core

type Authorization struct {
	// Scopes are the list of scopes this session was granted
	Scopes []string
	// ACR is the Authentication Context Class Reference the session was
	// authenticated with
	ACR string
	// AMR are the Authentication Methods Reference the session was
	// authenticated with
	AMR []string
}

type AuthorizationRequest struct {
	// SessionID that was generated for this session. This should be tracked
	// throughout the authentication process
	SessionID string
	// ACRValues are the authentication context class reference values the
	// caller requested
	//
	// https://openid.net/specs/openid-connect-core-1_0.html#acrSemantics
	ACRValues []string
	// Scopes that have been requested
	Scopes []string
	// ClientID that started this request
	ClientID string
}

type ClientSource interface {
	// IsValidClientID should return true if the passed client ID is valid
	IsValidClientID(clientID string) (ok bool, err error)
	// IsUnauthenticatedClient is used to check if the client should be required
	// to pass a client secret. If not, this will not be checked
	IsUnauthenticatedClient(clientID string) (ok bool, err error)
	// ValidateClientSecret should confirm if the passed secret is valid for the
	// given client
	ValidateClientSecret(clientID, clientSecret string) (ok bool, err error)
	// ValidateRedirectURI should confirm if the given redirect is valid for the client. It should
	// compare as per https://tools.ietf.org/html/rfc3986#section-6
	ValidateClientRedirectURI(clientID, redirectURI string) (ok bool, err error)
}

type Config struct {
	// AuthValidityTime is the maximum time an authorization flow/AuthID is
	// valid. This is the time from Starting to Finishing the authorization. The
	// optimal time here will be application specific, and should encompass how
	// long the app expects a user to complete the "upstream" authorization
	// process.
	AuthValidityTime time.Duration
	// CodeValidityTime is the maximum time the authorization code is valid,
	// before it is exchanged for a token (code flow). This should be a short
	// value, as the exhange should generally not take long
	CodeValidityTime time.Duration
}

type GrantType string

type OIDC struct {
	// contains filtered or unexported fields
}

type Session interface {
	// GetID returns the unique identifier for tracking this session.
	ID() string
	// Expiry returns the time this session expires. Implementations
	// should garbage collect expired sessions, as this implementation doesn't
	Expiry() time.Time
}

type SessionManager interface {
	// NewID should return a new, unique identifier to be used for a session. It
	// should be hard to guess/brute force
	NewID() string
	// GetSession should return the current session state for the given session
	// ID. It should be deserialized/written in to into. If the session does not
	// exist, found should be false with no error.
	GetSession(ctx context.Context, sessionID string, into Session) (found bool, err error)
	// PutSession should persist the new state of the session
	PutSession(context.Context, Session) error
	// DeleteSession should remove the corresponding session.
	DeleteSession(ctx context.Context, sessionID string) error
}

type Signer interface {
	// SignerAlg returns the algorithm the signer uses
	SignerAlg(ctx context.Context) (jose.SignatureAlgorithm, error)
	// Sign the provided data
	Sign(ctx context.Context, data []byte) (signed []byte, err error)
	// VerifySignature verifies the signature given token against the current signers
	VerifySignature(ctx context.Context, jwt string) (payload []byte, err error)
}

type TokenRequest struct {
	// SessionID of the session this request corresponds to
	SessionID string
	// ClientID of the client this session is bound to.
	ClientID string
	// Authorization information this session was authorized with
	Authorization Authorization
	// GrantType indicates the grant that was requested for this invocation of
	// the token endpoint
	GrantType GrantType
	// SessionRefreshable is true if the offline_access scope was permitted for
	// the user, i.e this session should issue refresh tokens
	SessionRefreshable bool
	// IsRefresh is true if the token endpoint was called with the refresh token
	// grant (i.e called with a refresh, rather than access token)
	IsRefresh bool
	// Nonce from the authentication request, if specified
	Nonce string
	// AuthTime Time when the End-User authentication occurred
	AuthTime time.Time
	// contains filtered or unexported fields
}

type TokenResponse struct {
	// IssueRefreshToken indicates if we should issue a refresh token.
	IssueRefreshToken bool

	// IDToken is returned as the id_token for the request to this endpoint. It
	// is up to the application to store _all_ the desired information in the
	// token correctly, and to obey the OIDC spec. The handler will make no
	// changes to this token.
	IDToken oidc.Claims

	// AccessTokenValidUntil indicates how long the returned authorization token
	// should be valid for.
	AccessTokenValidUntil time.Time
	// RefreshTokenValidUntil indicates how long the returned refresh token should
	// be valid for, assuming one is issued.
	RefreshTokenValidUntil time.Time
}

type UserinfoRequest struct {
	// SessionID of the session this request is for.
	SessionID string
}