sso

type AdminConnectionPathRequest struct {
	ConnectionID string `path:"connectionId" description:"Connection identifier"`
}

type AdminCreateConnectionRequest struct {
	AppID        string `json:"app_id,omitempty" description:"Application ID; optional, must be the caller's own app"`
	OrgID        string `json:"org_id,omitempty" description:"Optional Org scope inside the App"`
	Provider     string `json:"provider" description:"Stable name for this IdP (e.g. 'studio', 'okta')"`
	Protocol     string `json:"protocol" description:"oidc or saml"`
	Domain       string `json:"domain" description:"Email-domain or IdP host this connection covers"`
	Issuer       string `json:"issuer,omitempty" description:"OIDC issuer URL (required for oidc)"`
	ClientID     string `json:"client_id,omitempty" description:"OIDC client ID"`
	ClientSecret string `json:"client_secret,omitempty" description:"OIDC client secret (omit for public flows)"`
	MetadataURL  string `json:"metadata_url,omitempty" description:"SAML metadata URL (one IdP source for saml)"`

	// SAML IdP configuration. Supply exactly one IdP source: metadata_url,
	// idp_metadata_xml, or idp_sso_url + idp_certificate.
	IDPMetadataXML    string            `json:"idp_metadata_xml,omitempty" description:"Pasted SAML IdP metadata XML"`
	IDPSSOURL         string            `json:"idp_sso_url,omitempty" description:"SAML IdP SSO (redirect) URL"`
	IDPCertificate    string            `json:"idp_certificate,omitempty" description:"SAML IdP signing certificate (PEM)"`
	EntityID          string            `json:"entity_id,omitempty" description:"SP EntityID override; defaults to the metadata URL"`
	ACSURL            string            `json:"acs_url,omitempty" description:"SP ACS URL override; defaults to the canonical /acs route"`
	SignRequests      bool              `json:"sign_requests,omitempty" description:"Sign outbound AuthnRequests with the SP key"`
	AttributeMappings map[string]string `json:"attribute_mappings,omitempty" description:"SAML attribute name → user field (email|first_name|last_name|groups)"`
	AllowedDomains    []string          `` /* 141-byte string literal not displayed */
	TrustedFederation bool              `` /* 136-byte string literal not displayed */
}

type AdminCreateConnectionResponse struct {
	ID       string `json:"id"`
	AppID    string `json:"app_id"`
	Provider string `json:"provider"`
	Protocol string `json:"protocol"`
	Domain   string `json:"domain"`
	Active   bool   `json:"active"`
}

type AdminDeleteConnectionResponse struct {
	Status string `json:"status"`
}

type AdminListConnectionsRequest struct {
	AppID string `query:"app_id,omitempty" description:"App identifier; optional, must be the caller's own app"`
}

type AdminListConnectionsResponse struct {
	Connections []*Connection `json:"connections"`
}

type AdminUpdateConnectionRequest struct {
	ConnectionID string `path:"connectionId" description:"Connection identifier"`

	Provider     string `json:"provider,omitempty" description:"Stable provider name"`
	Domain       string `json:"domain,omitempty" description:"Email-domain or IdP host"`
	Issuer       string `json:"issuer,omitempty" description:"OIDC issuer URL"`
	ClientID     string `json:"client_id,omitempty" description:"OIDC client ID"`
	ClientSecret string `json:"client_secret,omitempty" description:"OIDC client secret; pass empty string to leave unchanged"`
	MetadataURL  string `json:"metadata_url,omitempty" description:"SAML metadata URL"`

	// SAML fields. Empty strings leave the stored value unchanged; send
	// attribute_mappings/sign_requests to replace them wholesale.
	IDPMetadataXML    string            `json:"idp_metadata_xml,omitempty" description:"Pasted SAML IdP metadata XML"`
	IDPSSOURL         string            `json:"idp_sso_url,omitempty" description:"SAML IdP SSO URL"`
	IDPCertificate    string            `json:"idp_certificate,omitempty" description:"SAML IdP signing certificate (PEM)"`
	EntityID          string            `json:"entity_id,omitempty" description:"SP EntityID override"`
	ACSURL            string            `json:"acs_url,omitempty" description:"SP ACS URL override"`
	SignRequests      *bool             `json:"sign_requests,omitempty" description:"Toggle signing outbound AuthnRequests"`
	AttributeMappings map[string]string `json:"attribute_mappings,omitempty" description:"Replace the SAML attribute → user field map"`
	AllowedDomains    []string          `json:"allowed_domains,omitempty" description:"Replace the extra email domains this connection may assert"`
	TrustedFederation *bool             `json:"trusted_federation,omitempty" description:"Adopt the IdP subject as the local user id for new users"`

	Active *bool `json:"active,omitempty" description:"Activate/deactivate the connection without deleting it"`
}

type CallbackRequest struct {
	Provider string `path:"provider"`
	State    string `json:"state" query:"state,omitempty"`
	Code     string `json:"code" query:"code,omitempty"`
	Error    string `json:"error,omitempty" query:"error,omitempty"`
}

type CallbackResponse struct {
	User         any    `json:"user"`
	SessionToken string `json:"session_token"`
	RefreshToken string `json:"refresh_token"`
	ExpiresAt    any    `json:"expires_at"`
	Provider     string `json:"provider"`
	IsNewUser    bool   `json:"is_new_user"`
	// contains filtered or unexported fields
}

type Config struct {
	// Providers is the list of configured SSO providers.
	Providers []Provider

	// SessionTokenTTL is the lifetime of sessions created via SSO sign-in (default: 1 hour).
	SessionTokenTTL time.Duration

	// SessionRefreshTTL is the lifetime of refresh tokens (default: 30 days).
	SessionRefreshTTL time.Duration

	// PublicBaseURL is the externally-reachable base URL of this SSO service
	// (e.g. "https://auth.muono.cloud"). SAML SP EntityID / ACS URL derive from
	// it when a connection doesn't override them. Required for SAML.
	PublicBaseURL string

	// AllowedReturnOrigins is the allowlist of scheme://host[:port] origins the
	// browser SSO landing may redirect back to after ACS. Guards against open
	// redirect. localhost/127.0.0.1 are always allowed (dev). The first entry is
	// used to derive a default `/sso/callback` landing when none is supplied.
	AllowedReturnOrigins []string
}

type Connection struct {
	ID       id.SSOConnectionID `json:"id"`
	AppID    id.AppID           `json:"app_id"`
	EnvID    string             `json:"env_id,omitempty"`
	OrgID    id.OrgID           `json:"org_id,omitempty"`
	Provider string             `json:"provider"`
	Protocol string             `json:"protocol"`
	Domain   string             `json:"domain"`
	// DisplayName is an optional admin-set label for the connection (e.g. "Okta",
	// "Google Workspace"), so multiple connections for the same domain can be told
	// apart. Cosmetic — never used for routing.
	DisplayName  string `json:"display_name,omitempty"`
	MetadataURL  string `json:"metadata_url,omitempty"`
	ClientID     string `json:"client_id,omitempty"`
	ClientSecret string `json:"-"`
	Issuer       string `json:"issuer,omitempty"`
	Active       bool   `json:"active"`
	// Enforced requires users on this connection's domain to sign in via SSO —
	// password login is blocked for them (workspace owners/admins excepted). See
	// the plugin's OnBeforeSignIn.
	Enforced bool `json:"enforced"`

	// AllowedDomains lists email domains, besides Domain, that this
	// connection may assert. A login whose email is outside Domain and this
	// list is refused before any account is touched.
	AllowedDomains []string `json:"allowed_domains,omitempty"`
	// TrustedFederation adopts the identity provider's subject as the local
	// user id when a user is first created through this connection. Off by
	// default: an IdP that can pick subjects can otherwise pick local ids.
	TrustedFederation bool `json:"trusted_federation,omitempty"`

	// SAML-specific configuration. Populated only for SAML connections.
	IDPMetadataXML    string            `json:"idp_metadata_xml,omitempty"`
	IDPSSOURL         string            `json:"idp_sso_url,omitempty"`
	IDPCertificate    string            `json:"idp_certificate,omitempty"`
	EntityID          string            `json:"entity_id,omitempty"`
	ACSURL            string            `json:"acs_url,omitempty"`
	SPCertificate     string            `json:"sp_certificate,omitempty"`
	SPPrivateKey      string            `json:"-"` // secret — never serialized
	SignRequests      bool              `json:"sign_requests,omitempty"`
	AttributeMappings map[string]string `json:"attribute_mappings,omitempty"`

	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type CreateConnectionInput struct {
	AppID    id.AppID
	OrgID    id.OrgID // zero value = app-wide (no org scope)
	Provider string
	Protocol string // "oidc" | "saml"
	Domain   string

	// OIDC
	Issuer       string
	ClientID     string
	ClientSecret string

	// SAML — supply one IdP source: MetadataURL, IDPMetadataXML, or
	// IDPSSOURL + IDPCertificate.
	MetadataURL       string
	IDPMetadataXML    string
	IDPSSOURL         string
	IDPCertificate    string
	EntityID          string
	ACSURL            string
	SignRequests      bool
	AttributeMappings map[string]string

	// Enforced requires users on this domain to sign in via SSO (password login
	// blocked). Usually toggled on later via UpdateConnection, not at create.
	Enforced bool
	// DisplayName is an optional admin-set label for the connection (cosmetic).
	DisplayName string
	// AllowedDomains and TrustedFederation confine and shape the identities
	// this connection may assert; see Connection.
	AllowedDomains    []string
	TrustedFederation bool
}

type EncryptedStore struct {
	// contains filtered or unexported fields
}

type ExchangeRequest struct {
	Code string `json:"code" description:"One-time code issued by the ACS redirect"`
}

type Identity struct {
	ConnectionID id.SSOConnectionID `json:"connection_id"`
	Subject      string             `json:"subject"`
	UserID       id.UserID          `json:"user_id"`
	CreatedAt    time.Time          `json:"created_at"`
}

type LoginByDomainRequest struct {
	Email        string `json:"email" description:"Work email; its domain routes to the matching SSO connection"`
	ConnectionID string `` /* 143-byte string literal not displayed */
	ReturnURL    string `json:"return_url,omitempty" description:"Frontend URL to land on after login (must be allowlisted)"`
}

type LoginRequest struct {
	Provider  string `path:"provider"`
	ReturnURL string `` /* 128-byte string literal not displayed */
}

type LoginResponse struct {
	LoginURL string `json:"login_url"`
	State    string `json:"state"`
}

type MemoryStore struct {
	// contains filtered or unexported fields
}

type MongoStore struct {
	// contains filtered or unexported fields
}

type OIDCConfig struct {
	// Name is the provider's stable name, used in routes and state.
	Name string
	// Issuer is the OpenID provider's issuer URL. Discovery is fetched from
	// Issuer + "/.well-known/openid-configuration".
	Issuer string
	// ClientID and ClientSecret are the relying party credentials.
	ClientID     string
	ClientSecret string
	// RedirectURL is the callback registered with the provider.
	RedirectURL string
	// Scopes defaults to openid, profile and email.
	Scopes []string
	// HTTPClient overrides the client used for discovery, the token exchange
	// and userinfo. Nil selects the hardened client, which refuses private
	// addresses and plain http; tests point it at a local server.
	HTTPClient *http.Client
	// contains filtered or unexported fields
}

type Plugin struct {
	// contains filtered or unexported fields
}

type PostgresStore struct {
	// contains filtered or unexported fields
}

type Provider interface {
	// Name returns the unique identifier for this provider (e.g. "okta", "azure-ad").
	Name() string

	// Protocol returns the SSO protocol ("oidc" or "saml").
	Protocol() string

	// LoginURL returns the URL to redirect the user to for authentication.
	LoginURL(state string) (string, error)

	// HandleCallback processes the callback from the identity provider
	// and returns the authenticated user's identity.
	HandleCallback(ctx context.Context, params map[string]string) (*User, error)
}

type SAMLConfig struct {
	// Name is the unique provider identifier (e.g. "okta-saml").
	Name string

	// IdP description — resolved in this order: pasted metadata XML, a
	// metadata URL to fetch, or an explicit SSO URL + signing certificate.
	IDPMetadataXML    string
	MetadataURL       string
	IDPSSOURL         string
	IDPCertificatePEM string

	// Service Provider identity.
	EntityID         string // SP entity ID (assertion audience)
	ACSURL           string // SP Assertion Consumer Service URL
	SPCertificatePEM string // SP signing cert (PEM); optional
	SPPrivateKeyPEM  string // SP signing key (PEM); optional, enables signed AuthnRequests
	SignRequests     bool

	// AllowIDPInitiated permits unsolicited assertions (no prior AuthnRequest).
	AllowIDPInitiated bool

	// AttributeMap maps SAML attribute names to user fields
	// ("email" | "first_name" | "last_name" | "groups"). Empty uses defaults.
	AttributeMap map[string]string
	// contains filtered or unexported fields
}

type SAMLMetadataProvider interface {
	Metadata() (xml []byte, contentType string, err error)
}

type SqliteStore struct {
	// contains filtered or unexported fields
}

type Store interface {
	CreateConnection(ctx context.Context, c *Connection) error
	GetConnection(ctx context.Context, connID id.SSOConnectionID) (*Connection, error)
	GetConnectionByDomain(ctx context.Context, appID id.AppID, domain string) (*Connection, error)
	// GetConnectionByDomainAndOrg resolves the active connection for a domain
	// within a specific org (workspace). Multi-tenant SSO allows the same domain
	// in several orgs, so lookups that must land on one workspace use this.
	GetConnectionByDomainAndOrg(ctx context.Context, appID id.AppID, orgID id.OrgID, domain string) (*Connection, error)
	GetConnectionByProvider(ctx context.Context, appID id.AppID, provider string) (*Connection, error)
	ListConnections(ctx context.Context, appID id.AppID) ([]*Connection, error)
	UpdateConnection(ctx context.Context, c *Connection) error
	DeleteConnection(ctx context.Context, connID id.SSOConnectionID) error

	// GetIdentity resolves the user bound to a provider subject on one
	// connection. CreateIdentity records the binding and fails on a subject
	// the connection already holds.
	GetIdentity(ctx context.Context, connID id.SSOConnectionID, subject string) (*Identity, error)
	CreateIdentity(ctx context.Context, ident *Identity) error
}

type User struct {
	ProviderUserID string            `json:"provider_user_id"`
	Email          string            `json:"email"`
	FirstName      string            `json:"first_name"`
	LastName       string            `json:"last_name"`
	Groups         []string          `json:"groups,omitempty"`
	Attributes     map[string]string `json:"attributes,omitempty"`
	// EmailVerified is the provider's own statement about the address, when
	// it made one: OIDC's email_verified claim. Nil means the provider said
	// nothing; an explicit false refuses the login.
	EmailVerified *bool `json:"email_verified,omitempty"`
}