Initial commit.

internal/authproxy/claims.go

@@ -0,0 +1,37 @@
+package authproxy
+
+// stateClaims rides through Google's OAuth flow as the `state` parameter.
+// It remembers which app host the user was visiting and where to send them
+// after sign-in.
+type stateClaims struct {
+	Host  string `json:"h"` // app host the user was visiting
+	RD    string `json:"r"` // relative path to return to
+	Proto string `json:"p"` // http or https
+	Nonce string `json:"n"`
+	Exp   int64  `json:"e"` // unix seconds
+}
+
+// handoffClaims is the short-lived token the callback (on the auth host)
+// hands to the destination app host so it can mint a session cookie on its
+// own domain.
+type handoffClaims struct {
+	Email string `json:"em"`
+	User  string `json:"u"` // Google account id (sub)
+	Name  string `json:"na"`
+	Host  string `json:"h"`
+	RD    string `json:"r"`
+	Proto string `json:"p"`
+	Nonce string `json:"n"`
+	Exp   int64  `json:"e"`
+}
+
+// sessionClaims is the content of the session cookie. Cookies are host-only
+// (no Domain attribute) and additionally pinned to the host they were minted
+// for.
+type sessionClaims struct {
+	Email string `json:"em"`
+	User  string `json:"u"`
+	Name  string `json:"na"`
+	Host  string `json:"h"`
+	Exp   int64  `json:"e"`
+}