oidc.go RawHistoryFolder

1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package ports
4
5import (
6	"context"
7	"time"
8
9	"bnema.dev/ermite/internal/domain"
10)
11
12// OIDCKeyStore keeps the signing keys of the ID tokens of CI jobs.
13// *kvstore.Store implements it.
14type OIDCKeyStore interface {
15	// ListOIDCKeys returns every stored key, oldest first.
16	ListOIDCKeys(ctx context.Context) ([]domain.OIDCKey, error)
17	// SaveOIDCKeys writes the keys of put (created or replaced) and deletes the
18	// keys whose ids are in drop, in one batch.
19	SaveOIDCKeys(ctx context.Context, put []domain.OIDCKey, drop []string) error
20}
21
22// OIDCService is the OIDC provider of CI jobs, served under /-/oidc: the
23// discovery document, the JWKS and the token endpoint. *usecase.CI implements
24// it.
25type OIDCService interface {
26	// OIDCEnabled reports whether the server issues ID tokens (it has a secrets
27	// key to seal its signing key with). When it does not, the other methods
28	// give domain.ErrNotFound.
29	OIDCEnabled() bool
30	// OIDCDiscovery returns the JSON of the OpenID Provider configuration.
31	OIDCDiscovery() ([]byte, error)
32	// OIDCKeys returns the JSON of the JWKS: the key that signs and the keys
33	// replaced less than domain.OIDCKeyRetention ago.
34	OIDCKeys() ([]byte, error)
35	// IDToken returns a signed ID token of the job whose request token is
36	// secret, for audience ("" for the default). A secret that is not the
37	// request token of a job that is assigned or running gives
38	// domain.ErrUnauthenticated; an audience that is too long gives a
39	// domain.InvalidFieldsError.
40	IDToken(ctx context.Context, secret, audience string) (string, error)
41}
42
43// OIDCRotation is the outcome of a key rotation.
44type OIDCRotation struct {
45	Issuer string
46	// Kid is the id of the new key, RetiredKid the one it replaced ("" for
47	// none), published until RetiredUntil.
48	Kid          string
49	RetiredKid   string
50	RetiredUntil time.Time
51}
52
53// OIDCKeyService manages the signing key of the ID tokens. *usecase.OIDC
54// implements it.
55type OIDCKeyService interface {
56	// Enabled reports whether the server issues ID tokens.
57	Enabled() bool
58	// RotateKey replaces the signing key by a new one. It needs owner rights.
59	RotateKey(ctx context.Context, p domain.Principal) (OIDCRotation, error)
60}