security

type Auditor interface {
	LogAuthEvent(ctx context.Context, event AuditorEvent) error
}

type AuditorEvent struct {
	Timestamp time.Time
	Subject   string
	Action    string
	Object    string
	Success   bool
	ClientIP  string
	UserAgent string
}

type Authenticator interface {
	// Authenticate returns a nil error and the AuthClaims info (if available).
	Authenticate(context.Context, string) (Claims, error)
	// AuthenticateContext returns a nil error and the AuthClaims info (if available).
	// if the subject is authenticated or a non-nil error with an appropriate error cause otherwise.
	AuthenticateContext(context.Context, TokenSource) (Claims, error)
	// DestroyToken invalidate a token by removing it from the token store.
	DestroyToken(context.Context, string) error
	// DestroyRefreshToken by removing from the token store to invalidate a refresh token
	DestroyRefreshToken(context.Context, string) error
}

type Authorizer interface {
	// Authorized checks if a user is authorized to perform an action.
	// It takes a context and a UserClaims object as input.
	// It returns a boolean indicating whether the user is authorized and an error if the check fails.
	Authorized(ctx context.Context, policy Policy, object string, action string) (bool, error)
	// AuthorizedWithDomain checks if a user is authorized to perform an action within a specific domain.
	// It takes a context, a UserClaims object, a domain, an object, and an action as input.
	// It returns a boolean indicating whether the user is authorized and an error if the check fails.
	AuthorizedWithDomain(ctx context.Context, policy Policy, object string, action string, domain string) (bool, error)
	// AuthorizedWithExtra checks if a user is authorized to perform an action within a specific domain.
	// It takes a context, a UserClaims object, a domain, an object, and an action as input.
	// It returns a boolean indicating whether the user is authorized and an error if the check fails.
	AuthorizedWithExtra(ctx context.Context, data ExtraData) (bool, error)
}

type Claims interface {
	// GetSubject returns the subject of the security
	GetSubject() string
	// GetIssuer returns the issuer of the security
	GetIssuer() string
	// GetAudience returns the audience of the security
	GetAudience() []string
	// GetExpiration returns the expiration time of the security
	GetExpiration() int64
	// GetNotBefore returns the time before which the security cannot be accepted
	GetNotBefore() int64
	// GetIssuedAt returns the time at which the security was issued
	GetIssuedAt() int64
	// GetID returns the unique identifier for the security
	GetID() string
	// GetScopes returns the scopes associated with the security
	GetScopes() map[string]bool
}

type Extra interface {
	// GetExtra returns the extra data as a map of strings
	GetExtra() map[string]string
	// Get returns the value associated with the given key
	Get(key string) (string, bool)
	// Set sets the value associated with the given key
	Set(key string, value string)
}

type ExtraClaims struct {
	// Claims is the registered claims part of the ExtraClaims object.
	Claims Claims
	// Extra is the extra claims part of the ExtraClaims object.
	Extra Extra
}

type ExtraData interface {
	Extra
	// GetClaims returns the Claims object associated with the extra data,if Claims exists
	GetClaims() (Claims, bool)
	// HasClaims returns true if the extra data contains a Claims object
	HasClaims() bool
	// GetPolicy returns the Policy object associated with the extra data,if Policy exists
	GetPolicy() (Policy, bool)
	// HasPolicy returns true if the extra data contains a Policy object
	HasPolicy() bool
}

type ExtraPolicy struct {
	// Policy is the underlying-registered policy.
	Policy Policy
	// Extra is the additional metadata associated with the policy.
	Extra Extra
}

type Policy interface {
	// GetSubject returns the subject of the casbin policy
	GetSubject() string
	// GetObject returns the object of the casbin policy
	GetObject() string
	// GetAction returns the action of the casbin policy
	GetAction() string
	// GetDomain returns the domain of the casbin policy
	GetDomain() string
	// GetRoles returns a list of roles for the user
	GetRoles() []string
	// GetPermissions returns a list of permissions for the user
	GetPermissions() []string
}

type PolicyMap map[string]any

type PolicyParser func(ctx context.Context, claims Claims) (Policy, error)

type PolicyRegistry interface {
	// AddPolicy adds a policy for a given subject, object, action, domain
	AddPolicy(sec string, pt string, rule []string) error
	// RemovePolicy removes a policy for a given subject, object, action, domain
	RemovePolicy(sec string, pt string, rule []string) error
	// SetRoles Set the role for a given context
	SetRoles(ctx context.Context, roles RoleMap) error
	// SetPolicies sets the policies for a given context
	SetPolicies(ctx context.Context, policies PolicyMap) error
	// SetPolicyRoles sets the policies for a given context.
	// It takes a context, a map of policies, and a map of roles as input.
	// It returns an error if the policies cannot be set.
	SetPolicyRoles(ctx context.Context, policies PolicyMap, roles RoleMap) error
}

type RefreshTokenizer interface {
	Tokenizer
	// CreateRefreshClaims creates a new identity claims specifically for a refresh token.
	CreateRefreshClaims(context.Context, string) (Claims, error)
}

type RegisteredClaims struct {
	ID         string          `json:"jti,omitempty"`
	Subject    string          `json:"sub,omitempty"`
	Issuer     string          `json:"iss,omitempty"`
	Audience   []string        `json:"aud,omitempty"`
	Expiration int64           `json:"exp,omitempty"`
	NotBefore  int64           `json:"nbf,omitempty"`
	IssuedAt   int64           `json:"iat,omitempty"`
	Scopes     map[string]bool `json:"scopes,omitempty"`
}

type RegisteredPolicy struct {
	Subject     string   `json:"subject"`     // The subject of the policy.
	Object      string   `json:"object"`      // The object of the policy.
	Action      string   `json:"action"`      // The action of the policy.
	Domain      string   `json:"domain"`      // The domain of the policy.
	Roles       []string `json:"roles"`       // The roles associated with the policy.
	Permissions []string `json:"permissions"` // The permissions associated with the policy.
}

type RoleMap map[string]any

type Scheme int

type Security interface {
	Authenticator
	Authorizer
}

type Serializer interface {
	// Serialize serializes the given data into a byte slice
	Serialize(ctx context.Context, data Claims) ([]byte, error)
	// Deserialize deserializes the given byte slice into the given data
	Deserialize(ctx context.Context, data []byte) (Claims, error)
}

type TokenSource int

type Tokenizer interface {
	// CreateClaims creates a new identity claims.
	CreateClaims(context.Context, string) (Claims, error)
	// CreateToken inject user claims into token string.
	CreateToken(context.Context, Claims) (string, error)
	// ParseClaims parses a token string and returns the Claims.
	ParseClaims(context.Context, string) (Claims, error)
	// Validate validates if a token is valid.
	Validate(context.Context, string) (bool, error)
}

type UnimplementedClaims struct {
}

type UnimplementedPolicy struct {
}