hcl

type APIGWClient = RESTClient

type AssignAttributesToEvalContextOption func(*assignAttributesToEvalContextOptionArg)

type BlockWrapper hcl.Block

type BodyLabelReader interface {
	BodyReader
	LabelReader
}

type BodyReader interface {
	GetBody() hcl.Body
}

type ContextOption func(*hcl.EvalContext) error

type LabelReader interface {
	// Label implementations are expected to return the first label of an
	//  HCL-block.
	FirstLabel() string
	// Labels implementations are expected to return a slice of labels for an
	//  HCL-block.
	AllLabels() []string
}

type OIDCClient struct {
	ClientID     string              `hcl:"client_id,label" cty:"client_id"`
	AuthMethod   string              `hcl:"auth_method,optional" cty:"auth_method"`
	AuthToken    string              `hcl:"auth_token,optional" cty:"auth_token"`
	ClientSecret string              `hcl:"client_secret,optional" cty:"client_secret"`
	Endpoints    *OIDCEndpoints      `hcl:"endpoints,block" cty:"endpoints"`
	Headers      map[string][]string `hcl:"headers,optional" cty:"headers"`
	RedirectURIs []string            `hcl:"redirect_uris,optional" cty:"redirect_uris"`
	Scopes       []string            `hcl:"scopes,optional" cty:"scopes"`
	TLS          *TLS                `hcl:"tls,block" cty:"tls"`
}

type OIDCEndpoints struct {
	Auth          string `hcl:"auth,optional" cty:"auth"`
	Introspection string `hcl:"introspection,optional" cty:"introspection"`
	Issuer        string `hcl:"issuer" cty:"issuer"`
	JWKS          string `hcl:"jwks,optional" cty:"jwks"`
	Token         string `hcl:"token,optional" cty:"token"`
	Userinfo      string `hcl:"userinfo,optional" cty:"userinfo"`
}

type OIDCProvider struct {
	Alias         string         `hcl:"alias,label" cty:"alias"`
	Endpoints     *OIDCEndpoints `hcl:"endpoints,block" cty:"endpoints"`
	Clients       []*OIDCClient  `hcl:"client,block" cty:"client"`
	DefaultClient string         `hcl:"default_client,optional" cty:"default_client"`
}

type RESTClient struct {
	Alias      string              `hcl:"alias,label" cty:"alias"`
	AuthMethod string              `hcl:"auth_method,optional" cty:"auth_method"`
	AuthToken  string              `hcl:"auth_token,optional" cty:"auth_token"`
	Headers    map[string][]string `hcl:"headers,optional" cty:"headers"`
	TLS        *TLS                `hcl:"tls,block" cty:"tls"`
	URL        string              `hcl:"url,optional" cty:"url"`
}

type ServiceType = string

type TLS struct {
	// ClientAuthType determines the server's policy for
	// TLS Client Authentication. The default is NoClientCert.
	ClientAuthType tls.ClientAuthType `hcl:"client_auth_type,optional" cty:"client_auth_type"`
	// ClientCAs defines the set of root certificate authorities that servers
	// expect to be used use when verifying a client certificate (if so
	// configured by the policy in ClientAuthType.
	ClientCAs []string `hcl:"client_cas,optional" cty:"client_cas"`
	// CurvePreferences contains the elliptic curves that will be used in
	// an ECDHE handshake, in preference order. If empty, the default will
	// be used. The client will use the first preference as the type for
	// its key share in TLS 1.3. This may change in the future.
	CurvePreferences []tls.CurveID `hcl:"curve_preferences,optional" cty:"curve_preferences"`
	// RootCAs defines the set of root certificate authorities that clients use
	// when verifying server certificates. If RootCAs is nil, TLS uses
	//  the host's root CA set.
	RootCAs []string `hcl:"root_cas,optional" cty:"root_cas"`
	// ServerName is used to verify the hostname on the returned
	// certificates unless InsecureSkipVerify is given. It is also included
	// in the client's handshake to support virtual hosting unless it is
	// an IP address.
	ServerName string `hcl:"server_name,optional" cty:"server_name"`
	// MaxVersion contains the maximum TLS version that is acceptable.
	//
	// By default, the maximum version supported by this package is used,
	// which is currently TLS 1.3.
	MaxVersion uint16 `hcl:"max_version,optional" cty:"max_version"`
	// MinVersion contains the minimum TLS version that is acceptable.
	//
	// By default, TLS 1.2 is currently used as the minimum when acting as a
	// client, and TLS 1.0 when acting as a server. TLS 1.0 is the minimum
	// supported by this package, both as a client and as a server.
	//
	// The client-side default can temporarily be reverted to TLS 1.0 by
	// including the value "x509sha1=1" in the GODEBUG environment variable.
	// Note that this option will be removed in Go 1.19 (but it will still be
	// possible to set this field to VersionTLS10 explicitly).
	MinVersion uint16 `hcl:"min_version,optional" cty:"min_version"`
	// InsecureSkipVerify controls whether a client verifies the server's
	// certificate chain and host name. If InsecureSkipVerify is true, crypto/tls
	// accepts any certificate presented by the server and any host name in that
	// certificate. In this mode, TLS is susceptible to machine-in-the-middle
	// attacks unless custom verification is used. This should be used only for
	// testing or in combination with VerifyConnection or VerifyPeerCertificate.
	InsecureSkipVerify bool `hcl:"insecure_skip_verify,optional" cty:"insecure_skip_verify"`
}

type TLSClientAuthTypeWrapper tls.ClientAuthType

type TLSCurveIDWrapper kcty.UInt16Wrapper

type TLSCurvePreferences []tls.CurveID

type TLSVersionWrapper kcty.UInt16Wrapper