oauth_metadata.h

#ifndef SOURCEMETA_CORE_OAUTH_METADATA_H_
#define SOURCEMETA_CORE_OAUTH_METADATA_H_
 
#ifndef SOURCEMETA_CORE_OAUTH_EXPORT
#include <sourcemeta/core/oauth_export.h>
#endif
 
#include <sourcemeta/core/json.h>
 
#include <cstdint>     // std::uint8_t
#include <optional>    // std::optional
#include <span>        // std::span
#include <string>      // std::string
#include <string_view> // std::string_view
 
namespace sourcemeta::core {

enum class OAuthWellKnownKind : std::uint8_t {
  AuthorizationServer,
  ProtectedResource,
  OpenIDConfigurationInserted,
  OpenIDConfigurationAppended
};

SOURCEMETA_CORE_OAUTH_EXPORT
auto oauth_well_known_url(const std::string_view identifier,
                          const OAuthWellKnownKind kind, std::string &sink)
    -> bool;

SOURCEMETA_CORE_OAUTH_EXPORT
auto oauth_is_endpoint_url(const std::string_view value) -> bool;

SOURCEMETA_CORE_OAUTH_EXPORT
auto oauth_is_resource_identifier(const std::string_view value) -> bool;

SOURCEMETA_CORE_OAUTH_EXPORT
auto oauth_is_issuer_identifier(const std::string_view value) -> bool;
 
#if defined(_MSC_VER)
#pragma warning(disable : 4251)
#endif

class SOURCEMETA_CORE_OAUTH_EXPORT OAuthServerMetadata {
public:
  OAuthServerMetadata(JSON &&data, const std::string_view issuer);

  [[nodiscard]] static auto from(JSON &&data, const std::string_view issuer)
      -> std::optional<OAuthServerMetadata>;

  [[nodiscard]] auto issuer() const -> std::string_view;

  [[nodiscard]] auto authorization_endpoint() const
      -> std::optional<std::string_view>;

  [[nodiscard]] auto token_endpoint() const -> std::optional<std::string_view>;

  [[nodiscard]] auto registration_endpoint() const
      -> std::optional<std::string_view>;

  [[nodiscard]] auto device_authorization_endpoint() const
      -> std::optional<std::string_view>;

  [[nodiscard]] auto revocation_endpoint() const
      -> std::optional<std::string_view>;

  [[nodiscard]] auto introspection_endpoint() const
      -> std::optional<std::string_view>;

  [[nodiscard]] auto jwks_uri() const -> std::optional<std::string_view>;

  [[nodiscard]] auto pushed_authorization_request_endpoint() const
      -> std::optional<std::string_view>;

  [[nodiscard]] auto require_pushed_authorization_requests() const -> bool;

  [[nodiscard]] auto authorization_response_iss_parameter_supported() const
      -> bool;

  [[nodiscard]] auto supports_response_type(const std::string_view value) const
      -> bool;

  [[nodiscard]] auto supports_grant_type(const std::string_view value) const
      -> bool;

  [[nodiscard]] auto
  supports_code_challenge_method(const std::string_view value) const -> bool;

  [[nodiscard]] auto
  supports_token_endpoint_auth_method(const std::string_view value) const
      -> bool;

  [[nodiscard]] auto
  supports_protected_resource(const std::string_view value) const -> bool;

  [[nodiscard]] auto data() const -> const JSON &;
 
private:
  JSON data_;
};

class SOURCEMETA_CORE_OAUTH_EXPORT OAuthResourceMetadata {
public:
  OAuthResourceMetadata(JSON &&data, const std::string_view resource);

  [[nodiscard]] static auto from(JSON &&data, const std::string_view resource)
      -> std::optional<OAuthResourceMetadata>;

  [[nodiscard]] auto resource() const -> std::string_view;

  [[nodiscard]] auto first_authorization_server() const
      -> std::optional<std::string_view>;

  [[nodiscard]] auto
  supports_authorization_server(const std::string_view value) const -> bool;

  [[nodiscard]] auto jwks_uri() const -> std::optional<std::string_view>;

  [[nodiscard]] auto supports_bearer_method(const std::string_view value) const
      -> bool;

  [[nodiscard]] auto supports_scope(const std::string_view value) const -> bool;

  [[nodiscard]] auto dpop_bound_access_tokens_required() const -> bool;

  [[nodiscard]] auto resource_name() const -> std::optional<std::string_view>;

  [[nodiscard]] auto resource_documentation() const
      -> std::optional<std::string_view>;

  [[nodiscard]] auto resource_policy_uri() const
      -> std::optional<std::string_view>;

  [[nodiscard]] auto resource_tos_uri() const
      -> std::optional<std::string_view>;

  [[nodiscard]] auto tls_client_certificate_bound_access_tokens() const -> bool;

  [[nodiscard]] auto
  supports_resource_signing_alg(const std::string_view value) const -> bool;

  [[nodiscard]] auto
  supports_dpop_signing_alg(const std::string_view value) const -> bool;

  [[nodiscard]] auto
  supports_authorization_details_type(const std::string_view value) const
      -> bool;

  [[nodiscard]] auto data() const -> const JSON &;
 
private:
  JSON data_;
};
 
#if defined(_MSC_VER)
#pragma warning(default : 4251)
#endif

struct OAuthServerMetadataConfig {
  std::string_view issuer;
  std::string_view authorization_endpoint;
  std::string_view token_endpoint;
  std::string_view registration_endpoint;
  std::string_view jwks_uri;
  std::span<const std::string_view> response_types_supported;
  std::span<const std::string_view> grant_types_supported;
  std::span<const std::string_view> code_challenge_methods_supported;
  std::span<const std::string_view> token_endpoint_auth_methods_supported;
  std::span<const std::string_view>
      token_endpoint_auth_signing_alg_values_supported;
  std::span<const std::string_view> scopes_supported;
  std::string_view pushed_authorization_request_endpoint;
  bool require_pushed_authorization_requests{false};
  std::span<const std::string_view> protected_resources;
};

SOURCEMETA_CORE_OAUTH_EXPORT
auto oauth_make_server_metadata(const OAuthServerMetadataConfig &config)
    -> std::optional<JSON>;

struct OAuthResourceMetadataConfig {
  std::string_view resource;
  std::span<const std::string_view> authorization_servers;
  std::string_view jwks_uri;
  std::span<const std::string_view> scopes_supported;
  std::optional<std::span<const std::string_view>> bearer_methods_supported;
  std::span<const std::string_view> resource_signing_alg_values_supported;
  std::string_view resource_name;
  std::string_view resource_documentation;
  std::string_view resource_policy_uri;
  std::string_view resource_tos_uri;
  bool tls_client_certificate_bound_access_tokens{false};
  std::span<const std::string_view> authorization_details_types_supported;
  std::span<const std::string_view> dpop_signing_alg_values_supported;
  bool dpop_bound_access_tokens_required{false};
};

SOURCEMETA_CORE_OAUTH_EXPORT
auto oauth_make_resource_metadata(const OAuthResourceMetadataConfig &config)
    -> std::optional<JSON>;
 
} // namespace sourcemeta::core
 
#endif