security

type BasicConfig struct {
	InactivityInterval string `yaml:"inactivity_interval"`
	ExpirationInterval string `yaml:"expiration_interval"`
}

type CasConfig struct {
	InactivityInterval string `yaml:"inactivity_interval"`
	ExpirationInterval string `yaml:"expiration_interval"`
	Title              string `yaml:"title"`
	LoginUrl           string `yaml:"login_url"`
	ValidateUrl        string `yaml:"validate_url"`
	DefaultRole        string `yaml:"default_role"`
}

type Config struct {
	Security struct {
		AuthProviders []string     `yaml:"auth_providers"`
		Basic         BasicConfig  `yaml:"basic"`
		Ldap          LdapConfig   `yaml:"ldap"`
		Cas           CasConfig    `yaml:"cas"`
		Saml          SamlConfig   `yaml:"saml"`
		OAuth2        OAuth2Config `yaml:"oauth2"`
	} `yaml:"security"`
}

type Enforcer interface {
	Enforce(rvals ...interface{}) (bool, error)
	StartAutoLoadPolicy(context.Context, time.Duration)
	LoadPolicy() error
	GetRolesForUser(name string, domain ...string) ([]string, error)
	GetPermissionsForUser(user string, domain ...string) ([][]string, error)
	HasPermissionForUser(user string, permission ...string) (bool, error)
}

type HttpProvider interface {
	Auth(*http.Request) (*User, error, bool)
}

type LdapConfig struct {
	InactivityInterval string            `yaml:"inactivity_interval"`
	ExpirationInterval string            `yaml:"expiration_interval"`
	Url                string            `yaml:"url"`
	AdminUsername      string            `yaml:"admin_dn"`
	AdminPassword      string            `yaml:"admin_passwd"`
	BaseDN             string            `yaml:"user_dn"`
	Attributes         map[string]string `yaml:"attrs"`
	UsernameAttr       string            `yaml:"username_attr"`
	Filter             string            `yaml:"ufilter"`
	DefaultRole        string            `yaml:"default_role"`
	InsecureSkipVerify bool              `yaml:"insecure_skip_verify"`
	MinTLSVersion      string            `yaml:"min_tls_ver"`
	MaxTLSVersion      string            `yaml:"max_tls_ver"`
}

type OAuth2Config struct {
	Providers map[string]OAuth2ProviderConfig `yaml:"providers"`
}

type OAuth2ProviderConfig struct {
	InactivityInterval string            `yaml:"inactivity_interval"`
	ExpirationInterval string            `yaml:"expiration_interval"`
	Issuer             string            `yaml:"issuer"`
	ClientID           string            `yaml:"client_id"`
	ClientSecret       string            `yaml:"client_secret"`
	RedirectURL        string            `yaml:"redirect_url"`
	DefaultRole        string            `yaml:"default_role"`
	AllowExtraRoles    bool              `yaml:"allow_extra_roles"`
	AuthURL            string            `yaml:"auth_url"`
	TokenURL           string            `yaml:"token_url"`
	UserURL            string            `yaml:"user_url"`
	UserID             string            `yaml:"user_id"`
	Scopes             []string          `yaml:"scopes"`
	AttributesMap      map[string]string `yaml:"attributes_map"`
	OpenID             bool              `yaml:"open_id"`
	PKCE               bool              `yaml:"pkce"`
}

type Provider interface {
	GetName() string
	Auth(ctx context.Context, username, password string) (*User, error)
}

type RoleProvider interface {
	// GetValidRoleIDs checks if potentialRoles slice contains valid role names and returns at least one valid role ID.
	// If no roles found, then it check if default role is valid and returns its ID. Return ErrDefaultRoleNotFound error if default role not found.
	GetValidRoleIDs(ctx context.Context, potentialRoles []string, defaultRole string) ([]string, error)
	// GetRoleID returns role ID by role name.
	GetRoleID(ctx context.Context, name string) (string, error)
}

type SamlConfig struct {
	InactivityInterval      string            `yaml:"inactivity_interval"`
	ExpirationInterval      string            `yaml:"expiration_interval"`
	Title                   string            `yaml:"title"`
	X509Cert                string            `yaml:"x509_cert"`
	X509Key                 string            `yaml:"x509_key"`
	IdPMetadataUrl          string            `yaml:"idp_metadata_url"`
	IdPMetadataXml          string            `yaml:"idp_metadata_xml"`
	IdPAttributesMap        map[string]string `yaml:"idp_attributes_map"`
	CanopsisSamlUrl         string            `yaml:"canopsis_saml_url"`
	DefaultRole             string            `yaml:"default_role"`
	InsecureSkipVerify      bool              `yaml:"insecure_skip_verify"`
	CanopsisSSOBinding      string            `yaml:"canopsis_sso_binding"`
	CanopsisACSBinding      string            `yaml:"canopsis_acs_binding"`
	SignAuthRequest         bool              `yaml:"sign_auth_request"`
	NameIdFormat            string            `yaml:"name_id_format"`
	SkipSignatureValidation bool              `yaml:"skip_signature_validation"`
	ACSIndex                *int              `yaml:"acs_index"`
	AutoUserRegistration    bool              `yaml:"auto_user_registration"`
	AllowExtraRoles         bool              `yaml:"allow_extra_roles"`
}

type TokenProvider interface {
	Auth(ctx context.Context, token string) (*User, error)
}

type User struct {
	ID             string   `bson:"_id"`
	Name           string   `bson:"name"`
	DisplayName    string   `bson:"display_name,omitempty"`
	Firstname      string   `bson:"firstname"`
	Lastname       string   `bson:"lastname"`
	Email          string   `bson:"email"`
	HashedPassword string   `bson:"password,omitempty"`
	AuthApiKey     string   `bson:"authkey"`
	Roles          []string `bson:"roles"`
	Contact        struct {
		Name    string `bson:"name"`
		Address string `bson:"address"`
	} `bson:"contact"`
	IsEnabled  bool   `bson:"enable"`
	ExternalID string `bson:"external_id"`
	Source     string `bson:"source"`

	// IdPRoles field show roles from idp, and they should be used ONLY in idp/canopsis role merging, see SetRolesFromIdP.
	IdPRoles []string `bson:"idp_roles"`
}

type UserProvider interface {
	// FindByUsername returns user with username or nil.
	FindByUsername(ctx context.Context, username string) (*User, error)
	// FindByAuthApiKey returns user with api key or nil.
	FindByAuthApiKey(ctx context.Context, apiKey string) (*User, error)
	// FindByID returns user with ID or nil.
	FindByID(ctx context.Context, id string) (*User, error)
	// FindByExternalSource returns user with ID from source or nil.
	FindByExternalSource(ctx context.Context, externalID, source string) (*User, error)
	// FindWithoutPermission returns users without permission.
	FindWithoutPermission(ctx context.Context, perm string) ([]User, error)
	// Save updates user or inserts user if not exist.
	Save(ctx context.Context, user *User) error
	UpdateHashedPassword(ctx context.Context, id, hash string) error
}