must carry: this service's own client id.
	//
	// Empty accepts any audience, which is almost always wrong: a token
	// minted for another service is a perfectly valid token, and taking
	// it here makes every audience that issuer serves a way in.
	Audience string
	// Client fetches discovery and the keys. Nil uses one with a
	// ten-second timeout.
	Client *http.Client
	// contains filtered or unexported fields
}

type Verified struct {
	// Subject is the token's `sub`: an address for a person, and
	// `<cluster>:k8s:<namespace>:<name>` for a workload.
	Subject string
	// Email is the person's address, empty for a workload.
	Email string
	// Name is what the directory calls the person, for display. Empty for
	// a workload, a recovery sign-in, or a person the directory gives no
	// name -- show the address then. Never authorize on it.
	Name string
	// GivenName and FamilyName are its halves, for a UI that wants them.
	GivenName  string
	FamilyName string
	// ClientID is the client the token was minted for: the `azp` claim,
	// or `client_id` where that is absent. For a record of which software
	// called, never a thing to authorize on.
	ClientID string
	// Groups are the internal groups the policy put the caller in,
	// verbatim from the token. Never re-mapped.
	Groups []string
	// ServiceAccount is set when the caller is a workload rather than a
	// person, parsed from the subject.
	ServiceAccount *policy.ServiceAccountRef
}

type Verifier interface {
	Verify(ctx context.Context, token string) (Verified, error)
}