oauth

type Address struct {

	// Country name component.
	Country *string `json:"country,omitempty"`

	// Full mailing address, formatted for display or use on a mailing label. This field MAY contain multiple lines, separated by newlines.
	// Newlines can be represented either as a carriage return/line feed pair ("\r\n") or as a single line feed character ("\n").
	//
	Formatted *string `json:"formatted,omitempty"`

	// City or locality component.
	Locality *string `json:"locality,omitempty"`

	// Zip code or postal code component.
	PostalCode *string `json:"postal_code,omitempty"`

	// State, province, prefecture, or region component.
	Region *string `json:"region,omitempty"`

	// Full street address component, which MAY include house number, street name, Post Office Box, and multi-line extended street address
	// information. This field MAY contain multiple lines, separated by newlines. Newlines can be represented either as a carriage return/line
	// feed pair ("\r\n") or as a single line feed character ("\n").
	//
	StreetAddress *string `json:"street_address,omitempty"`
}

type Application struct {

	// allowed grants
	AllowedGrants PermissionSet `json:"allowed_grants,omitempty"`

	// app uris
	AppUris PermissionSet `json:"app_uris,omitempty"`

	// The application client id used for oauth grants
	// Read Only: true
	ClientID string `json:"client_id,omitempty"`

	// The application client secret used for oauth grants
	// Read Only: true
	ClientSecret string `json:"client_secret,omitempty"`

	// The application description
	Description *string `json:"description,omitempty"`

	// The application name
	Name string `json:"name,omitempty"`

	// permissions
	Permissions PermissionSet `json:"permissions,omitempty"`

	// redirect uris
	RedirectUris PermissionSet `json:"redirect_uris,omitempty"`

	// The lifetime for identity tokens in seconds, provided the call requested the
	// `openid` scopes.
	//
	TokenLifetime int64 `json:"token_lifetime,omitempty"`

	// The application type
	// Enum: [web native machine]
	Type string `json:"type,omitempty"`
}

type Audience interface {
	// The name of the audience. This is used in token request and token claims.
	Name() string

	// The audience description
	Description() string

	// permissions
	Permissions() Permissions

	// The audience token signing algorithm
	// Enum: [RS256 HS256]
	TokenAlgorithm() string

	// The lifetime for tokens created on behalf of this audience, in seconds
	TokenLifetime() int64

	// The signing secret used if the algorithm is HS256
	TokenSecret() string

	// Principal is the implementation specfic audience object
	Principal() interface{}
}

type AuthCode struct {
	AuthRequest

	// The auth code value provided by the CodeStore
	Code string `json:"code,omitempty"`

	// The time the code was issued on
	IssuedAt int64 `json:"issued_at,omitempty"`

	// The refresh token nonce
	RefreshNonce string `json:"refresh_nonce,omitempty"`

	// The session id
	SessionID string `json:"session_id,omitempty"`

	// The session subject
	Subject string `json:"subject,omitempty"`

	// If this is false the session was created in am SSO flow without capture user credentials
	// Some audiences may request credentials
	//
	UserAuthenticated bool `json:"user_authenticated,omitempty"`
}

type AuthOption func(a *authOptions)

type AuthRequest struct {

	// The request audience
	// Required: true
	Audience string `json:"aud"`

	// The request client id
	// Required: true
	ClientID string `json:"client_id"`

	// The request code challenge
	// Required: true
	CodeChallenge string `json:"code_challenge"`

	// The request code challenge method
	// Enum: [S256]
	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`

	// The request expiration epoch
	ExpiresAt int64 `json:"expires_at,omitempty"`

	// The request app uri
	// Required: true
	AppURI string `json:"app_uri"`

	// The request redirect uri
	// Required: true
	RedirectURI string `json:"redirect_uri"`

	// scope
	Scope Permissions `json:"scope,omitempty"`

	// The request state
	State *string `json:"state,omitempty"`

	// Subject is the request subject
	Subject *string `json:"subject,omitempty"`
}

type Authorizer interface {
	Authorize(opts ...AuthOption) api.Authorizer
}

type AuthorizerOption func(a *authorizer)

type BearerToken struct {

	// The token to be used for authorization
	// Required: true
	AccessToken string `json:"access_token"`

	// The time from `now` that the token expires
	// Required: true
	ExpiresIn int64 `json:"expires_in"`

	// The idenity token contains claims about the users identity. This token is
	// returned if the `openid` scope was granted.
	// If the `profile` scope was granted, this will contain the user profile.
	// These scopes are outside of the context of this library, it is up to the
	// provider to maintain these scopes.
	//
	IDToken string `json:"id_token,omitempty"`

	// The refresh token maybe used to generate a new access token so client
	// and user credentials do not have to traverse the wire again.
	// The is provided if the `offline_access` scope is request.
	// This scopes are outside of the context of this library, it is up to the
	// provider to maintain these scopes.
	//
	RefreshToken string `json:"refresh_token,omitempty"`

	// The token type, always Bearer
	// Required: true
	// Enum: [bearer]
	TokenType string `json:"token_type"`

	// Additional properties added by the platform
	BearerToken map[string]map[string]interface{} `json:"-"`
}

type Claims map[string]interface{}

type CodeStore interface {
	// AuthCodeCreate creates a new authcode from the request if code expires at is set
	// the store should use that value, otherwise set the defaults
	AuthCodeCreate(context.Context, *AuthCode) error

	// AuthCodeGet returns a code from the store
	AuthCodeGet(context.Context, string) (*AuthCode, error)

	// AuthCodeDestroy removes a code from the store
	AuthCodeDestroy(context.Context, string) error
}

type Context struct {
	Application *Application
	Audience    Audience
	User        *User
	Principal   interface{}
	Token       Claims
	Bearer      string
	Request     *AuthRequest
}

type Controller interface {
	// AudienceGet should return an audience for the specified name/id
	AudienceGet(ctx context.Context, name string) (Audience, error)

	// ApplicationGet should return an application for the specified client id
	ApplicationGet(ctx context.Context, clientID string) (*Application, error)

	// UserGet returns a user by subject id along with the underlying principal
	UserGet(ctx context.Context, id string) (*User, interface{}, error)

	// UserAuthenticate authenticates a user using the login and password
	// This function should return an oauth user and the principal
	UserAuthenticate(ctx context.Context, login string, password string) (*User, interface{}, error)

	// UserCreate will create the user, optionally validating the invite code
	UserCreate(ctx context.Context, login string, password *string, profile *Profile, invite ...string) (*User, error)

	// UserUpdate updates a user profile
	UserUpdate(ctx context.Context, id string, profile *Profile) error

	// UserNotify should create an email or sms with the verification link or code for the user
	UserNotify(ctx context.Context, note Notification) error

	// UserResetPassword should notify the user with a reset password link to the
	// which includes the user's password reset code i.e.:
	// - https://domain.tld/setPassword?code={reset_code}
	//
	// These values should be the posted along with the new password to `/oauth/passwordSet`
	UserResetPassword(ctx context.Context, login string, resetCode string) error

	// UserSetPassword will set a user's password
	UserSetPassword(ctx context.Context, sub string, password string) error

	// TokenFinalize finalizes the token, signs it and returns the bearer
	TokenFinalize(ctx context.Context, claims Claims) (string, error)

	// TokenValidate validate the token signature and parse it into the Claims
	TokenValidate(ctx context.Context, bearerToken string) (Claims, error)
}

type EmailClaim struct {
	// The user's email address
	Email *string `json:"email,omitempty"`

	// True if the End-User's e-mail address has been verified; otherwise false. When this Claim Value is true, this means that the OP
	// took affirmative steps to ensure that this e-mail address was controlled by the End-User at the time the verification was performed.
	// The means by which an e-mail address is verified is context-specific, and dependent upon the trust framework or contractual agreements
	// within which the parties are operating.
	//
	EmailVerified *bool `json:"email_verified,omitempty"`
}

type ErrorResponse struct {

	// The error message
	// Required: true
	Message string `json:"message"`
}

type Notification interface {
	Type() NotificationType
	Subject() string
	Channels() NotificationChannels
	URI() *URI
}

type NotificationChannel string

type NotificationChannels []NotificationChannel

type NotificationType string

type PermissionSet map[string]Permissions

type Permissions []string

type PhoneClaim struct {
	// The user's phone number in E.164 format
	PhoneNumber *string `json:"phone_number,omitempty"`

	// True if the End-User's phone number has been verified; otherwise false. When this Claim Value is true, this means that the OP
	// took affirmative steps to ensure that this phone number was controlled by the End-User at the time the verification was performed.
	// The means by which a phone number is verified is context-specific, and dependent upon the trust framework or contractual agreements
	// within which the parties are operating. When true, the phone_number Claim MUST be in E.164 format and any extensions MUST be
	// represented in RFC 3966 format."
	//
	PhoneNumberVerified *bool `json:"phone_number_verified,omitempty"`
}

type Profile struct {
	*EmailClaim `json:",flatten,omitempty"`
	*PhoneClaim `json:",flatten,omitempty"`

	// Subject - Identifier for the End-User at the Issuer.
	//
	Subject string `json:"sub,omitempty"`

	// address
	Address *Address `json:"address,omitempty"`

	// End-User's birthday, represented as an ISO 8601:2004 [ISO8601‑2004] YYYY-MM-DD format. The year MAY be 0000, indicating that it is omitted.
	// To represent only the year, YYYY format is allowed. Note that depending on the underlying platform's date related function, providing just
	// year can result in varying month and day, so the implementers need to take this factor into account to correctly process the dates."
	//
	Birthdate *time.Time `json:"birthdate,omitempty"`

	// Surname(s) or last name(s) of the End-User. Note that in some cultures, people can have multiple family names or no family name;
	// all can be present, with the names being separated by space characters.
	//
	FamilyName string `json:"family_name,omitempty"`

	// End-User's gender. Values defined by this specification are female and male. Other values MAY be used when neither
	// of the defined values are applicable.
	//
	Gender string `json:"gender,omitempty"`

	// Given name(s) or first name(s) of the End-User. Note that in some cultures, people can have multiple given names;
	// all can be present, with the names being separated by space characters.
	//
	GivenName string `json:"given_name,omitempty"`

	// End-User's locale, represented as a BCP47 [RFC5646] language tag. This is typically an ISO 639-1 Alpha-2 [ISO639‑1] language code in lowercase
	// and an ISO 3166-1 Alpha-2 [ISO3166‑1] country code in uppercase, separated by a dash. For example, en-US or fr-CA. As a compatibility note,
	// some implementations have used an underscore as the separator rather than a dash, for example, en_US; Relying Parties MAY choose to accept
	// this locale syntax as well.
	//
	Locale *string `json:"locale,omitempty"`

	// Middle name(s) of the End-User. Note that in some cultures, people can have multiple middle names;
	// all can be present, with the names being separated by space characters. Also note that in some cultures, middle names are not used.
	//
	MiddleName string `json:"middle_name,omitempty"`

	// End-User's full name in displayable form including all name parts, possibly including titles and suffixes,
	// ordered according to the End-User's locale and preferences.
	//
	Name string `json:"name,omitempty"`

	// Casual name of the End-User that may or may not be the same as the given_name. For instance,
	// a nickname value of Mike might be returned alongside a given_name value of Michael.
	//
	Nickname string `json:"nickname,omitempty"`

	// URL of the End-User's profile picture. This URL MUST refer to an image file (for example, a PNG, JPEG, or GIF image file),
	// rather than to a Web page containing an image. Note that this URL SHOULD specifically reference a profile photo of the
	// End-User suitable for displaying when describing the End-User, rather than an arbitrary photo taken by the End-User.
	//
	Picture string `json:"picture,omitempty"`

	// Shorthand name by which the End-User wishes to be referred to at the RP, such as janedoe or j.doe. This value MAY be any valid
	// JSON string including special characters such as @, /, or whitespace. The RP MUST NOT rely upon this value being unique.
	//
	PreferredUsername string `json:"preferred_username,omitempty"`

	// URL of the End-User's profile page. The contents of this Web page SHOULD be about the End-User.
	//
	// Format: uri
	Profile string `json:"profile,omitempty"`

	// Time the End-User's information was last updated. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z
	// as measured in UTC until the date/time.
	//
	UpdatedAt int64 `json:"updated_at,omitempty"`

	// URL of the End-User's Web page or blog. This Web page SHOULD contain information published by the End-User or an
	// organization that the End-User is affiliated with.
	//
	Website string `json:"website,omitempty"`

	// String from zoneinfo [zoneinfo] time zone database representing the End-User's time zone. For example, Europe/Paris or America/Los_Angeles.
	//
	Zoneinfo string `json:"zoneinfo,omitempty"`
}

type Session interface {
	// ID is the session id
	ID() string

	// ClientID is the client that created the user session
	ClientID() string

	// Audience is the session audience
	Audience() string

	// Subject is the user subject id
	Subject() string

	// CreatedAt is the session creation time
	CreatedAt() time.Time

	// ExpiresAt is the session expriation time
	ExpiresAt() time.Time

	// Set sets a value in the session interface
	Set(key string, value interface{})

	// Get gets a value from the session interface
	Get(key string) interface{}

	// Write writes the session to the response
	Write(http.ResponseWriter) error

	// Destroy clears the session from the response
	Destroy(http.ResponseWriter) error
}

type SessionStore interface {
	// SessionCreate creates a new session, overwriting an exising session
	SessionCreate(context.Context, *http.Request) (Session, error)

	// SessionRead returns the session
	SessionRead(context.Context, *http.Request) (Session, error)

	// SessionDestroy should cleanup an session in the response
	SessionDestroy(context.Context, http.ResponseWriter, *http.Request) error
}

type URI string

type URIList []URI

type User struct {

	// The user's login
	//
	// Required: true
	Login string `json:"login"`

	// The time the user password expirts
	// Format: date-time
	PasswordExpiresAt strfmt.DateTime `json:"password_expires_at,omitempty"`

	// permissions
	Permissions PermissionSet `json:"permissions,omitempty"`

	// profile
	Profile *Profile `json:"profile,omitempty"`

	// roles
	Roles PermissionSet `json:"roles,omitempty"`
}