authn

type AccessTokenClaims struct {
	// Namespace takes the form of '<type>-<id>', '*' means all namespaces.
	// Type can be either org or stack.
	Namespace string `json:"namespace"`
	// Access policy scopes
	Scopes []string `json:"scopes"`
	// Grafana roles
	Permissions []string `json:"permissions"`
	// On-behalf-of user
	DelegatedPermissions []string `json:"delegatedPermissions"`
}

type AccessTokenVerifier struct {
	// contains filtered or unexported fields
}

type Claims[T any] struct {
	*jwt.Claims
	Rest T
}

type ExchangeClientOpts func(c *TokenExchangeClient)

type IDTokenClaims struct {
	// Namespace takes the form of '<type>-<id>', '*' means all namespaces.
	// Type can be either org or stack.
	Namespace string `json:"namespace"`
	// AuthenticatedBy is the method used to authenticate the identity.
	AuthenticatedBy string `json:"authenticatedBy"`
	Email           string `json:"email"`
	EmailVerified   string `json:"email_verified"`
}

type IDTokenVerifier struct {
	// contains filtered or unexported fields
}

type NoopVerifier[T any] struct{}

type TokenExchangeClient struct {
	// contains filtered or unexported fields
}

type TokenExchangeConfig struct {
	// Token used to perform the exchange request.
	Token string
	// Url called to perform exhange request.
	TokenExchangeURL string
}

type TokenExchangeRequest struct {
	// Namespace token should be signed with.
	// Use wildcard '*' to create a token for all namespaces.
	Namespace string `json:"namespace"`
	// Audiences token should be signed with.
	Audiences []string `json:"audiences"`
}

type TokenExhangeResponse struct {
	Token string
}

type TokenType = string

type Verifier[T any] interface {
	// Verify will parse and verify provided token using public key from `VerifierConfig.SigningKeysURL`.
	// If `AllowedAudiences` was configured those will be validated as well.
	Verify(ctx context.Context, token string) (*Claims[T], error)
}

type VerifierBase[T any] struct {
	// contains filtered or unexported fields
}

type VerifierConfig struct {
	SigningKeysURL   string       `yaml:"signingKeysUrl"`
	AllowedAudiences jwt.Audience `yaml:"allowedAudiences"`
}