// Code generated by tools/cmd/genoptions/main.go. DO NOT EDIT.

package jwk

import (
	"crypto"
	"io/fs"

	"github.com/lestrrat-go/jwx/v3/internal/json"
	"github.com/lestrrat-go/option/v2"
)

type Option = option.Interface

type AssignKeyIDOption interface {
	Option
	assignKeyIDOption()
}

type assignKeyIDOption struct {
	Option
}

func (*assignKeyIDOption) assignKeyIDOption() {}

// CacheOption is a type of Option that can be passed to the
// the `jwk.NewCache()` function.
type CacheOption interface {
	Option
	cacheOption()
}

type cacheOption struct {
	Option
}

func (*cacheOption) cacheOption() {}

// FetchOption is a type of Option that can be passed to `jwk.Fetch()`
// FetchOption also implements the `RegisterOption`, and thus can
// safely be passed to `(*jwk.Cache).Register()`
type FetchOption interface {
	Option
	fetchOption()
	parseOption()
	registerOption()
}

type fetchOption struct {
	Option
}

func (*fetchOption) fetchOption() {}

func (*fetchOption) parseOption() {}

func (*fetchOption) registerOption() {}

// GlobalFetchOption describes an Option that can be passed to `jwk.Configure()`,
// `jwk.Fetch()`, and `(*jwk.Cache).Register()`.
type GlobalFetchOption interface {
	Option
	globalOption()
	fetchOption()
	registerOption()
	parseOption()
}

type globalFetchOption struct {
	Option
}

func (*globalFetchOption) globalOption() {}

func (*globalFetchOption) fetchOption() {}

func (*globalFetchOption) registerOption() {}

func (*globalFetchOption) parseOption() {}

// GlobalOption is a type of Option that can be passed to the `jwk.Configure()` to
// change the global configuration of the jwk package.
type GlobalOption interface {
	Option
	globalOption()
}

type globalOption struct {
	Option
}

func (*globalOption) globalOption() {}

// GlobalParseOption describes an Option that can be passed to both
// `jwk.Configure()` (to change the default globally) and
// `jwk.Parse()` / `jwk.ParseReader()` / `jwk.ParseString()` (to
// override per call).
type GlobalParseOption interface {
	Option
	globalOption()
	fetchOption()
	registerOption()
	readFileOption()
}

type globalParseOption struct {
	Option
}

func (*globalParseOption) globalOption() {}

func (*globalParseOption) fetchOption() {}

func (*globalParseOption) registerOption() {}

func (*globalParseOption) readFileOption() {}

// ParseOption is a type of Option that can be passed to `jwk.Parse()`
// ParseOption also implements the `ReadFileOption` and `NewCacheOption`,
// and thus safely be passed to `jwk.ReadFile` and `(*jwk.Cache).Configure()`
type ParseOption interface {
	Option
	fetchOption()
	registerOption()
	readFileOption()
}

type parseOption struct {
	Option
}

func (*parseOption) fetchOption() {}

func (*parseOption) registerOption() {}

func (*parseOption) readFileOption() {}

// PublicSetOption is a type of Option that can be passed to `jwk.PublicSetOf()`
type PublicSetOption interface {
	Option
	publicSetOption()
}

type publicSetOption struct {
	Option
}

func (*publicSetOption) publicSetOption() {}

// ReadFileOption is a type of `Option` that can be passed to `jwk.ReadFile`
type ReadFileOption interface {
	Option
	readFileOption()
}

type readFileOption struct {
	Option
}

func (*readFileOption) readFileOption() {}

// RegisterFetchOption describes options that can be passed to `(jwk.Cache).Register()` and `jwk.Fetch()`
type RegisterFetchOption interface {
	Option
	fetchOption()
	registerOption()
	parseOption()
}

type registerFetchOption struct {
	Option
}

func (*registerFetchOption) fetchOption() {}

func (*registerFetchOption) registerOption() {}

func (*registerFetchOption) parseOption() {}

// RegisterOption describes options that can be passed to `(jwk.Cache).Register()`
type RegisterOption interface {
	Option
	registerOption()
}

type registerOption struct {
	Option
}

func (*registerOption) registerOption() {}

// ResourceOption is a type of Option that can be passed to the `httprc.NewResource` function
// by way of RegisterOption.
type ResourceOption interface {
	Option
	resourceOption()
}

type resourceOption struct {
	Option
}

func (*resourceOption) resourceOption() {}

type identAllowSymmetric struct{}
type identFS struct{}
type identFetchWhitelist struct{}
type identForceAssign struct{}
type identHTTPClient struct{}
type identIgnoreParseError struct{}
type identLocalRegistry struct{}
type identMaxFetchBodySize struct{}
type identMaxKeys struct{}
type identMinRSAModulusBits struct{}
type identMinRSAPublicExponent struct{}
type identOmitUnsupportedKeys struct{}
type identPEM struct{}
type identPEMDecoder struct{}
type identRejectDuplicateKID struct{}
type identStrictKeySetParsing struct{}
type identStrictKeyUsage struct{}
type identThumbprintHash struct{}
type identWaitReady struct{}
type identX509 struct{}

func (identAllowSymmetric) String() string {
	return "WithAllowSymmetric"
}

func (identFS) String() string {
	return "WithFS"
}

func (identFetchWhitelist) String() string {
	return "WithFetchWhitelist"
}

func (identForceAssign) String() string {
	return "WithForceAssign"
}

func (identHTTPClient) String() string {
	return "WithHTTPClient"
}

func (identIgnoreParseError) String() string {
	return "WithIgnoreParseError"
}

func (identLocalRegistry) String() string {
	return "withLocalRegistry"
}

func (identMaxFetchBodySize) String() string {
	return "WithMaxFetchBodySize"
}

func (identMaxKeys) String() string {
	return "WithMaxKeys"
}

func (identMinRSAModulusBits) String() string {
	return "WithMinRSAModulusBits"
}

func (identMinRSAPublicExponent) String() string {
	return "WithMinRSAPublicExponent"
}

func (identOmitUnsupportedKeys) String() string {
	return "WithOmitUnsupportedKeys"
}

func (identPEM) String() string {
	return "WithPEM"
}

func (identPEMDecoder) String() string {
	return "WithPEMDecoder"
}

func (identRejectDuplicateKID) String() string {
	return "WithRejectDuplicateKID"
}

func (identStrictKeySetParsing) String() string {
	return "WithStrictKeySetParsing"
}

func (identStrictKeyUsage) String() string {
	return "WithStrictKeyUsage"
}

func (identThumbprintHash) String() string {
	return "WithThumbprintHash"
}

func (identWaitReady) String() string {
	return "WithWaitReady"
}

func (identX509) String() string {
	return "WithX509"
}

// WithAllowSymmetric controls whether `jwk.PublicSetOf` tolerates
// symmetric (oct) keys in the input set.
//
// By default this option is false: a symmetric key in the input is
// an error, because a symmetric key has no public form — its
// "public" representation is the secret itself. Passing such a set
// through `PublicSetOf` silently and then publishing the result
// (e.g. as `/.well-known/jwks.json`) would leak HMAC secret material.
//
// Pass `WithAllowSymmetric(true)` only if you are certain the
// resulting set will not be published. When true, symmetric keys
// are passed through unchanged, matching the legacy behavior.
func WithAllowSymmetric(v bool) PublicSetOption {
	return &publicSetOption{option.New(identAllowSymmetric{}, v)}
}

// WithFS specifies the source `fs.FS` object to read the file from.
func WithFS(v fs.FS) ReadFileOption {
	return &readFileOption{option.New(identFS{}, v)}
}

// WithFetchWhitelist specifies the Whitelist applied to the URL passed
// to `jwk.Fetch()` (and `(*jwk.Cache).Register()`).
//
// The default when this option is not supplied is `jwk.InsecureWhitelist{}`,
// which allows every URL. That is the right default for URLs that are
// hard-coded in your program or loaded from trusted configuration, and
// keeps first-time usage free of boilerplate.
//
// It is NOT safe when the URL comes from an untrusted source — most
// commonly the `jku` header of a JWS handed to you by a peer. For those
// call sites you MUST supply a restrictive Whitelist: use
// `jwk.NewMapWhitelist()` for a fixed allow-list, `jwk.RegexpWhitelist`
// for pattern-based allow-lists, or implement the `jwk.Whitelist`
// interface yourself.
//
// Note that a whitelist only constrains the initial URL. For defense
// against redirect-to-private-IP and DNS-rebinding attacks, also supply
// a custom `http.Client` via `jwk.WithHTTPClient` whose
// `Transport.DialContext` validates resolved addresses.
func WithFetchWhitelist(v Whitelist) FetchOption {
	return &fetchOption{option.New(identFetchWhitelist{}, v)}
}

// WithForceAssign forces `jwk.AssignKeyID` to recompute and overwrite
// the `kid` header even when the key already has one. The default
// behavior preserves any existing `kid`; use this option to upgrade
// the thumbprint hash (e.g. with `jwk.WithThumbprintHash`) or to
// refresh a `kid` after mutating a key field that invalidates the
// cached thumbprint.
func WithForceAssign(v bool) AssignKeyIDOption {
	return &assignKeyIDOption{option.New(identForceAssign{}, v)}
}

// WithHTTPClient allows users to specify the "net/http".Client object that
// is used when fetching jwk.Set objects.
//
// When passed to `jwk.Configure()`, it sets the global default HTTP client
// used by `jwk.Fetch()`. By default, `jwk.Fetch()` uses an HTTP client with
// a 30-second timeout and a redirect policy that blocks HTTPS-to-HTTP
// scheme downgrades (with a maximum of 5 redirects) instead of
// `http.DefaultClient` (which has no timeout and allows up to 10 redirects).
//
// The client is used as-is: the library does NOT automatically apply its
// default timeout or redirect policy to a user-supplied client. If you want
// to bring your own client (e.g. for custom TLS or proxy settings) while
// retaining the library's defaults, wrap it with `jwk.WrapHTTPClientDefaults()`
// before passing it to this option.
//
// For full SSRF protection (blocking redirects to private IPs, DNS
// rebinding prevention), provide a custom http.Client with an appropriate
// Transport.DialContext that validates resolved IP addresses.
//
// Users can override the client per-call via `jwk.Fetch()` or per-resource
// via `(*jwk.Cache).Register()`.
func WithHTTPClient(v HTTPClient) GlobalFetchOption {
	return &globalFetchOption{option.New(identHTTPClient{}, v)}
}

// WithIgnoreParseError is only applicable when used with `jwk.Parse()`
// (i.e. to parse JWK sets). If passed to `jwk.ParseKey()`, the function
// will return an error no matter what the input is.
//
// DO NOT USE WITHOUT EXHAUSTING ALL OTHER ROUTES FIRST.
//
// The option specifies that errors found during parsing of individual
// keys are ignored. For example, if you had keys A, B, C where B is
// invalid (e.g. it does not contain the required fields), then the
// resulting JWKS will contain keys A and C only.
//
// This options exists as an escape hatch for those times when a
// key in a JWKS that is irrelevant for your use case is causing
// your JWKS parsing to fail, and you want to get to the rest of the
// keys in the JWKS.
//
// Again, DO NOT USE unless you have exhausted all other routes.
// When you use this option, you will not be able to tell if you are
// using a faulty JWKS, except for when there are JSON syntax errors.
func WithIgnoreParseError(v bool) ParseOption {
	return &parseOption{option.New(identIgnoreParseError{}, v)}
}

// This option is only available for internal code. Users don't get to play with it
func withLocalRegistry(v *json.Registry) ParseOption {
	return &parseOption{option.New(identLocalRegistry{}, v)}
}

// WithMaxFetchBodySize specifies the maximum number of bytes to read from
// an HTTP response body when fetching a JWKS. If the response body exceeds
// this size, the fetch returns an error. The default value is 10MB (10485760).
//
// This option can be passed to `jwk.Configure()` to change the default
// globally, or to `jwk.Fetch()` / `(*jwk.Cache).Register()` for a per-call
// override.
func WithMaxFetchBodySize(v int64) GlobalFetchOption {
	return &globalFetchOption{option.New(identMaxFetchBodySize{}, v)}
}

// WithMaxKeys specifies the maximum number of keys allowed in a JWK
// set passed to `jwk.Parse()` / `jwk.ParseReader()` / `jwk.ParseString()`.
// If the "keys" array of a JSON-encoded JWKS, or the number of PEM
// blocks in a PEM/X.509-encoded input, exceeds this value, parsing
// returns an error. The default is 1000.
//
// This option can be passed to `jwk.Configure()` to change the
// default globally, or to `jwk.Parse()` / `jwk.ParseReader()` /
// `jwk.ParseString()` for a per-call override. A non-positive
// value is rejected.
//
// The cap defends against amplification: each entry triggers a
// probe + unmarshal + validation, each of which allocates.
// Bounding raw input bytes remains the caller's responsibility.
func WithMaxKeys(v int) GlobalParseOption {
	return &globalParseOption{option.New(identMaxKeys{}, v)}
}

// WithMinRSAModulusBits specifies the minimum RSA modulus size, in bits,
// accepted by JWK validation and raw/PEM/X.509 import.
//
// The default is 2048. Lower this only for legacy interoperability with
// older key material. A value of 0 disables the modulus-size floor.
func WithMinRSAModulusBits(v int) GlobalOption {
	return &globalOption{option.New(identMinRSAModulusBits{}, v)}
}

// WithMinRSAPublicExponent specifies the minimum RSA public exponent
// accepted by JWK validation and raw/PEM/X.509 import.
//
// The default is 3. The exponent must still be odd and fit in a Go `int`.
// Lower this only for legacy interoperability. A value of 0 disables the
// minimum-exponent floor.
func WithMinRSAPublicExponent(v int) GlobalOption {
	return &globalOption{option.New(identMinRSAPublicExponent{}, v)}
}

// WithOmitUnsupportedKeys controls how `jwk.PublicSetOf` treats
// `jwk.UnsupportedKey` placeholders in the input set.
//
// By default this option is false: a placeholder in the input is an
// error, because there is no way to prove that an unparseable entry
// contains no private material, and passing it through would risk
// republishing a private key.
//
// Pass `WithOmitUnsupportedKeys(true)` to drop placeholders from the
// output set instead. Use this when you intend to publish the public
// set and want unparseable entries silently excluded.
func WithOmitUnsupportedKeys(v bool) PublicSetOption {
	return &publicSetOption{option.New(identOmitUnsupportedKeys{}, v)}
}

// WithPEM specifies that the input to `Parse()` is a PEM encoded key.
//
// This option is planned to be deprecated in the future. The plan is to
// replace it with `jwk.WithX509(true)`
func WithPEM(v bool) ParseOption {
	return &parseOption{option.New(identPEM{}, v)}
}

// WithPEMDecoder specifies the PEMDecoder object to use when decoding
// PEM encoded keys. This option can be passed to `jwk.Parse()`
//
// This option is planned to be deprecated in the future. The plan is to
// use `jwk.RegisterX509Decoder()` to register a custom X.509 decoder globally.
func WithPEMDecoder(v PEMDecoder) ParseOption {
	return &parseOption{option.New(identPEMDecoder{}, v)}
}

// WithRejectDuplicateKID instructs `jwk.Parse()` /
// `jwk.ParseReader()` / `jwk.ParseString()` and
// `Set.UnmarshalJSON()` to return an error when the JWKS contains
// two or more keys with the same non-empty `kid`. Keys without a
// kid are not considered.
//
// Default is false — first-match-wins is retained for
// compatibility with RFC 7517 (which permits, but does not
// mandate, unique kids) and with existing callers that rely on
// `(jwk.Set).LookupKeyID` returning the first entry. Use this
// option when your issuer should guarantee kid uniqueness and a
// duplicate is a sign of misconfiguration worth surfacing at
// parse time rather than at verify time.
//
// Can be set globally via `jwk.Configure()` or per-call on
// `jwk.Parse()` / `jwk.ParseReader()` / `jwk.ParseString()`.
//
// This does not affect `(*Set).AddKey` — programmatic additions
// remain permissive (AddKey dedupes only by pointer identity).
func WithRejectDuplicateKID(v bool) GlobalParseOption {
	return &globalParseOption{option.New(identRejectDuplicateKID{}, v)}
}

// WithStrictKeySetParsing controls what happens when an entry in a
// JWK Set's "keys" array cannot be parsed.
//
// In v3 the default is true (strict): the first unparseable entry
// fails the entire set, exactly as older v3 releases did. Existing
// callers therefore see no change in behavior.
//
// Pass `WithStrictKeySetParsing(false)` to opt into retention. In
// that mode an unparseable entry is neither dropped nor fatal — it
// is kept in the set as a `jwk.UnsupportedKey` placeholder that
// preserves the entry's original JSON and the error that prevented
// parsing (RFC 7517 §5). This lets a set that mixes understood and
// not-yet-understood keys (for example, post-quantum keys published
// by an identity provider) remain usable for the keys you do
// understand.
//
// Note the cross-version difference: v4 defaults to false (retain),
// while v3 defaults to true (fail-fast). The option means the same
// thing in both — only the default differs — so call sites that pass
// it explicitly are source-compatible across the v3→v4 migration.
//
// This option is distinct from `WithIgnoreParseError`, which silently
// *drops* unparseable entries instead of retaining placeholders.
// `WithIgnoreParseError(true)` takes precedence regardless of the
// strict setting: the entry is dropped rather than failing the set
// or being retained.
//
// Can be set globally via `jwk.Configure()` or per-call on
// `jwk.Parse()` / `jwk.ParseReader()` / `jwk.ParseString()`.
func WithStrictKeySetParsing(v bool) GlobalParseOption {
	return &globalParseOption{option.New(identStrictKeySetParsing{}, v)}
}

// WithStrictKeyUsage specifies if during JWK parsing, the "use" field
// should be confined to the values that have been registered via
// `jwk.RegisterKeyType()`. By default this option is true, and the
// initial allowed values are "use" and "enc" only.
//
// If this option is set to false, then the "use" field can be any
// value. If this options is set to true, then the "use" field must
// be one of the registered values, and otherwise an error will be
// reported during parsing / assignment to `jwk.KeyUsageType`
func WithStrictKeyUsage(v bool) GlobalOption {
	return &globalOption{option.New(identStrictKeyUsage{}, v)}
}

func WithThumbprintHash(v crypto.Hash) AssignKeyIDOption {
	return &assignKeyIDOption{option.New(identThumbprintHash{}, v)}
}

// WithWaitReady specifies that the `jwk.Cache` should wait until the
// first fetch is done before returning from the `Register()` call.
//
// This option is by default true. Specify a false value if you would
// like to return immediately from the `Register()` call.
//
// This options is exactly the same as `httprc.WithWaitReady()`
func WithWaitReady(v bool) RegisterOption {
	return &registerOption{option.New(identWaitReady{}, v)}
}

// WithX509 specifies that the input to `Parse()` is an X.509 encoded key
func WithX509(v bool) ParseOption {
	return &parseOption{option.New(identX509{}, v)}
}