oauth

type Auth struct {
	Issuer  string
	Clients map[string]Client

	Signer Signer
}

type BaseClient struct {
	// client_id for OAuth2 purposes
	ID string `json:"id"`
	// client_secret for OAuth2 purposes
	Secret string `json:"secret"`

	// A slug to uniquely identify the client. For example: `iota-android`
	Slug string `json:"slug"`

	// An entity to group clients together. For example: `iota`
	Entity string `json:"entity"`

	// A map grant_type / roles
	Scopes map[GrantType][]string `json:"scopes"`
}

type Claims struct {
	TokenID   uuid.UUID `json:"tid"`
	Issuer    string    `json:"iss"`
	Audience  string    `json:"aud"`
	Entity    string    `json:"ent,omitempty"`
	Subject   string    `json:"sub,omitempty"`
	Scope     []string  `json:"scope,omitempty"`
	IssuedAt  int64     `json:"iat"`
	ExpiresAt int64     `json:"exp"`
}

type Client interface {
	GetID() string
	GetSlug() string
	GetEntity() string

	GetScope(GrantType) []string
	Verify(string) bool

	Validate() error

	BaseClaims() *Claims
}

type GrantType string

type Signer interface {
	// Returns how long a token signed with this can live
	TokenLifetime() int64

	// Returns the active key ID
	// This method should ensure that the key is valid
	KeyID() (string, error)

	// Sign returns a cryptographic signature
	// The KeyID should be retrieved right before this call using KeyID()
	Sign(string, []byte) ([]byte, error)

	// PublicKeys return the authorized public keys, it also rotates the keys if required
	// Also returns the remaining time for which the keys will be valid
	PublicKeys() ([]keys.PublicKey, int64, error)
}

type TokenClaim interface {
	SetIssuerIfNeeded(string)
}

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	ExpiresIn    int64  `json:"expires_in"`
	TokenType    string `json:"token_type"`
	RefreshToken string `json:"refresh_token,omitempty"`
}