samlsp

type AssertionHandler interface {
	HandleAssertion(assertion *saml.Assertion) error
}

type Attributes map[string][]string

type CookieRequestTracker struct {
	ServiceProvider saml.ServiceProvider
	NamePrefix      string
	Codec           TrackedRequestCodec
	MaxAge          time.Duration
	RelayStateFunc  func(w http.ResponseWriter, r *http.Request) string
	SameSite        http.SameSite
}

type CookieSessionProvider struct {
	Name     string
	Domain   string
	HTTPOnly bool
	Secure   bool
	SameSite http.SameSite
	MaxAge   time.Duration
	Path     string
	Codec    SessionCodec
}

type ErrorFunction func(w http.ResponseWriter, r *http.Request, err error)

type JWTSessionClaims struct {
	jwt.RegisteredClaims
	Attributes  Attributes `json:"attr"`
	SAMLSession bool       `json:"saml-session"`
}

type JWTSessionCodec struct {
	SigningMethod jwt.SigningMethod
	Audience      string
	Issuer        string
	MaxAge        time.Duration
	Key           crypto.Signer
}

type JWTTrackedRequestClaims struct {
	jwt.RegisteredClaims
	TrackedRequest
	SAMLAuthnRequest bool `json:"saml-authn-request"`
}

type JWTTrackedRequestCodec struct {
	SigningMethod jwt.SigningMethod
	Audience      string
	Issuer        string
	MaxAge        time.Duration
	Key           crypto.Signer
}

type Middleware interface {
	ServeMetadata(c *gin.Context) ([]byte, error)
	ServeACS(c *gin.Context) (string, error)
	RequireAccount() gin.HandlerFunc
	HandleStartAuthFlow(c *gin.Context)
	GetLogoutUrl() string
	CreateSessionFromAssertion(c *gin.Context, assertion *saml.Assertion, redirectURI string) (string, error)
	GetSession() SessionProvider
	GetRequestTracker() RequestTracker
	GetServiceProvider() saml.ServiceProvider
	SetSession(session SessionProvider)
	SetRequestTracker(tracker RequestTracker)
	SetServiceProvider(sp saml.ServiceProvider)
	SetOnError(onErr func(ctx *gin.Context, err error) error)
	Logout(ctx *gin.Context) (*url.URL, error)
}

type MiddlewareImpl struct {
	ServiceProvider  saml.ServiceProvider
	OnError          func(c *gin.Context, err error) error
	Binding          string // either saml.HTTPPostBinding or saml.HTTPRedirectBinding
	ResponseBinding  string // either saml.HTTPPostBinding or saml.HTTPArtifactBinding
	RequestTracker   RequestTracker
	Session          SessionProvider
	AssertionHandler AssertionHandler
	ForceRedirectUrl string
	ACSHandler       gin.HandlerFunc
	MetadataHandler  gin.HandlerFunc
	LogoutUrl        *url.URL
}

type NopAssertionHandler struct{}

type Options struct {
	EntityID                string
	URL                     url.URL
	Key                     crypto.Signer
	Certificate             *x509.Certificate
	Intermediates           []*x509.Certificate
	HTTPClient              *http.Client
	AllowIDPInitiated       bool
	DefaultRedirectURI      string
	IDPMetadata             *saml.EntityDescriptor
	SignRequest             bool
	UseArtifactResponse     bool
	ForceAuthn              bool // TODO(ross): this should be *bool
	RequestedAuthnContext   *saml.RequestedAuthnContext
	CookieSameSite          http.SameSite
	CookieName              string
	RelayStateFunc          func(w http.ResponseWriter, r *http.Request) string
	LogoutBindings          []string
	LogoutUrl               *url.URL
	ForceRedirectUrl        *url.URL
	OverrideSessionProvider SessionProvider
	OverrideServiceProvider saml.ServiceProvider
}

type RequestTracker interface {
	// TrackRequest starts tracking the SAML request with the given ID. It returns an
	// `index` that should be used as the RelayState in the SAMl request flow.
	TrackRequest(w http.ResponseWriter, r *http.Request, samlRequestID string) (index string, err error)

	// StopTrackingRequest stops tracking the SAML request given by index, which is a string
	// previously returned from TrackRequest
	StopTrackingRequest(w http.ResponseWriter, r *http.Request, index string) error

	// GetTrackedRequests returns all the pending tracked requests
	GetTrackedRequests(r *http.Request) []TrackedRequest

	// GetTrackedRequest returns a pending tracked request.
	GetTrackedRequest(r *http.Request, index string) (*TrackedRequest, error)
}

type Session interface{}

type SessionCodec interface {
	// New creates a Session from the SAML assertion.
	New(assertion *saml.Assertion) (Session, error)

	// Encode returns a serialized version of the Session.
	//
	// Note: When implementing this function, it is reasonable to expect that
	// Session is of the exact type returned by New(), and panic if it is not.
	Encode(s Session) (string, error)

	// Decode parses the serialized session that may have been returned by Encode
	// and returns a Session.
	Decode(string) (Session, error)
}

type SessionProvider interface {
	// CreateSession is called when we have received a valid SAML assertion and
	// should create a new session and modify the http response accordingly, e.g. by
	// setting a cookie.
	GetName() string
	SetName(name string)
	GetMaxAge() time.Duration
	SetMaxAge(age time.Duration)
	GetCodec() SessionCodec
	SetCodec(codec SessionCodec)
	CreateSession(ctx *gin.Context, assertion *saml.Assertion) error

	// DeleteSession is called to modify the response such that it removed the current
	// session, e.g. by deleting a cookie.
	DeleteSession(ctx *gin.Context) error

	// GetSession returns the current Session associated with the request, or
	// ErrNoSession if there is no valid session.
	GetSession(ctx *gin.Context) (Session, error)
}

type SessionWithAttributes interface {
	Session
	GetAttributes() Attributes
}

type TrackedRequest struct {
	Index         string `json:"-"`
	SAMLRequestID string `json:"id"`
	URI           string `json:"uri"`
}

type TrackedRequestCodec interface {
	// Encode returns an encoded string representing the TrackedRequest.
	Encode(value TrackedRequest) (string, error)

	// Decode returns a Tracked request from an encoded string.
	Decode(signed string) (*TrackedRequest, error)
}