extension

type AlwaysSendCSRFHeader struct{}

type AlwaysVerifyCSRF struct{}

type CSRF struct {
	KM KeyManager `inject:"security.keys"`
	// contains filtered or unexported fields
}

type CSRFHeaderSend interface {
	// SendCSRFHeader instructs the CSRF generator to send the CSRF token header
	// along with every request on the specified method.
	SendCSRFHeader() bool
}

type CSRFIgnore interface {
	// IgnoreCSRF instructs the CSRF generator to ignore the entirety of this
	// controller. If this method exists on the controller and returns true,
	// neither validation nor verification will occur.
	IgnoreCSRF() bool
}

type CSRFOptions struct {
	// Key for CSRF token encipherment.
	Key []byte

	// HMAC key for CSRF token validity checks.
	HMAC []byte

	// Namespace for key retrieval.
	//
	// This may be a specific namespace for tokens generated using keys for a
	// particular purpose, "__global__" for the global namespace, or if left
	// uninitialized as the empty string, this will default to the namespace
	// configured by the key management extension.
	Namespace string

	// TokenHeader to use for validating CSRF tokens. Default "X-Csrf-Token" if
	// empty.
	TokenHeader string

	// SendTokenHeader with each response. This can be useful for API endpoints
	SendTokenHeader bool

	// NoTokenHeader disables validating CSRF tokens based upon the TokenHeader
	// value (above) sent as part of a request.
	NoTokenHeader bool

	// FormField instructions the CSRF validator which form field to examine for
	// validation. Default is "csrftoken."
	//
	// This value also controls the hidden field created by
	// csrftoken_hidden_field.
	FormField string

	// EnableFormValidation. By default, this is disabled. Form validation is an
	// opt-in-only feature because it requires the CSRF extension to call
	// Request.ParseForm or Request.ParseMultipartForm. This may have
	// performance implications.
	EnableFormValidation bool

	// CookeName to use for storing CSRF tokens client-side.
	CookieName string

	// CookieSecure, if enabled, forces CSRF token cookies to only be sent if
	// the connection is secure.
	CookieSecure bool

	// CookieSameSite to control SameSite settings. If this is disabled, this
	// will default to Lax. Set this to http.SameSiteNone to disable.
	CookieSameSite http.SameSite

	// InjectedName dictates what string is used to identify the CSRF validator
	// for dependency injection. If this isn't provided, "csrf" is used instead.
	InjectedName string

	// MaxAge after which the token is considered invalid. This defaults to 1
	// month.
	MaxAge time.Duration

	// GracePeriod for expired tokens. If the token exceeds its MaxAge but is
	// still within the confines of the GracePeriod, it will be accepted and
	// regenerated. This defaults to 1 week.
	GracePeriod time.Duration

	// RegenerationThreshold dictates when regeneration should pre-date the
	// MaxAge of the token. If this value is zero, the regeneration threshold
	// will default to 1 week.
	RegenerationThreshold time.Duration

	// Methods considered valid for CSRF checks. Leave this empty to validate
	// DELETE, PATCH, POST, and PUT.
	Methods []string
}

type CSRFRelinquish interface {
	// LetMeFail indicates the controller wishes to handle CSRF failures on its
	// own. Unlike CSRFVerifier, this doesn't bail from the token setup; tokens
	// are still generated (and verified) as needed, but the verification
	// failure is left to the controller.
	LetMeFail() bool
}

type CSRFVerifier interface {
	// VerifyCSRF token (or not) depending on the value of the returned `bool`.
	//
	// If the value returned is `true`, CSRF tokens will *always* be validated
	// for the implementing endpoint. If the value returned is `false`, CSRF
	// tokens will *never* be validated for the implementing endpoint.
	//
	// Tokens will still be generated for endpoints that return VerifyCSRF() ==
	// false; they just won't be validated. To ignore all CSRF activity,
	// implement CSRFIgnore.
	VerifyCSRF() bool
}

type EndpointTelemetryOptions struct {
	Manager     *lib.TelemetryManager
	BindSignals bool
}

type HandlesCSRF struct{}

type IgnoreCSRF struct{}

type Key interface {
	Bytes() []byte
	Created() time.Time
	Expires() time.Time
	IsExpired() bool
	Length() int
	Name() string
	Version() int
}

type KeyManager interface {
	WithKeyRing(namespace, keyring string, fn KeyRingFunc) error

	WithKeyRingTTL(namespace, keyring string, ttl int, fn KeyRingFunc) error

	WithGlobalKeyRing(keyring string, fn KeyRingFunc) error

	WithGlobalKeyRingTTL(keyring string, ttl int, fn KeyRingFunc) error
}

type KeyRing interface {
	// NewKey returns a new key from the current namespace or the global
	// namespace if otherwise unspecified or Namespace() has not been called.
	NewKey(name string, size int) (Key, error)

	// NewKeyPair returns a key pair. This is typically useful for creating
	// cipher and HMAC keys with a single call.
	NewKeyPair(name string, len1, len2 int) (Key, Key, error)
}

type KeyRingFunc func(KeyRing) error

type KeyStarConfig struct {
	Path string
	URI  string
	VFS  vfs.MutableFS
}

type KeyStarExtensionConfig struct {
	// Path for key server VFS config
	Path string

	// URI for keystar accessibility.
	URI string

	// Namespace specifies the default namespace for KeyStar.
	Namespace string

	// CipherKeyLength sets the default key length for cipher keys. If this
	// value is not provided, it will default to 32 (AES-256).
	CipherKeyLength int

	// HMACKeyLength sets the default key length for HMAC generation. If this
	// value is not provided, it will defualt to 64.
	HMACKeyLength int
}

type NeverVerifyCSRF struct{}

type SessionBackend int

type SessionExtensionConfig struct {
	// Backend controls which backend may be configured for session
	// management. If this value isn't set, it defaults to SessionNoopBackend
	// treating sessions as a noop. Note that some values may require additional
	// dependencies. In particular, enabling the cookie backend will require
	// KeyStar.
	//
	// Dependencies are further gated in the compiled binary via build flags.
	Backend SessionBackend

	// CookieOptions configures the session cookie to dispatch to the browser.
	CookieOptions *http.Cookie

	// DSN for backends that require datasource configuration.
	//
	// See the documentation for individual backends for a description of how
	// this is used.
	DSN string

	// Key used to encrypt/decrypt the session data.
	//
	// This value may be used to override the key used during session
	// encryption, such as for unit testing when using known keys.
	Key []byte

	// HMACKey used to sign and verify the session cookie. A key length of 64
	// bytes is recommended as per[1]
	//
	// [1] https://tools.ietf.org/html/rfc4868#section-2.6
	//
	// This value may be used to override the key used during session
	// encryption, such as for unit testing when using known keys.
	HMACKey []byte

	// YesImAbsolutelySureIWantPlainText toggles off cookie encryption if true.
	// This flag should only ever be enabled for debugging or testing.
	//
	// This flag cannot be enabled unless development mode is turned on.
	//
	// Note: Not all backends support encryption.
	//
	// Note: The name of this flag was chosen deliberately for its value as
	// obnoxious and difficult to type without autocompletion. Think twice if
	// you're using it.
	YesImAbsolutelySureIWantPlainText bool
}

type StaticOptions struct {
}

type StaticPath struct {
}

type VFS struct {
}

type Watcher interface {
	AddDir(string)
	AddCallback(watcherCallback)
	Close() error
}

type WebhookTelemetry struct {
	// contains filtered or unexported fields
}