provisioner

type AICJWTIdentity struct {
	Principal    aicjwt.Principal
	Issuer       string
	TokenID      string
	Capabilities []string // FullID ("scheme:id") forms, acceptable to MatchCapability
}

type AICJWTProvisioner struct{}

type AICOption struct {
	Config ca.AICConfig
}

type AuthResult struct {
	Username    string
	Role        string
	Permissions []string // grant patterns (e.g. "ca:*", "cert:issue")
	// CAScopes carries the effective CA scopes bound to the authentication.
	// For cert-first mTLS this is extracted from the client certificate
	// (SAN urn:pki:ca:* URIs + OID scope extension). Without it, enterprise
	// permission-mode checks have no scope to authorize against.
	CAScopes []string
	Options  []SignOption
	// CertIdentity records the client certificate identity snapshot bound to this authentication.
	// nil means no certificate (e.g. token/Basic login). Sourced from the same origin as mTLS
	// direct connection, ensuring Web sessions and certificate identity are not disconnected.
	CertIdentity *CertIdentity
	// AICJWT is set when the request authenticated via a validated AIC-JWT
	// bearer token (draft-ietf-oauth-aic). The RBAC layer intersects its
	// capabilities with route rules; nil means no AIC-JWT carrier.
	AICJWT *AICJWTIdentity
}

type CertIdentity struct {
	Serial       string    // Certificate serial number (%040X hex)
	Issuer       string    // Issuer DN
	CN           string    // Subject CN
	SpkiHash     string    // SHA-256(SubjectPublicKeyInfo) hex
	PrincipalUid string    // AIC PrincipalUid (empty for non-AIC certificates)
	AgentId      string    // AIC AgentId (empty for non-AIC certificates)
	NotAfter     time.Time // Certificate expiry time
}

type CompositeOption struct {
	Options []SignOption
}

type KeyTypeOption struct {
	KeyType string
}

type MTLSProvisioner struct{}

type OIDCConfig struct {
	IssuerURL    string `json:"issuer_url"`
	ClientID     string `json:"client_id"`
	JWKSEndpoint string `json:"jwks_endpoint,omitempty"` // defaults to IssuerURL + "/.well-known/jwks.json"
	ClaimMapping struct {
		Subject string `json:"subject,omitempty"` // JWT claim to use as username (default "email")
		Role    string `json:"role,omitempty"`    // JWT claim to use as role (default "sub")
	} `json:"claim_mapping,omitempty"`
	RoleOverride string `json:"role_override,omitempty"` // static role if set (e.g. "operator")
}

type OIDCProvisioner struct {
	// contains filtered or unexported fields
}

type PrincipalAuthOption struct {
	Config ca.PrincipalAuthorizationConfig
}

type ProfileOption struct {
	Profile ca.Profile
}

type Provisioner interface {
	Name() string
	Type() string
	Authenticate(r *http.Request) (*AuthResult, error)
}

type Registry struct {
	// contains filtered or unexported fields
}

type SANOption struct {
	DNSNames []string
	IPs      []string
	URIs     []string
	Emails   []string
}

type SignOption interface {
	Apply(sc *ca.SignConfig) error
}

type SignOptionFunc func(sc *ca.SignConfig) error

type TokenProvisioner struct{}

type ValidityOption struct {
	Validity int // in hours; 0 means use default
}