verify

type AWSAccount struct {
	// Account is the 12-digit AWS account id this row trusts.
	Account string
	// Name is the estate's word for the account, for the logs.
	Name string
	// Issuer is the account's `iss`:
	// `https://<id>.tokens.sts.global.api.aws`, from
	// `aws iam get-outbound-web-identity-federation-info`.
	Issuer string
	// JWKSURI is where the issuer publishes its keys. Empty means
	// `{Issuer}/.well-known/jwks.json`, which is where AWS puts them.
	JWKSURI string
	// OrgID, when set, is the AWS Organizations id the token's `org_id`
	// claim must carry.
	OrgID string
	// Algs are the signature algorithms accepted. Empty means both
	// [AWSAlgES384] and [AWSAlgRS256].
	Algs []string
	// Audience the role must have requested from STS. Required: without
	// one nothing is verified.
	Audience string
	// MaxAge rejects a token whose `iat` is older. Zero means
	// [DefaultAWSMaxAge].
	MaxAge time.Duration
	// Client fetches the keys. Nil means [http.DefaultClient].
	Client *http.Client
	// KeyRefresh is the shortest time between two fetches of the key set
	// caused by an unknown `kid`; without it a caller could make this
	// service hammer AWS with tokens naming keys that do not exist. Zero
	// means ten seconds.
	KeyRefresh time.Duration
	// Now is the clock. Nil means [time.Now].
	Now func() time.Time
	// contains filtered or unexported fields
}

type AWSAccountRow struct {
	// Account is the 12-digit AWS account id.
	Account string `yaml:"account"`
	// Name is the estate's own word for the account, for logs.
	Name string `yaml:"name"`
	// Issuer is the account's `iss`, from
	// `aws iam get-outbound-web-identity-federation-info`.
	Issuer string `yaml:"issuer"`
	// JWKSURI is where its keys are. Empty means
	// `{issuer}/.well-known/jwks.json`.
	JWKSURI string `yaml:"jwksUri,omitempty"`
	// OrgID, when set, must equal the token's `org_id` claim.
	OrgID string `yaml:"orgId,omitempty"`
	// Algs narrows the accepted algorithms. Default `[ES384, RS256]`.
	Algs []string `yaml:"algs,omitempty"`
}

type AWSFederation struct {
	// Audience the role must request from `sts:GetWebIdentityToken`.
	// Required whenever an account is listed; it is the trust boundary.
	Audience string `yaml:"audience"`
	// MaxAge rejects a token whose `iat` is older, whatever its `exp`
	// allows. Default 5m, at most 1h.
	MaxAge time.Duration `yaml:"maxAge,omitempty"`
	// Accounts are the trusted accounts. Empty is an installation with no
	// AWS proof, which is a real posture and not a failure.
	Accounts []AWSAccountRow `yaml:"accounts"`
}

type Cluster struct {
	// Name is what the cluster is called in a `workload` matcher and in
	// the subject of the token this exchange mints: the estate's own word
	// for it, the same one that scopes a group name.
	Name string
	// Issuer is the `iss` its ServiceAccount tokens carry — for EKS the
	// cluster's OIDC provider URL, for Talos whatever
	// `--service-account-issuer` says.
	Issuer string
	// JWKSURI is where its public keys are. Empty discovers it from the
	// issuer, which works wherever the cluster publishes a discovery
	// document at a reachable address.
	JWKSURI string
	// Audience the token must have been minted for: this issuer's
	// exchange audience. Without one nothing is verified, because every
	// ServiceAccount token in that cluster would be a proof.
	Audience string
	// Client fetches the keys. Nil means [http.DefaultClient].
	Client *http.Client
	// contains filtered or unexported fields
}

type FederatedCluster struct {
	// Name is the estate's own word for the cluster — `dev`, `prod`
	// — the same one that scopes a group name. It becomes the cluster in
	// a `workload` matcher and in the subject of the minted token, so a
	// row renamed is every rule about it changed.
	Name string `yaml:"name"`
	// Issuer is the `iss` its ServiceAccount tokens carry: for EKS the
	// cluster's OIDC provider URL, for Talos whatever
	// `--service-account-issuer` says.
	Issuer string `yaml:"issuer"`
	// JWKSURI is where its public keys are. Empty discovers it from the
	// issuer, which works wherever the cluster publishes a discovery
	// document at an address this service can reach.
	JWKSURI string `yaml:"jwksUri,omitempty"`
}

type Federation struct {
	Clusters []FederatedCluster `yaml:"clusters"`
}

type GitHub struct {
	// Owners are the GitHub organisations (and users) whose repositories
	// this installation will act on, lowercased on comparison.
	Owners []string
	// OwnerIDs are the numeric ids of those organisations, as GitHub puts them
	// in `repository_owner_id`. A login can be renamed, and a deleted
	// organisation's login can be taken by someone else; the id cannot.
	// When set, the token's `repository_owner_id` must be one of them, in
	// addition to its `repository_owner` being in Owners. Unset asks
	// nothing of it, which is every installation before this existed.
	OwnerIDs []string
	// RepositoryIDs are the numeric ids of the repositories a token may come
	// from, as GitHub puts them in `repository_id`. When set, the token's
	// `repository_id` must be one of them, whatever its owner. Unset asks
	// nothing of it.
	RepositoryIDs []string
	// Audience the workflow must have requested: this issuer's URL.
	Audience string
	// Client fetches the keys. Nil means [http.DefaultClient].
	Client *http.Client
	// contains filtered or unexported fields
}