sharedsignals

type Config struct {
	// Audience is the aud value inbound SETs must carry. Streams inherit it
	// at creation when they do not set their own.
	Audience string

	// SignalTTL is how long a stored signal stays active.
	SignalTTL time.Duration

	// MaxActionsPerHour is the circuit breaker default for new streams.
	MaxActionsPerHour int

	// ClockSkew is the tolerance for an iat slightly in the future.
	ClockSkew time.Duration

	// MaxSETAge is how far in the past an iat may be. Transmitters retry for
	// a long time, so this is generous.
	MaxSETAge time.Duration

	// MaxBodyBytes bounds the push request body.
	MaxBodyBytes int64

	// MaxRiskScore caps the score this plugin hands to the risk engine.
	//
	// severityFor scores a session-revoked event at 100, which is honest: an
	// identity provider that watched an account be taken over is as certain as
	// a signal gets, and that number is what the stored signal keeps for
	// forensics. But a single contributor's score becomes the whole composite,
	// and riskengine blocks at 85 by default, so handing 100 straight through
	// refused the sign-in outright rather than stepping it up. A user with
	// correct credentials and a correct second factor could not get in.
	//
	// The default of 84 sits one below that threshold, so a CAEP signal
	// challenges. Raise it to 100 if you would rather a confirmed compromise
	// bar the door; the number is a policy statement, not a measurement.
	MaxRiskScore int

	// KeyRefreshInterval is how often cached JWKS entries are re-fetched in
	// the background. A value of zero takes the default; a negative value
	// turns the ticker off entirely, for an embedder that does not want a
	// background goroutine and accepts that key freshness then depends
	// wholly on inbound traffic.
	KeyRefreshInterval time.Duration
}

type CreateStreamRequest struct {
	Name                  string            `json:"name"`
	Issuer                string            `json:"issuer"`
	JWKSURI               string            `json:"jwks_uri"`
	Audience              string            `json:"audience,omitempty"`
	AllowedEventTypes     []string          `json:"allowed_event_types,omitempty"`
	AllowedSubjectFormats []string          `json:"allowed_subject_formats,omitempty"`
	VerifiedDomains       []string          `json:"verified_domains,omitempty"`
	ActionOverrides       map[string]string `json:"action_overrides,omitempty"`
	EnforcementMode       string            `json:"enforcement_mode,omitempty"`
	MaxActionsPerHour     int               `json:"max_actions_per_hour,omitempty"`
}

type CreateStreamResponse struct {
	Stream StreamView `json:"stream"`
	// PushURLPath is the secret segment in the push URL.
	PushURLPath string `json:"push_url_path"`
	// PushToken is the bearer token the transmitter must send.
	PushToken string `json:"push_token"`
	// PushURL is the full URL to hand to the transmitter.
	PushURL string `json:"push_url"`
}

type InboundStream struct {
	ID    id.SSFStreamID
	AppID id.AppID
	EnvID id.EnvironmentID
	Name  string

	// Issuer is the exact iss value a SET must carry.
	Issuer string
	// Audience is the aud value a SET must include.
	Audience string
	// JWKSURI is where this stream's verification keys live.
	JWKSURI string

	// PushPathHash is SHA-256 of the secret URL segment. The plaintext is
	// shown once at creation and never stored.
	PushPathHash string
	// PushTokenHash is SHA-256 of the bearer token the transmitter must send.
	PushTokenHash string

	AllowedEventTypes     []string
	AllowedSubjectFormats []string
	VerifiedDomains       []string
	ActionOverrides       map[string]string

	EnforcementMode   string
	Status            string
	MaxActionsPerHour int

	// PendingVerifyState is the state we sent to the transmitter's
	// verification endpoint and expect echoed back in a verification event.
	PendingVerifyState string
	LastVerifiedAt     *time.Time

	CreatedAt time.Time
	UpdatedAt time.Time
}

type ListStreamsResponse struct {
	Streams []StreamView `json:"streams"`
}

type MemoryStore struct {
	// contains filtered or unexported fields
}

type MongoStore struct {
	// contains filtered or unexported fields
}

type Plugin struct {
	// contains filtered or unexported fields
}

type PostgresStore struct {
	// contains filtered or unexported fields
}

type ReceivedEvent struct {
	ID             id.SSFEventID
	StreamID       id.SSFStreamID
	JTI            string
	EventType      string
	SubjectJSON    string
	ResolvedUserID id.UserID
	Outcome        string
	ActionTaken    string
	Error          string
	ReceivedAt     time.Time
}

type ReceivedEventFilter struct {
	StreamID id.SSFStreamID
	// Since and Until bound received_at, half-open: [Since, Until). Either
	// may be zero, meaning unbounded on that side.
	Since time.Time
	Until time.Time
	// Limit caps the rows returned. Zero or less means
	// DefaultReceivedEventLimit; anything above MaxReceivedEventLimit is
	// clamped down to it.
	Limit int
}

type Resolution struct {
	UserID id.UserID
	// SessionID is set only for a complex subject whose session member both
	// parsed as a valid session ID AND was verified to belong to UserID. A
	// session member that fails either check rejects the whole event rather
	// than being dropped, so callers may treat a non-nil SessionID here as
	// already scoped to UserID without re-checking ownership themselves.
	SessionID id.SessionID
	Outcome   string
}

type Signal struct {
	ID        id.SSFSignalID
	AppID     id.AppID
	EnvID     id.EnvironmentID
	UserID    id.UserID
	StreamID  id.SSFStreamID
	EventType string
	Severity  int
	Reason    string
	EventAt   time.Time
	ExpiresAt time.Time
	CreatedAt time.Time
}

type SqliteStore struct {
	// contains filtered or unexported fields
}

type Store interface {
	CreateInboundStream(ctx context.Context, s *InboundStream) error
	GetInboundStream(ctx context.Context, streamID id.SSFStreamID) (*InboundStream, error)
	GetInboundStreamByPushPathHash(ctx context.Context, hash string) (*InboundStream, error)
	ListInboundStreams(ctx context.Context, appID id.AppID) ([]*InboundStream, error)
	UpdateInboundStream(ctx context.Context, s *InboundStream) error
	DeleteInboundStream(ctx context.Context, streamID id.SSFStreamID) error

	UpsertSubjectLink(ctx context.Context, l *SubjectLink) error
	GetSubjectLink(ctx context.Context, appID id.AppID, envID id.EnvironmentID,
		issuer, subject string) (*SubjectLink, error)

	// InsertReceivedEvent returns ErrDuplicateJTI when (stream_id, jti,
	// event_type) already exists.
	InsertReceivedEvent(ctx context.Context, e *ReceivedEvent) error
	UpdateReceivedEvent(ctx context.Context, e *ReceivedEvent) error
	// DeleteReceivedEvent removes one received-event row by ID. Its only
	// caller is the servePush pipeline undoing InsertReceivedEvent's dedupe
	// row after processing that event failed for an infrastructure reason
	// rather than a policy one -- a transmitter retry must actually be
	// reprocessed, not read back later as a replay of a delivery that was
	// never really handled.
	DeleteReceivedEvent(ctx context.Context, id id.SSFEventID) error
	// GetReceivedEvent loads one audit row by ID, scoped to appID. The
	// row itself has no app_id, so the scope is enforced through the
	// stream it arrived on; a row belonging to another tenant answers
	// ErrNotFound, never a distinguishable "forbidden".
	GetReceivedEvent(ctx context.Context, appID id.AppID,
		eventID id.SSFEventID) (*ReceivedEvent, error)
	// ListReceivedEvents returns one stream's audit rows newest first,
	// bounded by the filter's time window and row limit. A stream that
	// does not belong to appID answers ErrNotFound rather than an empty
	// list, so a probe cannot tell "not yours" from "yours but quiet".
	ListReceivedEvents(ctx context.Context, appID id.AppID,
		f ReceivedEventFilter) ([]*ReceivedEvent, error)
	// CountEventsSince counts every event RECORDED for a stream since a
	// cutoff, whatever outcome it reached. It backs the circuit breaker.
	//
	// It deliberately does not filter on action_taken. Counting only the
	// events that produced an action left the entire signal-only half of
	// the matrix outside the breaker: an authentic but hostile transmitter
	// could push unlimited risk-level-change events at HIGH, raising every
	// user's risk score, while the counter stayed at zero. The breaker
	// exists to bound authentic traffic, so it has to count all of it.
	CountEventsSince(ctx context.Context, streamID id.SSFStreamID, since time.Time) (int, error)

	CreateSignal(ctx context.Context, s *Signal) error
	ListActiveSignals(ctx context.Context, appID id.AppID, envID id.EnvironmentID,
		userID id.UserID, now time.Time) ([]*Signal, error)
}

type StreamView struct {
	ID                    string            `json:"id"`
	Name                  string            `json:"name"`
	Issuer                string            `json:"issuer"`
	Audience              string            `json:"audience"`
	JWKSURI               string            `json:"jwks_uri"`
	AllowedEventTypes     []string          `json:"allowed_event_types"`
	AllowedSubjectFormats []string          `json:"allowed_subject_formats"`
	VerifiedDomains       []string          `json:"verified_domains"`
	ActionOverrides       map[string]string `json:"action_overrides"`
	EnforcementMode       string            `json:"enforcement_mode"`
	Status                string            `json:"status"`
	MaxActionsPerHour     int               `json:"max_actions_per_hour"`
	LastVerifiedAt        *time.Time        `json:"last_verified_at,omitempty"`
	CreatedAt             time.Time         `json:"created_at"`
	UpdatedAt             time.Time         `json:"updated_at"`
}

type SubjectLink struct {
	ID         id.SSFLinkID
	AppID      id.AppID
	EnvID      id.EnvironmentID
	Issuer     string
	Subject    string
	UserID     id.UserID
	Source     string
	CreatedAt  time.Time
	LastSeenAt time.Time
}

type SubjectLinker interface {
	LinkSubject(ctx context.Context, appID id.AppID, envID id.EnvironmentID,
		issuer, subject string, userID id.UserID, source string) error
}

type UpdateStreamRequest struct {
	Name                  *string           `json:"name,omitempty"`
	Status                *string           `json:"status,omitempty"`
	EnforcementMode       *string           `json:"enforcement_mode,omitempty"`
	MaxActionsPerHour     *int              `json:"max_actions_per_hour,omitempty"`
	JWKSURI               *string           `json:"jwks_uri,omitempty"`
	AllowedEventTypes     []string          `json:"allowed_event_types,omitempty"`
	AllowedSubjectFormats []string          `json:"allowed_subject_formats,omitempty"`
	VerifiedDomains       []string          `json:"verified_domains,omitempty"`
	ActionOverrides       map[string]string `json:"action_overrides,omitempty"`
}