tokenbridge

type Cache interface {
	// Add inserts a public key into the cache with the specified key ID.
	Add(ctx context.Context, keyID string, key crypto.PublicKey)

	// Get retrieves a public key from the cache by its key ID.
	// Returns nil if the key is not found.
	Get(ctx context.Context, keyID string) (crypto.PublicKey, bool)
}

type CalculateThumbprintOptions struct {
	// TLSConfig is a customizable TLS configuration used when establishing the TLS connection.
	TLSConfig *tls.Config

	// Dialer is a custom network dialer that will be used to establish the network connection.
	Dialer *net.Dialer
}

type ClientCredentialIssuer struct {
	// contains filtered or unexported fields
}

type ECSignerOptions struct {
	RotatedKeys []RotatedECDAKey
}

type JWK struct {
	// Kty (Key Type) indicates the algorithm family of the key (e.g., "RSA", "EC").
	Kty string `json:"kty"`

	// Alg (Algorithm) indicates the algorithm used with the key (e.g., "RS256").
	Alg string `json:"alg"`

	// Use (Key Use) indicates the intended use of the key (e.g., "sig" for signature).
	Use string `json:"use"`

	// Kid (Key ID) is a unique identifier for the key.
	Kid string `json:"kid"`

	// N is the modulus for RSA keys. This field is only set for RSA keys.
	N string `json:"n,omitempty"`

	// E is the exponent for RSA keys. This field is only set for RSA keys.
	E string `json:"e,omitempty"`

	// X is the x-coordinate for EC keys. This field is only set for EC keys.
	X string `json:"x,omitempty"`

	// Y is the y-coordinate for EC keys. This field is only set for EC keys.
	Y string `json:"y,omitempty"`

	// Crv (Curve) indicates the elliptic curve used for EC keys. This field is only set for EC keys.
	Crv string `json:"crv,omitempty"`
}

type JWKS struct {
	// Keys is a list of JSON Web Keys (JWKs) included in the set.
	Keys []JWK `json:"keys"`
}

type JWKSProvider interface {
	// GetJWKS retrieves the JSON Web Key Set (JWKS) containing the public keys used to verify the signed tokens.
	GetJWKS(ctx context.Context) (*JWKS, error)
}

type KMSClient interface {
	// Sign signs a digest with the given key using KMS.
	Sign(ctx context.Context, input *kms.SignInput, optFns ...func(*kms.Options)) (*kms.SignOutput, error)

	// GetPublicKey retrieves the public key associated with the given key ID.
	GetPublicKey(ctx context.Context, input *kms.GetPublicKeyInput, optFns ...func(*kms.Options)) (*kms.GetPublicKeyOutput, error)
}

type KMSSigner struct {
	// contains filtered or unexported fields
}

type KMSSignerOptions struct {
	Cache         Cache    // Cache for storing and retrieving public keys
	RotatedKeyIDs []string // A list of key IDs that have been rotated out of active use but are still included in the JWKS
}

type OIDCVerifier struct {
	// contains filtered or unexported fields
}

type OIDCVerifierOptions struct {
	// Transport is an optional custom HTTP transport used for making HTTP requests.
	Transport http.RoundTripper

	// Thumbprints is a list of valid thumbprints for the keys used to verify ID tokens.
	// If this is set, the transport will be configured to validate the thumbprints of the keys.
	Thumbprints []string

	// SupportedSigningAlgs is a list of signing algorithms supported for verifying ID tokens.
	SupportedSigningAlgs []string

	// SkipClientIDCheck controls whether the client ID check is skipped during verification.
	SkipClientIDCheck bool

	// SkipExpiryCheck controls whether the expiry check is skipped during verification.
	SkipExpiryCheck bool

	// SkipIssuerCheck controls whether the issuer check is skipped during verification.
	SkipIssuerCheck bool

	// Now is a function that returns the current time, which can be used for expiry and validity checks.
	// If not provided, the default time function (time.Now) is used.
	Now func() time.Time

	// CalculateThumbprintOptions is an optional configuration for calculating the thumbprint.
	// It allows customization of the TLS configuration and dialer used to establish the connection.
	// This is useful for scenarios where you need to specify custom TLS settings or a custom dialer.
	// If nil, default settings will be used.
	CalculateThumbprintOptions *CalculateThumbprintOptions
}

type RSASignerOptions struct {
	RotatedKeys []RotatedRSAKey
}

type RotatedECDAKey struct {
	KeyID     string
	PublicKey *ecdsa.PublicKey
}

type RotatedRSAKey struct {
	KeyID     string
	PublicKey *rsa.PublicKey
}

type Signer interface {
	// SignToken signs the given JWT token using the signing algorithm and returns the signed string.
	SignToken(ctx context.Context, token *jwt.Token) (string, error)

	// GetJWKS returns the JWKS (JSON Web Key Set) associated with the signer, containing the public key.
	GetJWKS(ctx context.Context) (*JWKS, error)

	// SigningMethod returns the JWT signing method (e.g., HMAC or RSA).
	SigningMethod() jwt.SigningMethod

	// KeyID returns the Key ID used to identify the key.
	KeyID() string
}

type TokenBridge struct {
	// contains filtered or unexported fields
}

type TokenIssuer interface {
	// IssueAccessToken generates an access token based on the provided ID token.
	IssueAccessToken(ctx context.Context, idToken *oidc.IDToken) (string, error)
}

type TokenIssuerWithJWKS struct {
	// contains filtered or unexported fields
}

type TokenIssuerWithJWKSOptions struct {
	// MandatoryClaims are the claims that must be present in the access token.
	MandatoryClaims []string

	// TokenExpiration defines the duration for which the access token will be valid.
	// The default is set to one hour.
	TokenExpiration time.Duration

	// OnTokenCreate is a callback function that allows customization of claims during token creation.
	// If not set, a default implementation will be used.
	OnTokenCreate func(ctx context.Context, issuer string, idToken *oidc.IDToken) (jwt.MapClaims, error)
}

type Verifier interface {
	Verify(ctx context.Context, rawIDToken string) (*oidc.IDToken, error)
}