iam

type Client interface {
	// ClientTokenGrant starts client token grant to get client bearer token for role caching
	ClientTokenGrant() error

	// ClientToken returns client access token
	ClientToken() string

	// StartLocalValidation starts goroutines to refresh JWK and revocation list periodically
	// this enables local token validation
	StartLocalValidation() error

	// ValidateAccessToken validates access token by calling IAM service
	ValidateAccessToken(accessToken string) (bool, error)

	// ValidateAndParseClaims validates access token locally and returns the JWT claims contained in the token
	ValidateAndParseClaims(accessToken string) (*JWTClaims, error)

	// ValidatePermission validates if an access token has right for a specific permission
	// requiredPermission: permission to access resource, example:
	// 		{Resource: "NAMESPACE:{namespace}:USER:{userId}", Action: 2}
	// permissionResources: resource string to replace the `{}` placeholder in
	// 		`requiredPermission`, example: p["{namespace}"] = "accelbyte"
	ValidatePermission(claims *JWTClaims, requiredPermission Permission,
		permissionResources map[string]string) (bool, error)

	// ValidateRole validates if an access token has a specific role
	ValidateRole(requiredRoleID string, claims *JWTClaims) (bool, error)

	// UserPhoneVerificationStatus gets user phone verification status on access token
	UserPhoneVerificationStatus(claims *JWTClaims) (bool, error)

	// UserEmailVerificationStatus gets user email verification status on access token
	UserEmailVerificationStatus(claims *JWTClaims) (bool, error)

	// UserAnonymousStatus gets user anonymous status on access token
	UserAnonymousStatus(claims *JWTClaims) (bool, error)

	// HasBan validates if certain ban exist
	HasBan(claims *JWTClaims, banType string) bool

	// HealthCheck lets caller know the health of the IAM client
	HealthCheck() bool
}

type Config struct {
	BaseURL                       string
	ClientID                      string
	ClientSecret                  string
	RolesCacheExpirationTime      time.Duration // default: 60s
	JWKSRefreshInterval           time.Duration // default: 60s
	RevocationListRefreshInterval time.Duration // default: 60s
}

type DefaultClient struct {
	// contains filtered or unexported fields
}

type JWK struct {
	Kty string `json:"kty"`
	Use string `json:"use"`
	Kid string `json:"kid"`
	N   string `json:"n"`
	E   string `json:"e"`
}

type JWTBan struct {
	Ban     string    `json:"ban"`
	EndDate time.Time `json:"end_date"`
}

type JWTClaims struct {
	Namespace    string       `json:"namespace"`
	DisplayName  string       `json:"display_name"`
	Roles        []string     `json:"roles"`
	Permissions  []Permission `json:"permissions"`
	Bans         []JWTBan     `json:"bans"`
	JusticeFlags int          `json:"jflgs"`
	jwt.Claims
}

type Keys struct {
	Keys []JWK `json:"keys"`
}

type MockClient struct {
	Healthy bool // set this to false to mock unhealthy IAM service
}

type Permission struct {
	Resource        string
	Action          int
	ScheduledAction int      `json:"SchedAction,omitempty"`
	CronSchedule    string   `json:"SchedCron,omitempty"`
	RangeSchedule   []string `json:"SchedRange,omitempty"`
}

type RevocationList struct {
	RevokedTokens bloom.FilterJSON           `json:"revoked_tokens"`
	RevokedUsers  []UserRevocationListRecord `json:"revoked_users"`
}

type Role struct {
	RoleID      string `json:"RoleId"`
	RoleName    string
	Permissions []Permission
}

type TokenResponse struct {
	AccessToken    string       `json:"access_token"`
	RefreshToken   string       `json:"refresh_token"`
	ExpiresIn      int          `json:"expires_in"`
	TokenType      string       `json:"token_type"`
	Roles          []string     `json:"roles"`
	Permissions    []Permission `json:"permissions"`
	Bans           []JWTBan     `json:"bans"`
	UserID         string       `json:"user_id"`
	PlatformID     string       `json:"platform_id,omitempty"`
	PlatformUserID string       `json:"platform_user_id,omitempty"`
	JusticeFlags   int          `json:"jflgs,omitempty"`
	DisplayName    string       `json:"display_name"`
	Namespace      string       `json:"namespace"`
}

type UserRevocationListRecord struct {
	ID        string    `json:"id" bson:"id"`
	RevokedAt time.Time `json:"revoked_at" bson:"revoked_at"`
}