api

type API struct {
	// contains filtered or unexported fields
}

type APIDocPlugin struct {
	Bbasepath string
	Swagger   *spec.Swagger
	Builder   *openapi.Builder
}

type AnonymousAuthenticator struct{}

type AttrbuteResource struct {
	Resource string `json:"resource,omitempty"`
	Name     string `json:"name,omitempty"`
}

type AttributeExtractor func(r *http.Request) (*Attributes, error)

type Attributes struct {
	Action    string             `json:"action,omitempty"`
	Resources []AttrbuteResource `json:"resources,omitempty"`
	Path      string             `json:"path,omitempty"`
}

type AuditExtraMetadata map[string]string

type AuditLog struct {
	SSH *AuditSSH `json:"ssh,omitempty"` // for ssh only
	// request
	Request  AuditRequest  `json:"request,omitempty"`
	Response AuditResponse `json:"response,omitempty"`
	// authz
	Subject string `json:"subject,omitempty"` // username
	// Resource is the resource type, e.g. "pods", "namespaces/default/pods/nginx-xxx"
	// we can detect the resource type and name from the request path.
	// GET  /zoos/{zoo_id}/animals/{animal_id} 	-> get zoos,zoo_id,animals,animal_id
	// GET  /zoos/{zoo_id}/animals 				-> list zoos,zoo_id,animals,animal_id
	// POST /zoos/{zoo_id}/animals:set-free 	-> set-free zoos,zoo_id,animals
	Action       string             `json:"action,omitempty"`       // create, update, delete, get, list, set-free, etc.
	Domain       string             `json:"domain,omitempty"`       // for multi-tenant
	Parents      []AttrbuteResource `json:"parents,omitempty"`      // parent resources, e.g. "zoos/{zoo_id}",
	Resource     string             `json:"resource,omitempty"`     // resource type, e.g. "animals"
	ResourceName string             `json:"resourceName,omitempty"` //  "{animal_id}", or "" if list
	// metadata
	StartTime time.Time          `json:"startTime,omitempty"` // request start time
	EndTime   time.Time          `json:"endTime,omitempty"`   // request end time
	Metadata  AuditExtraMetadata `json:"metadata,omitempty"`  // extra metadata
}

type AuditRequest struct {
	HttpVersion string            `json:"httpVersion,omitempty"` // http version
	Method      string            `json:"method,omitempty"`      // method
	URL         string            `json:"url,omitempty"`         // full url
	Header      map[string]string `json:"header,omitempty"`      // header
	Body        []byte            `json:"body,omitempty"`        // ignore body if size > 1MB or stream.
	ClientIP    string            `json:"clientIP,omitempty"`    // client ip
	RemoteAddr  string            `json:"remoteAddr,omitempty"`
	LocalAddr   string            `json:"localAddr,omitempty"`
}

type AuditResponse struct {
	StatusCode   int               `json:"statusCode,omitempty"`   // status code
	Header       map[string]string `json:"header,omitempty"`       // header
	ResponseBody []byte            `json:"responseBody,omitempty"` // ignore body if size > 1MB or stream.
}

type AuditSSH struct {
	User          string   `json:"user,omitempty"`
	RemoteAddr    string   `json:"remoteAddr,omitempty"`
	LocalAddr     string   `json:"localAddr,omitempty"`
	SessionID     string   `json:"sessionID,omitempty"`
	ClientVersion string   `json:"clientVersion,omitempty"`
	ServerVersion string   `json:"serverVersion,omitempty"`
	PublicKey     string   `json:"publicKey,omitempty"`
	Command       string   `json:"command,omitempty"`
	Env           []string `json:"env,omitempty"`
}

type AuditSink interface {
	Save(log *AuditLog) error
}

type Auditor interface {
	OnRequest(w http.ResponseWriter, r *http.Request) (http.ResponseWriter, *AuditLog)
	OnResponse(w http.ResponseWriter, r *http.Request, auditlog *AuditLog)
}

type AuthenticateErrorHandleFunc func(w http.ResponseWriter, r *http.Request, err error)

type AuthenticateFunc func(w http.ResponseWriter, r *http.Request) (*AuthenticateInfo, error)

type AuthenticateInfo struct {
	// Audiences is the set of audiences the authenticator was able to validate
	// the token against. If the authenticator is not audience aware, this field
	// will be empty.
	Audiences []string
	// User is the UserInfo associated with the authentication context.
	User UserInfo
}

type AuthenticatorChain []TokenAuthenticator

type Authorizer interface {
	Authorize(ctx context.Context, user UserInfo, a Attributes) (authorized Decision, reason string, err error)
}

type AuthorizerChain []Authorizer

type AuthorizerFunc func(ctx context.Context, user UserInfo, a Attributes) (authorized Decision, reason string, err error)

type CachedAuditSink struct {
	// contains filtered or unexported fields
}

type CachedBody struct {
	// contains filtered or unexported fields
}

type CompresseWriter struct {
	http.ResponseWriter
	// contains filtered or unexported fields
}

type ContextKey string

type Decision int

type Filter interface {
	Process(w http.ResponseWriter, r *http.Request, next http.Handler)
}

type FilterFunc func(w http.ResponseWriter, r *http.Request, next http.Handler)

type Filters []Filter

type Group struct {
	Path      string
	Filters   Filters
	Tags      []string
	Params    []Param // common params apply to all routes in the group
	Routes    []Route
	SubGroups []Group // sub groups
	Consumes  []string
	Produces  []string
}

type HTTPAuthenticateFunc func(ctx context.Context, r *http.Request) (*AuthenticateInfo, error)

type HTTPAuthenticator interface {
	Authenticate(ctx context.Context, r *http.Request) (*AuthenticateInfo, error)
}

type HealthCheckPlugin struct {
	NoopPlugin
	CheckFun func() error
}

type LRUCache[T any] struct {
	// contains filtered or unexported fields
}

type LRUCacheAuthenticator struct {
	Authenticator TokenAuthenticator
	Cache         LRUCache[*AuthenticateInfo]
}

type LRUCacheAuthorizer struct {
	Authorizer Authorizer
	// contains filtered or unexported fields
}

type LRUCacheSSHAuthenticator struct {
	Authenticator SSHAuthenticator
	Cache         LRUCache[*AuthenticateInfo]
}

type LoggerAuditSink struct {
	Sink   AuditSink
	Logger logr.Logger
}

type MethodsHandler map[string]http.Handler

type Mux struct {
	NotFound http.Handler
	Tree     matcher.Node[MethodsHandler]
}

type NoopPlugin struct{}

type OIDCAuthenticator struct {
	Verifier               *oidc.IDTokenVerifier
	UsernameClaimCandidate []string
	EmailClaimCandidate    []string
	GroupsClaimCandidate   []string
	EmailToUsername        func(email string) string
}

type OIDCOptions struct {
	Issuer   string `json:"issuer" description:"oidc issuer url"`
	Insecure bool   `json:"insecure" description:"skip issuer and audience verification"`

	// ClientID is the OAuth2 client ID for this server.
	ClientID string `json:"clientID" description:"oidc client id"`

	// ClientSecret is the secret for the client ID. If no secret is provided,
	// the client is assumed to be a public client and authentication will
	// proceed without a client secret.
	ClientSecret string `json:"clientSecret" description:"oidc client secret"`

	// Scopes is the set of scopes to request.
	Scope []string `json:"scope" description:"oidc scope"`
}

type OpenTelemetryPlugin struct {
	TraceProvider trace.TracerProvider
}

type Param struct {
	Name        string
	Kind        ParamKind
	Type        string
	Enum        []any
	Default     any
	IsOptional  bool
	Description string
	Example     any
	Pattern     string
}

type ParamKind string

type Plugin interface {
	Install(m *API) error
	OnRoute(route *Route) error
}

type PredicatedFilter struct {
	Predicate func(r *http.Request) bool
	Filter    Filter
}

type RequestAuthorizer interface {
	AuthorizeRequest(r *http.Request) (Decision, string, error)
}

type RequestAuthorizerFunc func(r *http.Request) (Decision, string, error)

type ResponseInfo struct {
	Code        int
	Headers     map[string]string
	Body        interface{}
	Description string
}

type Route struct {
	Summary    string
	Path       string
	Method     string
	Deprecated bool
	Handler    http.Handler
	Filters    Filters
	Tags       []string
	Consumes   []string
	Produces   []string
	Params     []Param
	Responses  []ResponseInfo
	Properties map[string]interface{}
}

type Router interface {
	HandleRoute(route *Route) error
	ServeHTTP(w http.ResponseWriter, r *http.Request)
	SetNotFound(handler http.Handler)
}

type SSHAuthenticator interface {
	UsernamePasswordAuthenticator
	AuthenticatePublibcKey(ctx context.Context, pubkey ssh.PublicKey) (*AuthenticateInfo, error)
}

type SimpleAuditor struct {
	RecordReadBody                bool     // Record read actions
	RecordRequestBodyContentTypes []string // Record only for these content types
	MaxBodySize                   int      // Max body size to record,0 means disable
	WhiteList                     []string // White list
}

type StatusResponseWriter struct {
	Inner        http.ResponseWriter
	Code         int
	Cache        []byte
	MaxCacheSize int
}

type TokenAuthenticator interface {
	// Authenticate authenticates the token and returns the authentication info.
	// if can't authenticate, return nil, "reason message", nil
	// if unexpected error, return nil, "", err
	Authenticate(ctx context.Context, token string) (*AuthenticateInfo, error)
}

type UserInfo struct {
	ID            string              `json:"id,omitempty"`
	Name          string              `json:"name,omitempty"`
	Email         string              `json:"email,omitempty"`
	EmailVerified bool                `json:"email_verified,omitempty"`
	Groups        []string            `json:"groups,omitempty"`
	Extra         map[string][]string `json:"extra,omitempty"`
}

type UsernamePasswordAuthenticator interface {
	Authenticate(ctx context.Context, username, password string) (*AuthenticateInfo, error)
}

type VersionPlugin struct {
	NoopPlugin
	Version any
}