oidcproxy

type App struct {
	Config          *Config
	TemplateManager *templateManager
	SessionManager  *sessionManager
	Providers       []*Provider
}

type ClaimCheckFunc func(claims map[string]any) error

type Config struct {
	// OAuth2 / OIDC
	Providers []ProviderConfig

	// CallbackURL is the url under which the callback path is reachable
	CallbackURL string

	// PostLogoutRedirectURI is the URL where you get redirected after an
	// RP initiated logut
	PostLogoutRediretURI string

	// BasePath is the path under which the other pathes get mapped
	BasePath string

	// LoginPath is the path under which the login flow gets initiated.
	LoginPath string

	// CallbackPath handle the oauth2 callback. It defaults to the path of
	// the CallbackURL if not specified.
	CallbackPath string

	// SessionInfoPath
	SessionInfoPath string

	// RefreshPath performs an explicit refresh
	RefreshPath string

	// LogoutPath deletes cookie, revokes token and redirect to IDPs logout
	// URL if available
	LogoutPath string

	// The external pathes are the paths under which the endpoint is
	// reachable from externally. If not set this defaults to the internal
	// path. These variables are only required if between the client and
	// this component the path gets rewritten.
	// For example if you have an entry proxy (ingress) which routes
	// requests from entry.com/myapp/auth/info to myapp.com/auth/info you
	// have to configure a ExternalBasePath of /myapp.
	ExternalBasePath        string
	ExternalLoginPath       string
	ExternalSessionInfoPath string
	ExternalRefreshPath     string
	ExternalLogoutPath      string

	// DebugPath shows info about the current session
	//
	// Deprecated: will remove
	// TODO:
	DebugPath string

	// secure cookie
	HashKey      []byte
	EncryptKey   []byte
	CookieConfig CookieOptions

	// Used in templates
	AppName string

	TemplateDir     string
	TemplateDevMode bool
}

type CookieHandler struct {
	// contains filtered or unexported fields
}

type CookieOptions struct {
	Path     string
	Secure   bool
	HttpOnly bool
	Domain   string
	SameSite http.SameSite
	Duration time.Duration
}

type Endpoints struct {
	AuthorizationEndpoint string `json:"authorization_endpoint"`
	TokenEndpoint         string `json:"token_endpoint"`
	IntrospectionEndpoint string `json:"introspection_endpoint"`
	UserinfoEndpoint      string `json:"userinfo_endpoint"`
	EndSessionEndpoint    string `json:"end_session_endpoint"`
	RevocationEndpoint    string `json:"revocation_endpoint"`
}

type HTTPErrorHandler func(w http.ResponseWriter, r *http.Request, httpCode int, err error)

type LoginState struct {
	ProviderID string
	State      string
	URI        string
}

type PathSet struct {
	// Login is the path to the login handler
	Login string

	// Logout is the path to the logout handler
	Logout string

	// Refresh is the path to the refresh handler
	Refresh string
}

type PostCallbackHandler func(w http.ResponseWriter, r *http.Request, s *SessionContext)

type Provider struct {
	// contains filtered or unexported fields
}

type ProviderConfig struct {
	ID                     string           `json:"id,omitempty"`
	Name                   string           `json:"name"`
	IssuerURL              string           `json:"issuer_url"`
	ClientID               string           `json:"client_id"`
	ClientSecret           string           `json:"client_secret"`
	Scopes                 []string         `json:"scopes"`
	AuthorizationParameter url.Values       `json:"authorization_parameters"`
	TokenParameters        url.Values       `json:"token_parameters"`
	CallbackURL            string           `json:"callback_url"`
	PostLogoutRedirectURI  string           `json:"post_logout_redirect_uri"`
	SetupSessionFunc       SessionSetupFunc `json:"-"`
	Endpoints
}

type Session struct {
	ProviderID string `json:"provider_id"`

	// Expiry specifies the time when the session expires. This is set
	// during the session setup and is usually obtained from the field
	// expires_in from the Access Token Response (see
	// https://datatracker.ietf.org/doc/html/rfc6749#section-5.1).
	Expiry time.Time `json:"expiry"`

	// Tokens usually stores the issued tokens from which the session got
	// created. If you don't need the tokens you can remove them during the
	// session setup which helps to keep the cookie small.
	Tokens *Tokens `json:"tokens,omitempty"`

	// User represents the authenticated user. The user can be initialized
	// during the session setup. Usually for this values from the claims in
	// the id_token are used.
	User *User `json:"user,omitempty"`
}

type SessionContext struct {
	*Session
	Provider *Provider
}

type SessionInfoTemplateData struct {
	Session  *Session
	Provider *Provider
	Path     PathSet
}

type SessionSetupFunc func(ctx context.Context, p *Provider, t *TokenResponse, s *Session) error

type TokenResponse struct {
	// Token contains the standard OAuth2 tokens like the access_token.
	oauth2.Token

	// RawIDToken contains the id_token if it was available in the
	// response.
	RawIDToken string

	// IDToken contains the parsed and validated id_token if it was
	// available in the response.
	IDToken *oidc.IDToken
}

type Tokens struct {
	oauth2.Token
	IDToken string `json:"id_token"`
}

type User struct {
	ID     string   `json:"id"`
	Name   string   `json:"name"`
	Groups []string `json:"groups,omitempty"`
	Extra  any      `json:"extra,omitempty"`
}

type UserError interface {
	UserError() string
}