ohauth

type Authenticator interface {
	Verify(sig string, client *Client) (*TokenClaims, error)
	AuthenticateCredentials(username, password string, client *Client) (*TokenClaims, error)
	AuthenticateRequest(r *http.Request, client *Client) (*TokenClaims, error)
}

type Authorization struct {
	CID     string    `json:"cid"`
	UID     string    `json:"uid"`
	Scope   Scope     `json:"scope"`
	Active  bool      `json:"active"`
	Created time.Time `json:"created"`
}

type Client struct {
	ID          string `json:"id"`
	DisplayName string `json:"displayName"`
	Secret      string `json:"secret"`

	// GrantType defines the allowed flow the client may use
	GrantType   string     `json:"grantType"`
	RedirectURI *StrictURL `json:"redirectURI"`
	Scope       Scope      `json:"scope"`
	Status      string     `json:"status"`
	Created     time.Time  `json:"created"`

	// Keys are used with a Tokenizer to sign and verify codes and tokens
	Keys *ClientKeys `json:"keys"`
}

type ClientKeys struct {
	Sign   []byte `json:"sign"`
	Verify []byte `json:"verify"`
}

type Error struct {
	Code        string `json:"error"`
	Description string `json:"error_description,omitempty"`
}

type Issuer interface {
	// ExpiryForToken returns the expiry duration for token issued under a
	// specified grant type
	ExpiryForToken(grantType string) time.Duration
	// ExpiryForCode returns the expiry duration for codes issued with the
	// Authorization Code grant type
	ExpiryForCode() time.Duration
	// ScopePermitted determines if a scope can be issued under a certain grant
	// type
	ScopePermitted(scope Scope, grantType string) bool
}

type Provider struct {
	// Authorization and Authentication endpoints
	URL *StrictURL
	// Authenticator is used for to parse sessions and authenticate via password grants
	Authenticator Authenticator
	// Data store for clients and tokens
	Store Store
	// Tokenizer is required to generate code, id, access and refresh tokens
	Tokenizer Tokenizer
	// Issuer is used to determine claim values when issuing tokens
	Issuer Issuer
}

type Scope map[string]bool

type Store interface {
	// CreateClient stores a client
	CreateClient(*Client) error
	// FetchClient retrieves a client by its id
	FetchClient(cid string) (*Client, error)
	// DeleteClient deletes a client by its id
	DeleteClient(cid string) error

	// BlacklistToken invalidate codes and tokens using a token ID
	BlacklistToken(id string) error
	// TokenBlacklisted is used to check if a code or token is invalidated
	TokenBlacklisted(id string) (bool, error)

	// StoreAuthorization records a resource owner's authorisation of a client
	StoreAuthorization(a *Authorization) error
	// FetchAuthorization retrieves an Authorization record
	FetchAuthorization(cid string, sub string) (*Authorization, error)
}

type StrictURL url.URL

type TestingStore struct {
	*sync.Mutex
	// contains filtered or unexported fields
}

type TokenClaims struct {
	ID       string `json:"jti"`
	Role     string `json:"role"`
	Audience string `json:"aud"`
	Expires  int64  `json:"exp"`
	Issued   int64  `json:"iat"`
	Issuer   string `json:"iss"`
	Subject  string `json:"sub"`
	Grant    string `json:"grant"`
	Scope    Scope  `json:"scope,omitempty"`
	Nonce    string `json:"nonce,omitempty"`
}

type Tokenizer interface {
	// Tokenize converts TokenClaims into a signed string using a signing key
	Tokenize(tc *TokenClaims, signingKey []byte) (string, error)
	// Parse takes a signed token string, verifies its authenticity and returns
	// the TokenClaims it carries
	Parse(token string, verifyKey []byte) (*TokenClaims, error)
}