jwt

type Actor struct {
	// set by service
	ID         string `json:"id"`
	Admin      bool   `json:"admin,omitempty"`
	SuperAdmin bool   `json:"super_admin,omitempty"`
	// set by client
	IP         string                 `json:"ip,omitempty"`
	Email      string                 `json:"email,omitempty"`
	Attributes map[string]interface{} `json:"attrs,omitempty"`
	Role       string                 `json:"role,omitempty"`
}

type AuthProxyClaims struct {
	jwt.RegisteredClaims

	// Actor is the entity taking the action. Specifying the full actor here (versus just the ID in the subject)
	// implies that the actor should be upserted into the system as specified versus only working against a previous
	// actor configured in the system.
	Actor *Actor `json:"actor,omitempty"`

	// SessionOnly implies this token is only valid within the context of an existing session.
	SessionOnly bool `json:"sess_only,omitempty"`

	// SelfSigned indicates this token is signed with the GlobalAESKey. This mean that that AuthProxy has signed
	// this token to itself for auth transfer between services, a token used in session, etc.
	SelfSigned bool `json:"self_signed,omitempty"`

	// Nonce is a one-time-use value. Adding a nonce to the JWT make it a one-time-use for auth purposes. If you use
	// a nonce, the JWT must also have an expiry so that tracking of the nonce values do not need to be kept forever.
	Nonce *uuid.UUID `json:"nonce,omitempty"`
}

type ClaimsBuilder interface {
	WithIssuer(issuer string) ClaimsBuilder
	WithAudience(audience string) ClaimsBuilder    // Specifies the audience of the claims; normally a service id
	WithAudiences(audience []string) ClaimsBuilder // Specifies the service that is intended to consume the claims. Communicated as aud.
	WithServiceId(serviceId config.ServiceId) ClaimsBuilder
	WithServiceIds(serviceIds []config.ServiceId) ClaimsBuilder
	WithExpiration(expiration time.Time) ClaimsBuilder
	WithExpiresIn(expiresIn time.Duration) ClaimsBuilder
	WithExpiresInCtx(ctx context.Context, expiresIn time.Duration) ClaimsBuilder
	WithSuperAdmin() ClaimsBuilder
	WithAdmin() ClaimsBuilder
	WithSelfSigned() ClaimsBuilder
	WithActorEmail(email string) ClaimsBuilder
	WithActorId(id string) ClaimsBuilder
	WithActor(actor *Actor) ClaimsBuilder
	WithSessionOnly() ClaimsBuilder
	WithNonce() ClaimsBuilder
	BuildCtx(context.Context) (*AuthProxyClaims, error)
	Build() (*AuthProxyClaims, error)
	MustBuild() AuthProxyClaims
	MustBuildCtx(context.Context) AuthProxyClaims
}

type KeySelector func(ctx context.Context, unverified *AuthProxyClaims) (kd config.KeyData, isShared bool, err error)

type ParserBuilder interface {

	// WithKeySelector specifies a key selector function to dynamically load a key based on the unverified, parsed
	// JWT. This is useful for cases where the key used can vary based on the token issued.
	WithKeySelector(KeySelector) ParserBuilder

	// WithConfigKey specifies the key to be used for parsing as a config value. Key can be either secret or public.
	WithConfigKey(ctx context.Context, cfgKey config.Key) ParserBuilder

	// WithPublicKeyPath specifies the public key as a file path.
	WithPublicKeyPath(string) ParserBuilder

	// WithPublicKeyString specifies the public key as an explicit string value.
	WithPublicKeyString(string) ParserBuilder

	// WithPublicKey sets the public key using the provided byte slice.
	WithPublicKey([]byte) ParserBuilder

	// WithSharedKeyPath sets the shared (aka secret) key using the file path provided.
	WithSharedKeyPath(string) ParserBuilder

	// WithSharedKeyString sets the shared (aka secret) key for the parser using a string.
	WithSharedKeyString(string) ParserBuilder

	// WithSharedKey sets the shared (aka secret) key for the JWT parser using the provided byte slice.
	WithSharedKey([]byte) ParserBuilder

	ParseCtx(context.Context, string) (*AuthProxyClaims, error)
	Parse(string) (*AuthProxyClaims, error)
	MustParseCtx(context.Context, string) AuthProxyClaims
	MustParse(string) AuthProxyClaims
}

type Signer interface {
	SignAuthHeader(req *http.Request)
	SignRestyRequest(req *resty.Request) *resty.Request
}

type TokenBuilder interface {
	// WithClaims allows the claims to be specified explicitly instead of built progressively
	WithClaims(c *AuthProxyClaims) TokenBuilder

	WithIssuer(issuer string) TokenBuilder
	WithAudience(audience string) TokenBuilder             // Specifies the audience of the claims; normally a service id
	WithServiceId(serviceId config.ServiceId) TokenBuilder // Specifies the service that is intended to consume the claims. Communicated as aud.
	WithServiceIds(serviceId []config.ServiceId) TokenBuilder
	WithExpiration(expiration time.Time) TokenBuilder
	WithExpiresIn(expiresIn time.Duration) TokenBuilder
	WithExpiresInCtx(ctx context.Context, expiresIn time.Duration) TokenBuilder
	WithSuperAdmin() TokenBuilder
	WithAdmin() TokenBuilder
	WithSelfSigned() TokenBuilder
	WithActorEmail(email string) TokenBuilder
	WithActorId(id string) TokenBuilder
	WithActor(actor *Actor) TokenBuilder
	WithSessionOnly() TokenBuilder
	WithNonce() TokenBuilder

	WithConfigKey(ctx context.Context, cfgKey config.Key) (TokenBuilder, error)
	WithSecretConfigKeyData(ctx context.Context, cfgKeyData config.KeyData) (TokenBuilder, error)
	WithPrivateKeyPath(string) TokenBuilder
	WithPrivateKeyString(string) TokenBuilder
	WithPrivateKey([]byte) TokenBuilder
	WithSecretKeyPath(string) TokenBuilder
	WithSecretKeyString(string) TokenBuilder
	WithSecretKey([]byte) TokenBuilder

	TokenCtx(context.Context) (string, error)
	Token() (string, error)
	MustTokenCtx(context.Context) string
	MustToken() string

	Signer() (Signer, error)
	SignerCtx(context.Context) (Signer, error)
	MustSigner() Signer
	MustSignerCtx(context.Context) Signer
}