authenticate

type AuthMethod string

type ClientAssertion string

type Config struct {
	// CallbackURLs is external host used for redirect uri
	// host specified at 0th index will be used as default
	CallbackURLs []string `yaml:"callback_urls" mapstructure:"callback_urls" default:"[http://localhost:7400/v1beta1/auth/callback]"`

	AuthorizedRedirectURLs []string `yaml:"authorized_redirect_urls" mapstructure:"authorized_redirect_urls" `

	OIDCConfig map[string]OIDCConfig `yaml:"oidc_config" mapstructure:"oidc_config"`
	Session    SessionConfig         `yaml:"session" mapstructure:"session"`
	Token      TokenConfig           `yaml:"token" mapstructure:"token"`
	MailOTP    MailOTPConfig         `yaml:"mail_otp" mapstructure:"mail_otp"`
	MailLink   MailLinkConfig        `yaml:"mail_link" mapstructure:"mail_link"`
	PassKey    PassKeyConfig         `yaml:"passkey" mapstructure:"passkey"`
	TestUsers  testusers.Config      `yaml:"test_users" mapstructure:"test_users"`
}

type Flow struct {
	ID uuid.UUID

	// authentication flow type
	Method string

	// Email is the email of the user
	Email string

	// StartURL is where flow should start from for verification
	StartURL string
	// FinishURL is where flow should end to after successful verification
	FinishURL string

	// Nonce is a once time use random string
	Nonce string

	Metadata metadata.Metadata

	// CreatedAt will be used to clean-up dead auth flows
	CreatedAt time.Time

	// ExpiresAt is the time when the flow will expire
	ExpiresAt time.Time
}

type FlowRepository interface {
	Set(ctx context.Context, flow *Flow) error
	Get(ctx context.Context, id uuid.UUID) (*Flow, error)
	Delete(ctx context.Context, id uuid.UUID) error
	DeleteExpiredFlows(ctx context.Context) error
}

type MailLinkConfig struct {
	Subject  string        `yaml:"subject" mapstructure:"subject" default:"Frontier Login - One time link"`
	Body     string        `` /* 225-byte string literal not displayed */
	Validity time.Duration `yaml:"validity" mapstructure:"validity" default:"10m"`
}

type MailOTPConfig struct {
	Subject  string        `yaml:"subject" mapstructure:"subject" default:"Frontier Login - OTP"`
	Body     string        `` /* 149-byte string literal not displayed */
	Validity time.Duration `yaml:"validity" mapstructure:"validity" default:"10m"`
}

type OIDCConfig struct {
	ClientID     string        `yaml:"client_id" mapstructure:"client_id"`
	ClientSecret string        `yaml:"client_secret" mapstructure:"client_secret"`
	IssuerUrl    string        `yaml:"issuer_url" mapstructure:"issuer_url"`
	Validity     time.Duration `yaml:"validity" mapstructure:"validity" default:"15m"`
}

type PassKeyConfig struct {
	RPDisplayName string   `yaml:"rpdisplayname"`
	RPID          string   `yaml:"rpid"`
	RPOrigins     []string `yaml:"rporigins"`
}

type Principal struct {
	ID   string
	Type string

	User        *user.User
	ServiceUser *serviceuser.ServiceUser
}

type RegistrationFinishRequest struct {
	Method string

	// used for OIDC & mail otp auth strategy
	Code        string
	State       string
	StateConfig map[string]any
}

type RegistrationFinishResponse struct {
	User user.User
	Flow *Flow
}

type RegistrationStartRequest struct {
	Method string
	// ReturnToURL is where flow should end to after successful verification
	ReturnToURL string
	Email       string

	// callback_url will be used by strategy as last step to finish authentication flow
	// in OIDC this host will receive "state" and "code" query params, in case of magic links
	// this will be the url where user is redirected after clicking on magic link.
	// For most cases it could be host of frontier but in case of proxies, this will be proxy public endpoint.
	// callback_url should be one of the allowed urls configured at instance level
	CallbackUrl string
}

type RegistrationStartResponse struct {
	Flow        *Flow
	State       string
	StateConfig map[string]any
}

type Service struct {
	Now func() time.Time
	// contains filtered or unexported fields
}

type ServiceUserService interface {
	GetByJWT(ctx context.Context, token string) (serviceuser.ServiceUser, error)
	GetBySecret(ctx context.Context, clientID, clientSecret string) (serviceuser.ServiceUser, error)
}

type SessionConfig struct {
	HashSecretKey  string `mapstructure:"hash_secret_key" yaml:"hash_secret_key" default:"hash-secret-should-be-32-chars--"`
	BlockSecretKey string `mapstructure:"block_secret_key" yaml:"block_secret_key" default:"block-secret-should-be-32-chars-"`
	Domain         string `mapstructure:"domain" yaml:"domain" default:""`
	// SameSite can be set to "default", "lax", "strict" or "none"
	SameSite string `mapstructure:"same_site" yaml:"same_site" default:"lax"`
	// Validity is the duration for which the session is valid
	Validity time.Duration `mapstructure:"validity" yaml:"validity" default:"720h"`
	Secure   bool          `mapstructure:"secure" yaml:"secure" default:"false"`
}

type SessionService interface {
	ExtractFromContext(ctx context.Context) (*frontiersession.Session, error)
}

type TokenClaimConfig struct {
	AddOrgIDsClaim    bool `yaml:"add_org_ids" mapstructure:"add_org_ids" default:"true"`
	AddUserEmailClaim bool `yaml:"add_user_email" mapstructure:"add_user_email" default:"true"`
}

type TokenConfig struct {
	// Path to rsa key file, it can contain more than one key as a json array
	// jwt will be signed by first key, but will be tried to be decoded by all matching key ids, this helps in key rotation.
	// If not provided, access token will not be generated
	RSAPath string `yaml:"rsa_path" mapstructure:"rsa_path"`
	// RSABase64 is base64 encoded rsa key, it can contain more than one key as a json array
	RSABase64 string `yaml:"rsa_base64" mapstructure:"rsa_base64"`

	// Issuer uniquely identifies the service that issued the token
	// a good example could be fully qualified domain name
	Issuer string `yaml:"iss" mapstructure:"iss" default:"frontier"`

	// Validity is the duration for which the token is valid
	Validity time.Duration `yaml:"validity" mapstructure:"validity" default:"1h"`

	Claims TokenClaimConfig `yaml:"claims" mapstructure:"claims"`
}

type UserService interface {
	GetByID(ctx context.Context, id string) (user.User, error)
	Create(context.Context, user.User) (user.User, error)
	Update(ctx context.Context, toUpdate user.User) (user.User, error)
}