uma

type Authorization struct {
	Permissions []Permission `json:"permissions,omitempty"`
}

type Claims struct {
	Authorization     *Authorization `json:"authorization,omitempty"`
	Email             string         `json:"email,omitempty"`
	Name              string         `json:"name,omitempty"`
	GivenName         string         `json:"given_name,omitempty"`
	FamilyName        string         `json:"family_name,omitempty"`
	PreferredUsername string         `json:"preferred_username,omitempty"`
	EmailVerified     bool           `json:"email_verified,omitempty"`
	Aud               string         `json:"aud,omitempty"`
	Sid               string         `json:"sid,omitempty"`
	Jti               string         `json:"jti,omitempty"`
	Exp               int            `json:"exp,omitempty"`
	Nbf               int            `json:"nbf,omitempty"`
	Iat               int            `json:"iat,omitempty"`
	Sub               string         `json:"sub,omitempty"`
	Typ               string         `json:"typ,omitempty"`
	Azp               string         `json:"azp,omitempty"`
}

type DiscoveryDoc struct {
	TokenEndpoint                string `json:"token_endpoint,omitempty"`
	TokenIntrospectionEndpoint   string `json:"token_introspection_endpoint,omitempty"`
	ResourceRegistrationEndpoint string `json:"resource_registration_endpoint,omitempty"`
	PermissionEndpoint           string `json:"permission_endpoint,omitempty"`
	PolicyEndpoint               string `json:"policy_endpoint,omitempty"`
}

type ExpandedResource struct {
	ID             string  `json:"_id,omitempty"`
	Name           string  `json:"name,omitempty"`
	Type           string  `json:"type,omitempty"`
	Description    string  `json:"description,omitempty"`
	IconUri        string  `json:"icon_uri,omitempty"`
	ResourceScopes []Scope `json:"resource_scopes,omitempty"`
	Scopes         []Scope `json:"scopes,omitempty"`

	// Keycloak only fields
	Owner              *ResourceOwner `json:"owner,omitempty"`
	OwnerManagedAccess bool           `json:"ownerManagedAccess,omitempty"`
	URIs               []string       `json:"uris,omitempty"`
}

type KcPermission struct {
	ID               string                   `json:"id,omitempty"`
	Name             string                   `json:"name"`
	Type             string                   `json:"type,omitempty"`
	Description      string                   `json:"description,omitempty"`
	Logic            KcPermissionLogic        `json:"logic,omitempty"`
	DecisionStrategy KcPolicyDecisionStrategy `json:"decisionStrategy,omitempty"`
	Scopes           []string                 `json:"scopes,omitempty"`
	Owner            string                   `json:"owner,omitempty"`
	Roles            []string                 `json:"roles,omitempty"`
	Groups           []string                 `json:"groups,omitempty"`
	Clients          []string                 `json:"clients,omitempty"`
}

type KcPermissionLogic string

type KcPolicyDecisionStrategy string

type KeySet interface {
	// VerifySignature parses the JSON web token, verifies the signature, and returns
	// the raw payload. Header and claim fields are validated by other parts of the
	// package. For example, the KeySet does not need to check values such as signature
	// algorithm, issuer, and audience since the IDTokenVerifier validates these values
	// independently.
	//
	// If VerifySignature makes HTTP requests to verify the token, it's expected to
	// use any HTTP client associated with the context through ClientContext.
	VerifySignature(ctx context.Context, jwt string) (payload []byte, err error)
}

type KeycloakOption func(kp *KeycloakProvider)

type KeycloakProvider struct {
	ClientID string
	// contains filtered or unexported fields
}

type Manager struct {
	// contains filtered or unexported fields
}

type ManagerOptions struct {
	// GetBaseURL returns the base url of the covered api. It is typically the "url" of the matching
	// server entry in openapi spec. It should have this format: "{SCHEME}://{PUBLIC_HOSTNAME}{ANY_BASE_PATH}"
	GetBaseURL func(r *http.Request) url.URL

	// GetProvider returns the provider info given the request. It allows you to use different UMA
	// providers for different requests if you so wish
	GetProvider func(r *http.Request) Provider

	// ResourceStore persistently stores resource name and id. This tells the middleware which resource
	// is already registered so it doesn't have to be registered again.
	GetResourceStore func(r *http.Request) ResourceStore

	// Includes scopes in permission ticket in order to be granted specific scopes (the currently needed scopes)
	// on a resource. If scopes are not included, the authorization server might decides to grant all scopes
	// on the request resource.
	IncludeScopesInPermissionTicket bool

	// Skip token expiration check during token validation. This is only useful during testing, don't set
	// to true in production.
	DisableTokenExpirationCheck bool

	// GetResourceName if defined, must return the correct name of the resource. The preferred way to set resource
	// name is to define name template for the resource (x-uma-resource.name) in the OpenAPI spec. This method
	// should only be used when that is not possible.
	GetResourceName func(r *http.Request, rsc Resource) string

	// CustomEnforce handler if defined, cut the UMA provider out of the flow entirely, and allows deciding access
	// with custom logic. If the handler return true, allow the request to come through. Otherwise, responds with 401.
	CustomEnforce func(r *http.Request, resource Resource, scopes []string) bool

	// EditUnauthorizedResponse allows you to add additional headers and write custom body for 401 unauthorized
	// responses. Whatever you do, don't touch the "WWW-Authenticate" header as that is how the ticket is
	// transferred. Also make sure to write headers with status code 401.
	EditUnauthorizedResponse func(rw http.ResponseWriter)

	// AnonymousScopes is invoked when the user is unauthenticated. It is given the resource object that is being
	// accessed and should return the scopes available to anonymous users. If the scopes are sufficient, the user
	// is allowed to access. Otherwise an UMA ticket is created and returned in 401 response as usual.
	AnonymousScopes func(r *http.Request, resource Resource) (scopes []string)
}

type Operation struct {
	Security Security
}

type Path struct {
	// contains filtered or unexported fields
}

type Permission struct {
	Rsid   string   `json:"rsid,omitempty"`
	Rsname string   `json:"rsname,omitempty"`
	Scopes []string `json:"scopes,omitempty"`
}

type Provider interface {
	KeySet

	// Authenticate authenticates client and get an access token for permission api
	Authenticate(client *http.Client) (*httputil.ClientCreds, error)

	// CreateResource creates resource
	CreateResource(request *Resource) (response *ExpandedResource, err error)

	// GetResource gets resource by id
	GetResource(id string) (resource *ExpandedResource, err error)

	// UpdateResource updates resource by id
	UpdateResource(id string, resource *Resource) (err error)

	// DeleteResource delete resource by id
	DeleteResource(id string) (err error)

	// ListResources lists resources. You can add custom query parameters with urlQuery
	ListResources(urlQuery url.Values) (ids []string, err error)

	// CreatePermissionTicket creates a permission ticket based on resourceID and
	// optional scopes
	CreatePermissionTicket(resourceID string, scopes ...string) (string, error)

	WWWAuthenticateDirectives() WWWAuthenticateDirectives
}

type Resource struct {
	ResourceType

	// ID is the identifier defined by the authorization server
	ID string `json:"_id,omitempty"`

	// Name is the URI where the resource was detected
	Name string `json:"name,omitempty"`

	// Keycloak only fields
	Owner              string `json:"owner,omitempty"`
	OwnerManagedAccess bool   `json:"ownerManagedAccess,omitempty"`
	URI                string `json:"uri,omitempty"`
}

type ResourceOwner struct {
	ID   string `json:"id,omitempty"`
	Name string `json:"name,omitempty"`
}

type ResourceStore interface {
	// Set resource id associated with given name
	Set(name, id string) error

	// Get resource id associated with given name. If this function returns
	// empty string, the Manager creates a new resource, registers it with the
	// provider, and persists the id using Set
	Get(name string) (id string, err error)
}

type ResourceTemplate struct {
	// contains filtered or unexported fields
}

type ResourceType struct {
	Type           string   `json:"type,omitempty"`
	Description    string   `json:"description,omitempty"`
	IconUri        string   `json:"icon_uri,omitempty"`
	ResourceScopes []string `json:"resource_scopes,omitempty"`
}

type Scope struct {
	ID   string `json:"id,omitempty"`
	Name string `json:"name,omitempty"`
}

type Security []map[string][]string

type WWWAuthenticateDirectives struct {
	Realm string
	AsUri string
}