auth

type AuthConfigCleaner interface {
	// Clean is used to give the different auth configs chance to clean up anything internal to that config
	Clean(context.Context) error
}

type AuthConfigEvaluator interface {
	Call(AuthPipeline, context.Context) (interface{}, error)
}

type AuthCredential struct {
	KeySelector string `yaml:"keySelector"`
	In          string `yaml:"in"`
}

type AuthCredentials interface {
	GetCredentialsFromReq(*envoy_auth.AttributeContext_HttpRequest) (string, error)
	GetCredentialsKeySelector() string
	GetCredentialsIn() string
	BuildRequestWithCredentials(ctx context.Context, endpoint string, method string, credentialValue string, body io.Reader) (*http.Request, error)
}

type AuthPipeline interface {
	Evaluate() AuthResult
	GetRequest() *envoy_auth.CheckRequest
	GetHttp() *envoy_auth.AttributeContext_HttpRequest
	GetAPI() interface{}
	GetResolvedIdentity() (interface{}, interface{})
	GetAuthorizationJSON() string
}

type AuthResult struct {
	// Code is gRPC response code to the auth check
	Code rpc.Code `json:"code,omitempty"`
	// Status is HTTP status code to override the default mapping between gRPC response codes and HTTP status messages
	// for auth
	Status envoy_type.StatusCode `json:"status,omitempty"`
	// Message is X-Ext-Auth-Reason message returned in an injected HTTP response header, to explain the reason of the
	// auth check result
	Message string `json:"message,omitempty"`
	// Headers are other HTTP headers to inject in the response
	Headers []map[string]string `json:"headers,omitempty"`
	// Metadata are Envoy dynamic metadata content
	Metadata map[string]interface{} `json:"metadata,omitempty"`
	// Body in the response of the request
	// auth check result
	Body string `json:"body,omitempty"`
}

type ConditionalEvaluator interface {
	GetConditions() jsonexp.Expression
}

type IdentityConfigEvaluator interface {
	GetAuthCredentials() AuthCredentials
	GetOIDC() interface{}
	ResolveExtendedProperties(AuthPipeline) (interface{}, error)
}

type K8sSecretBasedIdentityConfigEvaluator interface {
	GetK8sSecretLabelSelectors() labels.Selector
	AddK8sSecretBasedIdentity(context.Context, v1.Secret)
	RevokeK8sSecretBasedIdentity(context.Context, types.NamespacedName)
}

type NamedEvaluator interface {
	GetName() string
}

type Prioritizable interface {
	GetPriority() int
}

type ResponseConfigEvaluator interface {
	NamedEvaluator
	GetWristbandIssuer() WristbandIssuer
}

type TypedEvaluator interface {
	GetType() string
}

type WristbandIssuer interface {
	AuthConfigEvaluator
	GetIssuer() string
	OpenIDConfig() (string, error)
	JWKS() (string, error)
}