auth

type AuditExtraMetadata map[string]string

type AuditLog struct {
	// request
	Request  AuditRequest  `json:"request"`
	Response AuditResponse `json:"response"`
	// authz
	Subject string `json:"subject"` // username
	// Resource is the resource type, e.g. "pods", "namespaces/default/pods/nginx-xxx"
	// we can detect the resource type and name from the request path.
	// GET  /zoos/{zoo_id}/animals/{animal_id} 	-> get zoos,zoo_id,animals,animal_id
	// GET  /zoos/{zoo_id}/animals 				-> list zoos,zoo_id,animals,animal_id
	// POST /zoos/{zoo_id}/animals:set-free 	-> set-free zoos,zoo_id,animals
	Action   string           `json:"action"`   // create, update, delete, get, list, set-free, etc.
	Domain   string           `json:"domain"`   // for multi-tenant
	Parents  []ParentResource `json:"parents"`  // parent resources, e.g. "zoos/{zoo_id}",
	Resource string           `json:"resource"` // resource type, e.g. "animals"
	Name     string           `json:"name"`     //  "{animal_id}", or "" if list
	// metadata
	StartTime time.Time          `json:"startTime"` // request start time
	EndTime   time.Time          `json:"endTime"`   // request end time
	Metadata  AuditExtraMetadata `json:"metadata"`  // extra metadata
}

type AuditOptions struct {
	RecordRead             bool     // Record read actions
	RecordBodyContentTypes []string // Record only for these content types
	MaxBodySize            int      // Max body size to record,0 means disable
}

type AuditRequest struct {
	HttpVersion string            `json:"httpVersion"` // http version
	Method      string            `json:"method"`      // method
	URL         string            `json:"url"`         // full url
	Header      map[string]string `json:"header"`      // header
	Body        []byte            `json:"body"`        // ignore body if size > 1MB or stream.
	ClientIP    string            `json:"clientIP"`    // client ip
}

type AuditResponse struct {
	StatusCode   int               `json:"statusCode"`   // status code
	Header       map[string]string `json:"header"`       // header
	ResponseBody []byte            `json:"responseBody"` // ignore body if size > 1MB or stream.
}

type AuditSink interface {
	Save(log *AuditLog) error
}

type AuthorizationManager interface {
	Roles() SimpleOperation
	RoleAuthorities() SimpleOperation
	UserRoles() SimpleOperation
}

type CachedAuditSink struct {
	// contains filtered or unexported fields
}

type CachedBody struct {
	// contains filtered or unexported fields
}

type CasbinPermissionChecker struct {
	// contains filtered or unexported fields
}

type HTTPAuditor interface {
	// Request is called on request stage, it returns the audit log and a wrapped response writer (if needed)
	OnRequest(w http.ResponseWriter, r *http.Request) (http.ResponseWriter, *AuditLog)
	// OnResponse is called on response stage, it passes the audit log and response writer produced by OnRequest
	OnResponse(w http.ResponseWriter, r *http.Request, auditlog *AuditLog)
}

type MiddlewareFunc func(http.Handler) http.Handler

type OIDCOptions struct {
	Issuer   string `json:"issuer" description:"oidc issuer url"`
	Insecure bool   `json:"insecure" description:"skip issuer and audience verification (optional)"`
	Audience string `json:"audience" description:"oidc resource server audience (optional)"`
}

type ParentResource struct {
	Resource string `json:"resource,omitempty"`
	Name     string `json:"name,omitempty"`
}

type PathRewriteMatcher func(string) (string, bool)

type PermissionAction string

type PermissionChecker interface {

	// HasPermission("alice", PermissionFromMethodPath("GET","/regions"))
	// HasPermission("alice", "regions:read")
	HasPermission(subject string, perm string) (bool, error)
}

type SimpleAuditor struct {
	Prefix  string // api prefix, e.g. /api/v1
	Options *AuditOptions
}

type SimpleOperation interface {
	Add(name string, values ...string) error
	Remove(name string, values ...string) error
	Set(name string, values ...string) error
	Get(name string) []string
	List() map[string][]string
}

type StatusResponseWriter struct {
	Inner http.ResponseWriter
	Code  int
	Cache []byte
	// contains filtered or unexported fields
}

type SubjectExtractor func(r *http.Request) string

type TokenClaims map[string]any

type TokenVerify interface {
	Verify(ctx context.Context, token string) (TokenClaims, error)
}

type TokenVerifyFunc func(ctx context.Context, token string) (TokenClaims, error)