// Code generated by smithy-go-codegen DO NOT EDIT.

package signin

import (
	"context"
	"github.com/aws/smithy-go/middleware"
	"github.com/aws/smithy-go/ptr"
)

// Grants permission to inspect the metadata and state of an OAuth 2.0 access
// token or refresh token
//
// Implements RFC 7662 OAuth 2.0 Token Introspection over a SigV4-authenticated
// endpoint. Inspects the metadata of an access_token or refresh_token issued by
// AWS Sign-In and returns the claims associated with it.
//
// Inactive token semantics (RFC 7662 §2.2): when the supplied token is unknown,
// expired, revoked, malformed, or owned by a different account, the response body
// is exactly { "active": false } with all other claims omitted.
func (c *Client) IntrospectOAuth2TokenWithIAM(ctx context.Context, params *IntrospectOAuth2TokenWithIAMInput, optFns ...func(*Options)) (*IntrospectOAuth2TokenWithIAMOutput, error) {
	if params == nil {
		params = &IntrospectOAuth2TokenWithIAMInput{}
	}

	result, metadata, err := c.invokeOperation(ctx, "IntrospectOAuth2TokenWithIAM", params, optFns, c.addOperationIntrospectOAuth2TokenWithIAMMiddlewares)
	if err != nil {
		return nil, err
	}

	out := result.(*IntrospectOAuth2TokenWithIAMOutput)
	out.ResultMetadata = metadata
	return out, nil
}

// Input structure for IntrospectOAuth2TokenWithIAM operation
//
// RFC 7662 §2.1 introspection request. Contains the token to inspect and an
// optional hint about the token's type.
type IntrospectOAuth2TokenWithIAMInput struct {

	// The string value of the token to introspect. May be either an access_token or a
	// refresh_token issued by AWS Sign-In.
	//
	// This member is required.
	Token *string

	// Optional hint about the type of the token submitted for introspection. The
	// server uses this hint to optimize lookup, but still falls back to the other
	// token type on miss. Allowed values: access_token, refresh_token.
	TokenTypeHint *string

	noSmithyDocumentSerde
}

func (in *IntrospectOAuth2TokenWithIAMInput) bindEndpointParams(p *EndpointParameters) {

	p.IsOAuthEndpoint = ptr.Bool(true)
}

// Output structure for IntrospectOAuth2TokenWithIAM operation
//
// RFC 7662 §2.2 introspection response. Only active is required; all other claims
// are omitted when the token is inactive.
type IntrospectOAuth2TokenWithIAMOutput struct {

	// Indicates whether the token is currently active. true only when the token is
	// valid, has not expired, has not been revoked, and belongs to the caller's
	// account.
	//
	// This member is required.
	Active *bool

	// 12-digit AWS account ID of the token's subject principal.
	AccountId *string

	// Audience of the token: the OAuth resource the token is scoped to (for example,
	// "aws-mcp.amazonaws.com"). Omitted for refresh tokens.
	Aud *string

	// Client identifier for the OAuth 2.0 client that requested the token.
	ClientId *string

	// Token expiration time as a NumericDate (Unix epoch seconds).
	Exp *int64

	// Token issuance time as a NumericDate (Unix epoch seconds).
	Iat *int64

	// Issuer of the token. Always "signin.amazonaws.com" for AWS Sign-In.
	Iss *string

	// Unique identifier for the token.
	Jti *string

	// Token "not before" time as a NumericDate (Unix epoch seconds).
	Nbf *int64

	// The OAuth resource the token is scoped to during Human OAuth flow. Only present
	// for refresh token introspection.
	Resource *string

	// AWS Sign-In session ARN bound to the token, of the form
	// arn:aws:signin:{region}:{account}:session/{uuid}.
	SigninSession *string

	// Subject of the token: the IAM principal ARN. For assumed-role sessions, this is
	// the session ARN (matches sts:GetCallerIdentity's Arn field), e.g.
	// arn:aws:sts::123456789012:assumed-role/MyRole/session-name.
	Sub *string

	// Indicates which kind of token was introspected. One of "access_token" or
	// "refresh_token".
	TokenType *string

	// User identifier matching sts:GetCallerIdentity's UserId field for the token's
	// subject principal (e.g. "AIDAEXAMPLE" for an IAM user, or
	// "AROAEXAMPLE:session-name" for an assumed role).
	UserId *string

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata

	noSmithyDocumentSerde
}

func (c *Client) addOperationIntrospectOAuth2TokenWithIAMMiddlewares(stack *middleware.Stack, options Options) (err error) {
	err = stack.Serialize.Add(&awsRestjson1_serializeOpIntrospectOAuth2TokenWithIAM{}, middleware.After)
	if err != nil {
		return err
	}
	err = stack.Deserialize.Add(&awsRestjson1_deserializeOpIntrospectOAuth2TokenWithIAM{}, middleware.After)
	if err != nil {
		return err
	}

	if err = addResolveEndpointMiddleware(stack, options); err != nil {
		return err
	}
	if err = addComputePayloadSHA256(stack); err != nil {
		return err
	}
	if err = addRecordResponseTiming(stack, options); err != nil {
		return err
	}
	if err = addCredentialSource(stack, options); err != nil {
		return err
	}
	if err = addOpIntrospectOAuth2TokenWithIAMValidationMiddleware(stack); err != nil {
		return err
	}
	if err = addRequestIDRetrieverMiddleware(stack); err != nil {
		return err
	}
	if err = addResponseErrorMiddleware(stack); err != nil {
		return err
	}
	if err = addRequestResponseLogging(stack, options); err != nil {
		return err
	}
	if err = addDisableHTTPSMiddleware(stack, options); err != nil {
		return err
	}
	if err = addInterceptors(stack, options); err != nil {
		return err
	}
	return nil
}