authzapireq

type APIApplication struct {
	AppID            string  `json:"applicationIdentifier"`
	DisplayName      string  `json:"displayName"`
	Description      string  `json:"description"`
	OwnerID          string  `json:"ownerId"`
	ManagerID        string  `json:"managerId"`
	IdentityID       string  `json:"identityId"`
	AdministratorsID *string `json:"administratorsId"`
	HomePage         string  `json:"homePage"`
	Category         string  `json:"resourceCategory"`
	Blocked          bool    `json:"blocked"`
	ID               string  `json:"id"`
	CreateTime       string  `json:"creationTime"`
	ModTime          string  `json:"modificationTime"`
	// OIDC fields
	ClientID       string `json:"clientId"`
	ClientSecret   string `json:"secret"`
	RegistrationID string `json:"registrationId"`
	// Internal fields
	// OwnerUPN is the Owner username, it is named OwnerUPN to match the naming on the Authzsvc API
	OwnerUPN string `json:"-"`
	// DisplayName of the Administrators group
	AdministratorsDisplayName string `json:"-"`
}

type APIGroup struct {
	// UUID of the group
	ID string `json:"id"`
	// human-readable identifier of the group ("name")
	GroupIdentifier string `json:"groupIdentifier"`
}

type APIIdentity struct {
	// ExternalEmail              interface{} `json:"externalEmail"`
	PrimaryAccountEmail string `json:"primaryAccountEmail"`
	Type                string `json:"type"`
	Upn                 string `json:"upn"`
	DisplayName         string `json:"displayName"`
	PersonID            string `json:"personId"`
	SupervisorID        string `json:"supervisorId"`
	DirectResponsibleID string `json:"directResponsibleId"`
	// Source                     string      `json:"source"`
	// Unconfirmed                bool        `json:"unconfirmed"`
	// UnconfirmedEmail           interface{} `json:"unconfirmedEmail"`
	PrimaryAccountID string `json:"primaryAccountId"`
	UID              int    `json:"uid"`
	Gid              int    `json:"gid"`
	ResourceCategory string `json:"resourceCategory"`
	Reassignable     bool   `json:"reassignable"`
	// AutoReassign               bool        `json:"autoReassign"`
	// PendingAction              bool        `json:"pendingAction"`
	// Blocked                    bool        `json:"blocked"`
	// SecurityIssues             bool        `json:"securityIssues"`
	// BlockingReason             string      `json:"blockingReason"`
	// BlockingTime               interface{} `json:"blockingTime"`
	// BlockingDeadline           interface{} `json:"blockingDeadline"`
	// ExpirationDeadline         interface{} `json:"expirationDeadline"`
	ID           string    `json:"id"`
	CreationTime time.Time `json:"creationTime"`
	// Room                       string      `json:"room"`
	// Floor                      string      `json:"floor"`
	// Building                   string      `json:"building"`
	// EndClass                   time.Time   `json:"endClass"`
	// LastName                   string      `json:"lastName"`
	// BirthDate                  time.Time   `json:"birthDate"`
	CernClass string `json:"cernClass"`
	CernGroup string `json:"cernGroup"`
	// FirstName                  string      `json:"firstName"`
	// ActiveUser                 bool        `json:"activeUser"`
	// StartClass                 time.Time   `json:"startClass"`
	CernSection    string `json:"cernSection"`
	Description    string `json:"description"`
	CernPersonID   string `json:"cernPersonId"`
	InstituteName  string `json:"instituteName"`
	CernDepartment string `json:"cernDepartment"`
}

type APIPage struct {
	Total  int         `json:"total"`
	Offset int         `json:"offset"`
	Limit  int         `json:"limit"`
	Next   *string     `json:"next"`
	Links  APIPageLink `json:"links"`
}

type APIPageLink struct {
	Current string `json:"current"`
	Next    string `json:"next"`
	Last    string `json:"last"`
}

type APIRegistration struct {
	RegistrationID string
	// Attributes we recognise
	ClientID             string   `json:"clientId"`
	ClientSecret         string   `json:"secret"`
	RedirectURIs         []string `json:"redirectUris"`
	ImplicitFlowEnabled  bool     `json:"implicitFlowEnabled"`
	ConsentRequired      bool     `json:"consentRequired"`
	Enabled              bool     `json:"enabled"`
	DefaultClientScopes  []string `json:"defaultClientScopes"`
	OptionalClientScopes []string `json:"optionalClientScopes"`
	// Additional attributes
	WebOrigins                []string `json:"webOrigins"`
	ClientAuthenticatorType   string   `json:"clientAuthenticatorType"`
	DirectAccessGrantsEnabled bool     `json:"directAccessGrantsEnabled"`
	PublicClient              bool     `json:"publicClient"`
	ServiceAccountsEnabled    bool     `json:"serviceAccountsEnabled"`
	StandardFlowEnabled       bool     `json:"standardFlowEnabled"`
	SurrogateAuthRequired     bool     `json:"surrogateAuthRequired"`
	FullScopeAllowed          bool     `json:"fullScopeAllowed"`
	FrontchannelLogout        bool     `json:"frontchannelLogout"`
}

type APIRole struct {
	Name            string `json:"name"`
	DisplayName     string `json:"displayName"`
	Description     string `json:"description"`
	ApplicationID   string `json:"applicationId"`
	ApplyToAllUsers bool   `json:"applyToAllUsers"`
	MinimumLoaID    string `json:"minimumLoaId"`
	Required        bool   `json:"required"`
	RoleId          string `json:"id"`
}

type AccessTokenArgs struct {
	Audience      string
	ExistingToken oauth2.Token
}

type AuthzAPI string

type AuthzClient interface {
	// Post authorized req to Authzsvc API
	Post(cmd AuthzAPI, body io.Reader) (resp *http.Response, err error)
	// Get authorized req from Authzsvc API
	Get(cmd AuthzAPI, body io.Reader) (resp *http.Response, err error)
	// Put authorized req from Authzsvc API
	Put(cmd AuthzAPI, body io.Reader) (resp *http.Response, err error)
	// Delete authorized req from Authzsvc API
	Delete(cmd AuthzAPI, body io.Reader) (resp *http.Response, err error)
	// GetMyApplications will retrieve all the applications in the API (Note: this call is expensive as it has to go through all the pages)
	GetMyApplications() ([]APIApplication, error)
	// GetRole validates if Role already exists on an ApplicationRegistration in the API
	GetRole(id string, role string) (bool, error)
	// GetApplicationByAppID queries the API for the Application with the given applicationIdentifier
	GetApplicationByAppID(appID string) (APIApplication, error)
	// GetLoA queries the Authzsvc API for the ID of the Level of Assurance with the given level
	// this method is also available through the AuthZ apicache
	GetLoA(level string) (string, error)
	// CreateApplicationRole creates a new Role for a Specific Application
	CreateApplicationRole(role APIRole, applicationID string) (string, error)
	// LinkGroupToAppRole links an existing Group to an existing Role in an existing Application
	LinkGroupToAppRole(groupID string, roleID string, appID string) error
	// GetIdentity returns information about a user account - this method is also available through the AuthZ apicache
	GetIdentity(id string) (APIIdentity, error)
	// GetGroup returns information about a group - this method is also available through the AuthZ apicache
	GetGroup(id string) (APIGroup, error)
	// ManagerID returns the API ID of this AuthzAPI client's Application registration
	ManagerID() string
	// OidcProviderID returns the OIDC Provider ID on the Authzsvc API
	OidcProviderID() string
	IssuerURL() string
	RefreshClientSecret(regID string) error
}

type AuthzClientHTTP struct {
	http.Client
	logr.Logger
	// contains filtered or unexported fields
}