auth

type AuthnConfig struct {
	OIDCConfig    *ProviderConfig `mapstructure:"oidc"`
	RefreshConfig *RefreshConfig  `mapstructure:"refresh"`

	// tell grpc if this auth config requires transport security
	DisableTransportSecurity bool `mapstructure:"disableTransportSecurity"`
	// contains filtered or unexported fields
}

type AuthnRefresher interface {
	Update(creds *ClientCredentials)
}

type ClientCredentials struct {
	// Required - ClientID is used for OIDC authentication of requests
	ClientID string `yaml:"id"`
	// Required - ClientSecret to use for OIDC authentication of requests
	ClientSecret string `yaml:"secret"` //nolint:gosec // G117: false positive - this is a configuration struct
}

type GRPCTokenSource interface {
	credentials.PerRPCCredentials
	AuthnRefresher
}

type InmemoryTokenStore struct {
	// contains filtered or unexported fields
}

type IntervalTokenRefresher struct {
	// contains filtered or unexported fields
}

type LoggingTransport struct {
	// contains filtered or unexported fields
}

type Option func(ts *grpcOauth2TokenSource)

type ProviderConfig struct {
	// Required - Host is the hostname of the authn server.
	Host string
	// Optional - CredentialsFile is the containing Client ID/Secret
	CredentialsFile string
	// Optional - ClientID is used for OIDC authentication of requests
	ClientID string
	// Optional - ClientSecret to use for OIDC authentication of requests
	ClientSecret string //nolint:gosec // G117: false positive - this is a configuration struct
	// Required - Scope(s) to request
	Scopes []string
	// Client name to use for authn setup
	ClientName string `mapstructure:",omitempty"`
	// contains filtered or unexported fields
}

type RefreshConfig struct {
	// Optional - Interval to use for token refresh. If not provided, background token refresh is not enabled.
	Interval int64
	// Optional - CredentialsRefreshInterval is the interval in seconds to periodically re-read the credentials file.
	// This is more reliable than file watching alone, as it handles atomic file replacements (e.g., vault-agent).
	// Recommended value: 300 (5 minutes). If 0, periodic refresh is disabled and only file watching is used.
	CredentialsRefreshInterval int64 `mapstructure:"credentialsRefreshInterval"`
}

type RefresherTokenSource struct {
	// contains filtered or unexported fields
}

type TLSConfigOptions struct {
	Enabled            bool     `mapstructure:"enabled"`
	CertFile           string   `mapstructure:"cert-file,omitempty"`
	KeyFile            string   `mapstructure:"key-file,omitempty"`
	ClientCACertFiles  []string `mapstructure:"client-ca-cert-file,omitempty"`
	RootCAFile         string   `mapstructure:"root-ca-file,omitempty"`
	InsecureSkipVerify bool     `mapstructure:"insecure-skip-verify"`

	ClientCAPool *x509.CertPool   `json:"-"`
	RootCAPool   *x509.CertPool   `json:"-"`
	Cert         *tls.Certificate `json:"-"`
}

type TokenRefresherConfig struct {
	ClientConfig *clientcredentials.Config

	// to discriminate different usage - mygroup or controller
	Id string
	// contains filtered or unexported fields
}

type TokenStore interface {
	// contains filtered or unexported methods
}

type UAMPolicyConfig struct {
	Namespace  string `mapstructure:"namespace"`
	PolicyFQDN string `mapstructure:"name"`
}