auth

type AccessClaims interface {
	// GetAccount gets the account stored in given token.
	GetAccount() Account
	Claims
}

type Account interface {
	mapping.Model
	// GetUsername gets the current account username.
	GetUsername() string
	// SetUsername sets the account username.
	SetUsername(username string)
	// GetPasswordHash sets the password hash for the account.
	GetPasswordHash() []byte
	// SetPasswordHash sets the password hash for given account.
	SetPasswordHash(hash []byte)
	// UsernameField gets the account username field name.
	UsernameField() string
	// PasswordHashField gets the hashed password field name.
	PasswordHashField() string
}

type Audiencer interface {
	Audience() string
}

type AuthenticateMethod int

type Authenticator interface {
	// HashAndSetPassword creates a password hash and stores it within given account.
	// If a model implements SaltSetter this function should set the salt also.
	HashAndSetPassword(account Account, password *Password) error
	// ComparePassword hash the 'password' (with optional salt) and compare with stored password hash.
	ComparePassword(account Account, password string) error
}

type AuthenticatorOption func(o *AuthenticatorOptions)

type AuthenticatorOptions struct {
	// Store is a store used for some authenticator implementations.
	Store store.Store
	// BCryptCost is an option that defines the cost of given password.
	BCryptCost int
	// AuthenticateMethod is a method used for authentication.
	AuthenticateMethod AuthenticateMethod
	// SaltLength is the length of the salt.
	SaltLength int
}

type Claims interface {
	// Subject should contain account id string value.
	Subject() string
	// ExpiresIn should define when (in seconds) the claims will expire.
	ExpiresIn() int64
	// Valid validates the claims.
	Valid() error
}

type HierarchicalRole interface {
	Role
	HierarchyValue() int
}

type Issuer interface {
	Issuer() string
}

type ListRoleOption func(o *ListRoleOptions)

type ListRoleOptions struct {
	SortByHierarchy bool
	SortOrder       query.SortOrder
	Limit, Offset   int
	Account         Account
}

type ListScopeOption func(o *ListScopeOptions)

type ListScopeOptions struct {
	Limit, Offset int
	Role          Role
}

type NotBeforer interface {
	NotBefore() int64
}

type Password struct {
	// Password is the string value of the provided password.
	Password string
	// Uppers is a count of the uppercase letters.
	Uppers int
	// Lowers is a count of the lowercase letters.
	Lowers int
	// Specials is a count of special symbols.
	Specials int
	// Numbers is a count of numbers in the password.
	Numbers int
	// UniqueRunes is the number of unique runes int
	UniqueRunes int
	// Score is a password strength score.
	Score int
}

type PasswordScorer func(pw *Password)

type PasswordValidator func(*Password) error

type Role interface {
	RoleName() string
}

type RoleScoper interface {
	// ListRoleScopes lists the scopes for provided options.
	ListRoleScopes(ctx context.Context, options ...ListScopeOption) ([]Scope, error)
	// ClearRoleScopes clears the scopes for provided roles/accounts.
	ClearRoleScopes(ctx context.Context, roles ...Role) error
	// GrantRoleScope grants roles/accounts access for given scope.
	GrantRoleScope(ctx context.Context, role Role, scope Scope) error
	// RevokeRoleScope revokes the roles/accounts access for given scope.
	RevokeRoleScope(ctx context.Context, role Role, scope Scope) error
}

type Roler interface {
	// FindRoles list all roles for
	FindRoles(ctx context.Context, options ...ListRoleOption) ([]Role, error)
	// ClearRoles clears all roles for given account.
	ClearRoles(ctx context.Context, account Account) error
	// GrantRole grants given 'role' access to given 'scope'.
	GrantRole(ctx context.Context, account Account, role Role) error
	// RevokeRole revokes access to given 'scope' for the 'role'.
	RevokeRole(ctx context.Context, account Account, role Role) error
}

type SaltFielder interface {
	SaltField() string
}

type SaltGetter interface {
	GetSalt() []byte
}

type SaltSetter interface {
	SetSalt(salt []byte)
}

type Salter interface {
	SaltFielder
	SaltSetter
	SaltGetter
}

type Scope interface {
	ScopeName() string
}

type Scoper interface {
	Scope() string
}

type SigningMethod interface {
	Verify(signingString, signature string, key interface{}) error
	Sign(signingString string, key interface{}) (string, error)
	Alg() string
}

type Token struct {
	// AccessToken is the string access token.
	AccessToken string
	// RefreshToken defines the token.
	RefreshToken string
	// ExpiresIn defines the expiration time for given access token.
	ExpiresIn int
	// TokenType defines the token type.
	TokenType string
}

type TokenOption func(o *TokenOptions)

type TokenOptions struct {
	// ExpirationTime is the expiration time of the token.
	ExpirationTime time.Duration
	// RefreshExpirationTime is the expiration time for refresh token
	RefreshExpirationTime time.Duration
	// RefreshToken is the optional refresh token used on token creation, when the refresh token is still valid (optional).
	RefreshToken string

	// Optional settings.
	//
	// Scope contains space separated authorization scopes that the token is available for (optional).
	Scope string
	// Audience is the audience of the token.
	Audience string
	// Issuer is the token issuer name.
	Issuer string
	// NotBefore is an option that sets the token to be valid not before provided time.
	NotBefore time.Time
}

type Tokener interface {
	// InspectToken extracts claims from the token.
	InspectToken(ctx context.Context, token string) (claims Claims, err error)
	// Token creates the token for provided options.
	Token(ctx context.Context, account Account, options ...TokenOption) (Token, error)
	// RevokeToken revokes provided 'token'
	RevokeToken(ctx context.Context, token string) error
}

type TokenerOption func(o *TokenerOptions)

type TokenerOptions struct {
	// Model is the account model used by the tokener.
	Model Account
	// Store is a store used for some authenticator implementations.
	Store store.Store
	// Secret is the authorization secret.
	Secret []byte
	// RsaPrivateKey is used for encoding the token using RSA methods.
	RsaPrivateKey *rsa.PrivateKey
	// EcdsaPrivateKey is used for encoding the token using ECDSA methods.
	EcdsaPrivateKey *ecdsa.PrivateKey
	// TokenExpiration is the default token expiration time.
	TokenExpiration time.Duration
	// RefreshTokenExpiration is the default refresh token expiration time,.
	RefreshTokenExpiration time.Duration
	// SigningMethod is the token signing method.
	SigningMethod SigningMethod
	// TimeFunc sets the time function for given tokener.
	TimeFunc func() time.Time
}

type UsernameValidator func(username string) error

type Verifier interface {
	// Authorize if the is allowed to access the resource. The resourceID is a unique resource identifier.
	Verify(ctx context.Context, account Account, options ...VerifyOption) error
}

type VerifyOption func(o *VerifyOptions)

type VerifyOptions struct {
	AllowedRoles    []Role
	DisallowedRoles []Role
	Scopes          []Scope
}