auth

type Auth struct {
	// If set, will attempt to load the key and certs from storage, and save the generated ones.
	// Config is a simple interface for blob storage.
	Config ConfStore

	// Name and domain to include in the self-signed cert.
	Name string

	// Identifies the domain of the node.
	// Added to the 'sub' field in Vapid messages. Can be an email or domain.
	Domain string

	// Primary VIP, Created from the Pub key, will be included in the self-signed cert.
	VIP6 net.IP
	// Same as VIP6, but as uint64
	VIP64 uint64

	// Primary public key of the node.
	// EC256: 65 bytes, uncompressed format
	// RSA: DER
	// ED25519: 32B
	Pub []byte

	// base64URL encoding of the primary public key.
	// Will be added to Crypto-Keys p256ecdsa header field.
	PubKey string

	// Private key to use in both server and client authentication. This is the base of the VIP of the node.
	// ED22519: 32B
	// EC256: 32
	// RSA: DER
	Priv []byte

	// Primary private keys. This is a long-lived key, used as SSH server
	// key.
	EC256PrivateKey *ecdsa.PrivateKey

	// Secondary private keys.
	RSAPrivate *rsa.PrivateKey
	EDPrivate  *ed25519.PrivateKey

	// List of authorized keys and roles, for minimal Authz.
	// Key is the string(marshalled_form). For example EC256 it's a byte[65]
	// Value is list of roles for the key.
	Authorized map[string]string
	Known      map[string]*AuthzInfo

	Authz     map[string]*AuthzInfo
	AuthzByID map[uint64]*AuthzInfo
	// contains filtered or unexported fields
}

type AuthzInfo struct {
	// Role - stored as comment of the SSH authz keys
	Role string

	Public []byte

	Opts map[string]string

	// key.(*ecdsa.PublicKey)
	// key.(*rsa.PublicKey)
	// key.(ed25519.PublicKey)
	Key crypto.PublicKey
}

type ConfStore interface {
	// Get a config blob by name
	Get(name string) ([]byte, error)

	// Save a config blob
	Set(conf string, data []byte) error

	// List the configs starting with a prefix, of a given type
	List(name string, tp string) ([]string, error)
}

type ReqContext struct {
	// Auth role - set if a authorized_keys or other authz is configured
	Role string

	// SAN list from the certificate, or equivalent auth method.
	SAN []string

	// Request start time
	T0 time.Time

	// Public key of the first cert in the chain (similar with SSH)
	Pub []byte

	// VIP associated with the public key.
	VIP net.IP

	VAPID *auth.JWT
}

type Subscription struct {
	// Endpoint is the URL to send the Web Push message to. Comes from the
	// endpoint field of the PushSubscription.
	Endpoint string

	// Key is the client's public key. From the getKey("p256dh") or keys.p256dh field.
	Key []byte

	// Auth is a value used by the client to validate the encryption. From the
	// keys.auth field.
	// The encrypted aes128gcm will have 16 bytes authentication tag derived from this.
	// This is the pre-shared authentication secret.
	Auth []byte

	// Used by the UA to receive messages, as PUSH promises
	Location string
}