openid

type AccessToken struct {
	Audience  string `json:"aud"`
	Subject   string `json:"sub"`
	Scope     string `json:"scope"`
	ExpiresAt int64  `json:"exp"`
	IssuedAt  int64  `json:"iat"`
}

type Address struct {
	Formatted     string `json:"formatted"`
	StreetAddress string `json:"street_address"`
	Locality      string `json:"locality"`
	Region        string `json:"region"`
	PostalCode    string `json:"postal_code"`
	Country       string `json:"country"`
}

type AuthRequest struct {
	ClientId     string
	ResponseType string // code, token, id_token
	Scope        string
	State        string
	RedirectUri  string
	Nonce        string
}

type AuthResponse struct {
	// for ReponseType = code
	Code string

	// for ReponseType = token
	TokenType    string `json:"token_type"`
	AccessToken  string `json:"access_token"`
	ExpiresIn    int64  `json:"expires_in,omitempty"`
	RefreshToken string `json:"refresh_token,omitempty"`
	Scope        string `json:"scope,omitempty"`

	// for ReponseType = id_token
	IdToken string `json:"id_token,omitempty"`

	State string `json:"state,omitempty"`
}

type Configuration struct {
	Issuer                                     string   `json:"issuer"`
	AuthorizationEndpoint                      string   `json:"authorization_endpoint"`
	TokenEndpoint                              string   `json:"token_endpoint"`
	TokenIntrospectionEndpoint                 string   `json:"token_introspection_endpoint"`
	UserinfoEndpoint                           string   `json:"userinfo_endpoint"`
	EndSessionEndpoint                         string   `json:"end_session_endpoint"`
	JwksUri                                    string   `json:"jwks_uri"`
	CheckSessionIframe                         string   `json:"check_session_iframe"`
	GrantTypesSupported                        []string `json:"grant_types_supported"`
	ResponseTypesSupported                     []string `json:"response_types_supported"`
	SubjectTypesSupported                      []string `json:"subject_types_supported"`
	IdTokenSigningAlgValuesSupported           []string `json:"id_token_signing_alg_values_supported"`
	UserinfoSigningAlgValuesSupported          []string `json:"userinfo_signing_alg_values_supported"`
	RequestObjectSigningAlgValuesSupported     []string `json:"request_object_signing_alg_values_supported"`
	ResponseModesSupported                     []string `json:"response_modes_supported"`
	RegistrationEndpoint                       string   `json:"registration_endpoint"`
	TokenEndpoinAuthMethodsSupported           []string `json:"token_endpoint_auth_methods_supported"`
	TokenEndpointAuthSigningAlgValuesSupported []string `json:"token_endpoint_auth_signing_alg_values_supported"`
	ClaimsSupported                            []string `json:"claims_supported"`
	ClaimTypesSupported                        []string `json:"claim_types_supported"`
	ClaimsParameterSupported                   bool     `json:"claims_parameter_supported"`
	ScopesSupported                            []string `json:"scopes_supported"`
	RequestParameterSupported                  bool     `json:"request_parameter_supported"`
	RequestUriParameterSupported               bool     `json:"request_uri_parameter_supported"`
	CodeChallengeMethodsSupported              []string `json:"code_challenge_methods_supported"`
	TlsClientCertificateBoundAccessTokens      bool     `json:"tls_client_certificate_bound_access_tokens"`
}

type IdTokenClaims struct {
	Audience string `json:"aud"`
	Issuer   string `json:"iss"`
	Userinfo
	Nonce string `json:"nonce"`
}

type JWK struct {
	Algorithm interface{}
	Use       string
	KeyId     string
}

type KeySet map[string]*JWK

type RevokeTokenRequest struct {
	Token         string
	TokenTypeHint string
}

type Scopes []string

type Server struct {
	Addr string

	Config *Configuration

	RefreshTokenKey []byte
	TokenKey        []byte
	TokenExpiry     time.Duration

	SessionStore SessionStore
	UserStore    UserStore

	GrantScopes func(ctx context.Context, aud string, sub string, scopes []string) (grantedScopes []string, err error)
	// contains filtered or unexported fields
}

type Session struct {
	IssuedAt  time.Time
	ExpiresAt time.Time
	Aud       string
	Subject   string
	Scopes    []string

	Server *Server
}

type SessionStore interface {
	RefreshSession(ctx context.Context, id string, filterScopes []string) (sub string, grantedScopes []string, err error)
	CreateSession(ctx context.Context, aud string, sub string, scopes []string) (id string, err error)
	RevokeSession(ctx context.Context, id string) (err error)
}

type SocialProvider struct {
	Issuer  string `json:"iss"`
	Profile string `json:"profile,omitempty"`
	Picture string `json:"picture,omitempty"`
	Website string `json:"website,omitempty"`
}

type TokenRequest struct {
	GrantType string `json:"grant_type"` // authorization_code, refresh_token

	// for GrantType = authorization_code
	// https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3
	Code        string `json:"code"`
	RedirectUri string `json:"redirect_uri"` // must match the redirect_uri in the auth request
	ClientId    string `json:"client_id"`

	// for GrantType = refresh_token
	// https://www.rfc-editor.org/rfc/rfc6749#section-6
	RefreshToken string `json:"refresh_token"`
	Scope        string `json:"scope"`

	Nonce string `json:"nonce"`
}

type TokenResponse struct {
	// for ResponseType = token
	TokenType    string `json:"token_type"`
	AccessToken  string `json:"access_token"`
	ExpiresIn    int64  `json:"expires_in,omitempty"`
	RefreshToken string `json:"refresh_token,omitempty"`
	Scope        string `json:"scope,omitempty"`

	// for ReponseType = id_token
	IdToken string `json:"id_token,omitempty"`

	State string `json:"state,omitempty"`
}

type UserStore interface {
	Userinfo(ctx context.Context, sub string) (*Userinfo, error)
}

type Userinfo struct {
	Subject   string `json:"sub,omitempty"`
	CreatedAt int64  `json:"created_at,omitempty"`

	Name       string `json:"name,omitempty"`
	GivenName  string `json:"given_name,omitempty"`
	FamilyName string `json:"family_name,omitempty"`
	MiddleName string `json:"middle_name,omitempty"`
	Nickname   string `json:"nickname,omitempty"`

	PreferredUsername         string `json:"preferred_username,omitempty"`
	PreferredUsernameVerified bool   `json:"preferred_username_verified"`

	Profile string `json:"profile,omitempty"`
	Picture string `json:"picture,omitempty"`
	Website string `json:"website,omitempty"`

	Email         string `json:"email"`
	EmailVerified bool   `json:"email_verified"`

	Gender              string   `json:"gender,omitempty"`
	Birthdate           string   `json:"birthdat,omitempty"`
	Zoneinfo            string   `json:"zoneinfo,omitempty"`
	Locale              string   `json:"locale,omitempty"`
	PhoneNumber         string   `json:"phone_number,omitempty"`
	PhoneNumberVerified bool     `json:"phone_number_verified"`
	Address             *Address `json:"address,omitempty"`

	SocialProviders []*SocialProvider `json:"social_providers,omitempty"`

	UpdatedAt int64 `json:"updated_at,omitempty"`
}

type UserinfoUpdate struct {
	Subject string `json:"sub,omitempty"`

	Name       *string `json:"name"`
	GivenName  *string `json:"given_name"`
	FamilyName *string `json:"family_name"`
	MiddleName *string `json:"middle_name"`
	Nickname   *string `json:"nickname"`

	PreferredUsername *string `json:"preferred_username"`

	Email         *string `json:"email"`
	EmailVerified *bool   `json:"email_verified"`

	Gender    *string  `json:"gender"`
	Birthdate *string  `json:"birthdate"`
	Zoneinfo  *string  `json:"zoneinfo"`
	Locale    *string  `json:"locale"`
	Address   *Address `json:"address"`

	Password *string `json:"password,omitempty"`
}