serviceprovider

type AccessTokenMapper struct {
	Name                    string   `json:"name"`
	Token                   string   `json:"token"`
	ServiceProviderUrl      string   `json:"serviceProviderUrl"` // We assume ServiceProviderUrl contains scheme, otherwise we can't parse the host properly.
	ServiceProviderUserName string   `json:"serviceProviderUserName"`
	ServiceProviderUserId   string   `json:"serviceProviderUserId"`
	UserId                  string   `json:"userId"`
	ExpiredAfter            *uint64  `json:"expiredAfter"`
	Scopes                  []string `json:"scopes"`
}

type Constructor interface {
	// Construct creates a new instance of service provider
	Construct(factory *Factory, spConfig *config.ServiceProviderConfiguration) (ServiceProvider, error)
}

type ConstructorFunc func(factory *Factory, spConfig *config.ServiceProviderConfiguration) (ServiceProvider, error)

type DefaultOAuthCapability struct {
	BaseUrl string
}

type DownloadFileCapability interface {
	DownloadFile(ctx context.Context, repoUrl, filepath, ref string, token *api.SPIAccessToken, maxFileSizeLimit int) (string, error)
}

type Factory struct {
	Configuration    *opconfig.OperatorConfiguration
	KubernetesClient client.Client
	HttpClient       *http.Client
	Initializers     *Initializers
	TokenStorage     tokenstorage.TokenStorage
}

type FileDownloadNotSupportedError struct {
}

type GenericLookup struct {
	// ServiceProviderType is just the type of the provider we're dealing with. It is used to limit the number of
	// results the filter function needs to sift through.
	ServiceProviderType api.ServiceProviderType
	// TokenFilter is the filter function that decides whether a token matches the requirements of a binding, given
	// the token's service-provider-specific state
	TokenFilter TokenFilter
	// MetadataProvider is used to figure out metadata of a token in the service provider useful for token lookup
	MetadataProvider MetadataProvider
	// MetadataCache is an abstraction used for storing/fetching the metadata of tokens
	MetadataCache *MetadataCache
	// RepoHostParser is a function that extracts the host from the repoUrl
	RepoHostParser RepoHostParser
}

type Initializer struct {
	Probe       Probe
	Constructor Constructor
}

type Initializers struct {
	// contains filtered or unexported fields
}

type Matchable interface {
	Validated
	RepoUrl() string
	ObjNamespace() string
}

type MetadataCache struct {
	// Client is the Kubernetes client to use for persisting the fetched metadata
	Client           client.Client
	ExpirationPolicy MetadataExpirationPolicy
	// CacheServiceProviderState specifies whether to fetch and cache the full state, including the service provider
	// state or just the basic info (like username and/or userid).
	CacheServiceProviderState bool
}

type MetadataExpirationPolicy interface {
	// IsExpired returns true if the metadata of the supplied token should be refreshed, false otherwise.
	// The implementation can assume that `token.Status.TokenMetadata` is not nil.
	IsExpired(token *api.SPIAccessToken) bool
}

type MetadataExpirationPolicyFunc func(token *api.SPIAccessToken) bool

type MetadataProvider interface {
	// Fetch tries to fetch the token metadata and assign it in the token. Note that the metadata of the token may or
	// may not be nil and this method shouldn't change it unless there is data to assign.
	// Implementors should make sure to return some errors.ServiceProviderError if the failure to fetch the metadata is
	// caused by the token or service provider itself and not other environmental reasons.
	//
	// The `includeState` governs the initialization of the `api.TokenMetadata.ServiceProviderState` field.
	// If it is false, the provider can leave it out, leading to reduced time needed to initialize the metadata.
	// This field is assumed to not be needed if the token match policy is set to "any" (which is currently the default).
	Fetch(ctx context.Context, token *api.SPIAccessToken, includeState bool) (*api.TokenMetadata, error)
}

type MetadataProviderFunc func(ctx context.Context, token *api.SPIAccessToken, includeState bool) (*api.TokenMetadata, error)

type NeverMetadataExpirationPolicy struct{}

type OAuthCapability interface {
	// GetOAuthEndpoint returns the URL of the OAuth initiation. This must point to the SPI oauth service, NOT
	//the service provider itself.
	GetOAuthEndpoint() string

	// OAuthScopesFor translates all the permissions into a list of service-provider-specific scopes. This method
	// is used to compose the OAuth flow URL. There is a generic helper, GetAllScopes, that can be used if all that is
	// needed is just a translation of permissions into scopes.
	OAuthScopesFor(permissions *api.Permissions) []string
}

type Probe interface {
	// Examine returns the base url of the service provider, if the provided URL can be handled by that provider or
	// an empty string if it cannot. The provided http client can be used to perform requests against the URL if needed.
	Examine(cl *http.Client, url string) (string, error)
}

type ProbeFunc func(*http.Client, string) (string, error)

type RefreshTokenCapability interface {
	// RefreshToken requests new access token from the service provider using refresh token as authorization.
	// This invalidates the old access token and refresh token
	RefreshToken(ctx context.Context, token *api.Token, config *oauth2.Config) (*api.Token, error)
}

type RefreshTokenNotSupportedError struct {
}

type RepoHostParser func(url string) (string, error)

type ServiceProvider interface {
	// LookupTokens tries to match an SPIAccessToken object with the requirements expressed in the provided binding.
	// This usually searches kubernetes (using the provided client) and the service provider itself (using some specific
	// mechanism (usually an http client)).
	LookupTokens(ctx context.Context, cl client.Client, binding *api.SPIAccessTokenBinding) ([]api.SPIAccessToken, error)

	// PersistMetadata tries to use the OAuth access token associated with the provided token (if any) and persists any
	// state and metadata required for the token lookup. The metadata must be stored in the Status.TokenMetadata field
	// of the provided token.
	// Implementors should make sure that this method returns InvalidAccessTokenError if the reason for the failure is
	// an invalid token. This is important to distinguish between environmental errors and errors in the data itself.
	PersistMetadata(ctx context.Context, cl client.Client, token *api.SPIAccessToken) error

	// GetBaseUrl returns the base URL of the service provider this instance talks to. This info is saved with the
	// SPIAccessTokens so that later on, the OAuth service can use it to construct the OAuth flow URLs.
	GetBaseUrl() string

	// GetType merely returns the type of the service provider this instance talks to.
	GetType() config.ServiceProviderType

	CheckRepositoryAccess(ctx context.Context, cl client.Client, accessCheck *api.SPIAccessCheck) (*api.SPIAccessCheckStatus, error)

	// GetDownloadFileCapability returns capability object for the providers which are able to download files from the repository
	// or nil for those which are not
	GetDownloadFileCapability() DownloadFileCapability

	// GetRefreshTokenCapability returns capability object for the providers which are able to refresh OAuth access tokens.
	// or nil
	GetRefreshTokenCapability() RefreshTokenCapability

	// GetOAuthCapability returns oauth capability of the service provider.
	// It can be null in case service provider don't support OAuth or it is not configured.
	GetOAuthCapability() OAuthCapability

	// MapToken creates an access token mapper for given binding and token using the service-provider specific data.
	// The implementations can use the DefaultMapToken method if they don't use any custom logic.
	MapToken(ctx context.Context, binding *api.SPIAccessTokenBinding, token *api.SPIAccessToken, tokenData *api.Token) (AccessTokenMapper, error)

	// Validate checks that the provided object (token or binding) is valid in this service provider
	Validate(ctx context.Context, validated Validated) (ValidationResult, error)
}

type TestCapabilities struct {
	DownloadFileImpl     func(context.Context, string, string, string, *api.SPIAccessToken, int) (string, error)
	GetOAuthEndpointImpl func() string
	OAuthScopesForImpl   func(permission *api.Permissions) []string
	RefreshTokenImpl     func(ctx context.Context, token *api.Token, config *oauth2.Config) (*api.Token, error)
}

type TestServiceProvider struct {
	LookupTokensImpl          func(context.Context, client.Client, *api.SPIAccessTokenBinding) ([]api.SPIAccessToken, error)
	PersistMetadataImpl       func(context.Context, client.Client, *api.SPIAccessToken) error
	GetBaseUrlImpl            func() string
	GetTypeImpl               func() config.ServiceProviderType
	CheckRepositoryAccessImpl func(context.Context, client.Client, *api.SPIAccessCheck) (*api.SPIAccessCheckStatus, error)
	MapTokenImpl              func(context.Context, *api.SPIAccessTokenBinding, *api.SPIAccessToken, *api.Token) (AccessTokenMapper, error)
	ValidateImpl              func(context.Context, Validated) (ValidationResult, error)
	CustomizeReset            func(provider *TestServiceProvider)
	DownloadFileCapability    func() DownloadFileCapability
	RefreshTokenCapability    func() RefreshTokenCapability
	OAuthCapability           func() OAuthCapability
}

type TokenFilter interface {
	Matches(ctx context.Context, matchable Matchable, token *api.SPIAccessToken) (bool, error)
}

type TokenFilterFunc func(ctx context.Context, matchable Matchable, token *api.SPIAccessToken) (bool, error)

type TtlMetadataExpirationPolicy struct {
	Ttl time.Duration
}

type Validated interface {
	Permissions() *api.Permissions
}

type ValidationResult struct {
	// ScopeValidation is the reasons for the scopes and permissions to be invalid
	ScopeValidation []error
}