Release 2019.8.3

Revert "AUTH-1941: Adds initial SSH server implementation"
This reverts commit e9c9bf3cbd.
2026-08-07 23:31:56 +00:00 · 2019-08-21 11:15:36 -05:00 · 2019-08-20 17:20:48 -05:00 · 2019-08-20 16:47:23 -05:00 · 2019-08-20 16:18:37 -05:00 · 2019-08-20 13:13:29 -05:00
473 changed files with 366948 additions and 4846 deletions
@@ -1,6 +1,14 @@
 # This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.


+[[projects]]
+  digest = "1:3d3a509c5ba327e8573bb57f9da8430c63a46a06886eb1d2ffc8af4e76f31c72"
+  name = "cloud.google.com/go"
+  packages = ["civil"]
+  pruneopts = "UT"
+  revision = "cdaaf98f9226c39dc162b8e55083b2fbc67b4674"
+  version = "v0.43.0"
+
 [[projects]]
  digest = "1:9f3b30d9f8e0d7040f729b82dcbc8f0dead820a133b3147ce355fc451f32d761"
  name = "github.com/BurntSushi/toml"
@@ -9,6 +17,14 @@
  revision = "3012a1dbe2e4bd1391d42b32f0577cb7bbc7f005"
  version = "v0.3.1"

+[[projects]]
+  digest = "1:c84a587136cb69cecc11f3dbe9f9001444044c0dba74997b07f7e4c150b07cda"
+  name = "github.com/DATA-DOG/go-sqlmock"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "3f9954f6f6697845b082ca57995849ddf614f450"
+  version = "v1.3.3"
+
 [[projects]]
  digest = "1:d6afaeed1502aa28e80a4ed0981d570ad91b2579193404256ce672ed0a609e0d"
  name = "github.com/beorn7/perks"
@@ -39,6 +55,14 @@
  pruneopts = "UT"
  revision = "333127dbecfcc23a8db7d9a4f52785d23aff44a1"

+[[projects]]
+  branch = "master"
+  digest = "1:05756b73bf7eae03d6f6c5f0ae83de42ce296e7d83336563dd9ce2072106d5e6"
+  name = "github.com/cloudflare/golz4"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "ef862a3cdc58a6f1fee4e3af3d44fbe279194cde"
+
 [[projects]]
  digest = "1:3f9506ee991cdee1f05bf0cd3e34b5cd922dc00d6a950fb4beb4e07ab1c4d3d1"
  name = "github.com/coredns/coredns"
@@ -73,17 +97,12 @@
  version = "v1.2.0"

 [[projects]]
-  digest = "1:6a503e232df389d94ebb97dfb22d4ae463b6e2f351660613e11d9e42f57ab6df"
+  branch = "v2"
+  digest = "1:ca6ce07b0d28c6044411b9c966cd845233e27c2ff91d08a3a869631f329c9918"
  name = "github.com/coreos/go-oidc"
-  packages = [
-    "http",
-    "jose",
-    "key",
-    "oauth2",
-    "oidc",
-  ]
+  packages = ["."]
  pruneopts = "UT"
-  revision = "a93f71fdfe73d2c0f5413c0565eea0af6523a6df"
+  revision = "274971e2c94cd6fb17614979e2899edbc81af146"

 [[projects]]
  digest = "1:1da3a221f0bc090792d3a2a080ff09008427c0e0f0533a4ed6abd8994421da73"
@@ -93,18 +112,6 @@
  revision = "95778dfbb74eb7e4dbaf43bf7d71809650ef8076"
  version = "v19"

-[[projects]]
-  digest = "1:6fda0d7f5e52b081e075775b1ecebf1ea0c923e7be33604ed0225ae078e701b5"
-  name = "github.com/coreos/pkg"
-  packages = [
-    "health",
-    "httputil",
-    "timeutil",
-  ]
-  pruneopts = "UT"
-  revision = "97fdf19511ea361ae1c100dd393cc47f8dcfa1e1"
-  version = "v4"
-
 [[projects]]
  digest = "1:ffe9824d294da03b391f44e1ae8281281b4afc1bdaa9588c9097785e3af10cec"
  name = "github.com/davecgh/go-spew"
@@ -115,11 +122,15 @@

 [[projects]]
  branch = "master"
-  digest = "1:c013ffc6e15f9f898078f9d38441c68b228aa7b899659452170250ccb27f5f1e"
-  name = "github.com/elgs/gosqljson"
-  packages = ["."]
+  digest = "1:27cbe99893a40975358d20736d80adc95ef395d3bf5923f802f3de259533c94a"
+  name = "github.com/denisenkom/go-mssqldb"
+  packages = [
+    ".",
+    "internal/cp",
+    "internal/querytext",
+  ]
  pruneopts = "UT"
-  revision = "027aa4915315a0b2825c0f025cea347829b974fa"
+  revision = "11b2859924c1e3c3da056fd4e0976b93883f3545"

 [[projects]]
  digest = "1:d4268b2a09b1f736633577c4ac93f2a5356c73742fff5344e2451aeec60a7ad0"
@@ -143,6 +154,14 @@
  pruneopts = "UT"
  revision = "75cf19382434e82df4dd84953f566b8ad23d6e9e"

+[[projects]]
+  digest = "1:296cda2c4a6a7a54964d7b3b0815e2aed215da75217b72033060ffb1c4e4b6ae"
+  name = "github.com/felixge/httpsnoop"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "eadd4fad6aac69ae62379194fe0219f3dbc80fd3"
+  version = "v1.0.0"
+
 [[projects]]
  branch = "master"
  digest = "1:50a46ab1d5edbbdd55125b4d37f1bf503d0807c26461f9ad7b358d6006641d09"
@@ -158,6 +177,14 @@
  pruneopts = "UT"
  revision = "ed7bcb39ff10f39ab08e317ce16df282845852fa"

+[[projects]]
+  digest = "1:ec6f9bf5e274c833c911923c9193867f3f18788c461f76f05f62bb1510e0ae65"
+  name = "github.com/go-sql-driver/mysql"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "72cd26f257d44c1114970e19afddcd812016007e"
+  version = "v1.4.1"
+
 [[projects]]
  branch = "master"
  digest = "1:3e6afc3ed8a72949aa735c00fddc23427dc9384ccfd51cf0d91a412e668da632"
@@ -166,6 +193,14 @@
  pruneopts = "UT"
  revision = "604e922904d35e97f98a774db7881f049cd8d970"

+[[projects]]
+  branch = "master"
+  digest = "1:01745416ed734d0dbd8f2a25344536e399ee60319654873da12b107e9e3cb309"
+  name = "github.com/golang/gddo"
+  packages = ["httputil/header"]
+  pruneopts = "UT"
+  revision = "af0f2af80721261f4d211b2c9563f7b46b2aab06"
+
 [[projects]]
  digest = "1:239c4c7fd2159585454003d9be7207167970194216193a8a210b8d29576f19c9"
  name = "github.com/golang/protobuf"
@@ -213,12 +248,15 @@
  revision = "8e809c8a86450a29b90dcc9efbf062d0fe6d9746"

 [[projects]]
-  digest = "1:75ab90ae3f5d876167e60f493beadfe66f0ed861a710f283fb06c86437a09538"
-  name = "github.com/jonboulle/clockwork"
-  packages = ["."]
+  digest = "1:6c41d4f998a03b6604227ccad36edaed6126c397e5d78709ef4814a1145a6757"
+  name = "github.com/jmoiron/sqlx"
+  packages = [
+    ".",
+    "reflectx",
+  ]
  pruneopts = "UT"
-  revision = "2eee05ed794112d45db504eb05aa693efd2b8b09"
-  version = "v0.1.0"
+  revision = "d161d7a76b5661016ad0b085869f77fd410f3e6a"
+  version = "v1.2.0"

 [[projects]]
  digest = "1:31e761d97c76151dde79e9d28964a812c46efc5baee4085b86f68f0c654450de"
@@ -229,7 +267,26 @@
  version = "v1.0.2"

 [[projects]]
-  digest = "1:bc1c0be40c67b6b4aee09d7508d5a2a52c1c116b1fa43806dad2b0d6b4d4003b"
+  digest = "1:177a18252d40bf39a867876456854717780b0b1212fdae231d31e93b6f885d80"
+  name = "github.com/kshvakov/clickhouse"
+  packages = [
+    ".",
+    "lib/binary",
+    "lib/cityhash102",
+    "lib/column",
+    "lib/data",
+    "lib/leakypool",
+    "lib/lz4",
+    "lib/protocol",
+    "lib/types",
+    "lib/writebuffer",
+  ]
+  pruneopts = "UT"
+  revision = "43e176a8d165376662f4d67203c71cc8a027c86b"
+  version = "v1.3.9"
+
+[[projects]]
+  digest = "1:12cb143f2148bf54bcd9fe622abac17325e85eeb1d84b8ec6caf1c80232108fd"
  name = "github.com/lib/pq"
  packages = [
    ".",
@@ -237,8 +294,8 @@
    "scram",
  ]
  pruneopts = "UT"
-  revision = "51e2106eed1cea199c802d2a49e91e2491b02056"
-  version = "v1.1.0"
+  revision = "3427c32cb71afc948325f299f040e53c1dd78979"
+  version = "v1.2.0"

 [[projects]]
  digest = "1:2fa7b0155cd54479a755c629de26f888a918e13f8857a2c442205d825368e084"
@@ -256,6 +313,14 @@
  revision = "c2a7a6ca930a4cd0bc33a3f298eb71960732a3a7"
  version = "v0.0.7"

+[[projects]]
+  digest = "1:79e87abf06b873987dee86598950f5b51732ac454d5a5cab6445a14330e6c9e3"
+  name = "github.com/mattn/go-sqlite3"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "b612a2feea6aa87c6d052d9086572551df06497e"
+  version = "v1.11.0"
+
 [[projects]]
  digest = "1:ff5ebae34cfbf047d505ee150de27e60570e8c394b3b8fdbb720ff6ac71985fc"
  name = "github.com/matttproud/golang_protobuf_extensions"
@@ -291,6 +356,22 @@
  revision = "af06845cf3004701891bf4fdb884bfe4920b3727"
  version = "v1.1.0"

+[[projects]]
+  digest = "1:dd3d50b46f8d3c88a8d3986f2e5344db582c457469a7cb3a0dda953c669cdf9a"
+  name = "github.com/mitchellh/go-server-timing"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "1ca01db910d57d64ec1c68f27105614b77558e28"
+  version = "v1.0.0"
+
+[[projects]]
+  digest = "1:53bc4cd4914cd7cd52139990d5170d6dc99067ae31c56530621b18b35fc30318"
+  name = "github.com/mitchellh/mapstructure"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "3536a929edddb9a5b34bd6861dc4a9647cb459fe"
+  version = "v1.1.2"
+
 [[projects]]
  digest = "1:11e62d6050198055e6cd87ed57e5d8c669e84f839c16e16f192374d913d1a70d"
  name = "github.com/opentracing/opentracing-go"
@@ -319,6 +400,17 @@
  revision = "792786c7400a136282c1664665ae0a8db921c6c2"
  version = "v1.0.0"

+[[projects]]
+  branch = "master"
+  digest = "1:bd9efe4e0b0f768302a1e2f0c22458149278de533e521206e5ddc71848c269a0"
+  name = "github.com/pquerna/cachecontrol"
+  packages = [
+    ".",
+    "cacheobject",
+  ]
+  pruneopts = "UT"
+  revision = "1555304b9b35fdd2b425bccf1a5613677705e7d0"
+
 [[projects]]
  digest = "1:c968b29db5d68ec97de404b6d058d5937fa015a141b3b4f7a0d87d5f8226f04c"
  name = "github.com/prometheus/client_golang"
@@ -375,16 +467,27 @@
  version = "v1.4.2"

 [[projects]]
-  digest = "1:f85e109eda8f6080877185d1c39e98dd8795e1780c08beca28304b87fd855a1c"
+  digest = "1:7e8d267900c7fa7f35129a2a37596e38ed0f11ca746d6d9ba727980ee138f9f6"
  name = "github.com/stretchr/testify"
-  packages = ["assert"]
+  packages = [
+    "assert",
+    "require",
+  ]
  pruneopts = "UT"
  revision = "12b6f73e6084dad08a7c6e575284b177ecafbc71"
  version = "v1.2.1"

 [[projects]]
  branch = "master"
-  digest = "1:a84d5ec8b40a827962ea250f2cf03434138ccae9d83fcac12fb49b70c70b80cc"
+  digest = "1:cac263b8eb2e9ad2327b70e03be1de1227040bfb3be26b49c4b56cbed568afc7"
+  name = "github.com/xo/dburl"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "98997a05b24fc069c79fa13b05ccf376c22a326c"
+
+[[projects]]
+  branch = "master"
+  digest = "1:1a9391a80fe548ffcf90aee8ae35bfb0b188198b57a3fe2ef5bb099ba4b4f610"
  name = "golang.org/x/crypto"
  packages = [
    "curve25519",
@@ -392,8 +495,10 @@
    "ed25519/internal/edwards25519",
    "internal/chacha20",
    "internal/subtle",
+    "md4",
    "nacl/box",
    "nacl/secretbox",
+    "pbkdf2",
    "poly1305",
    "salsa20/salsa",
    "ssh",
@@ -404,11 +509,12 @@

 [[projects]]
  branch = "master"
-  digest = "1:52d140f7ab52e491cc1cbc93e6637aa5e9a7f3beae7545d675b02e52ca9d7290"
+  digest = "1:6b3dbfffba73ea0d8131ecb5738fe87f6addc4c7b73154b9d58e2693ad6a6256"
  name = "golang.org/x/net"
  packages = [
    "bpf",
    "context",
+    "context/ctxhttp",
    "http/httpguts",
    "http2",
    "http2/hpack",
@@ -424,6 +530,17 @@
  pruneopts = "UT"
  revision = "1da14a5a36f220ea3f03470682b737b1dfd5de22"

+[[projects]]
+  branch = "master"
+  digest = "1:8d1c112fb1679fa097e9a9255a786ee47383fa2549a3da71bcb1334a693ebcfe"
+  name = "golang.org/x/oauth2"
+  packages = [
+    ".",
+    "internal",
+  ]
+  pruneopts = "UT"
+  revision = "0f29369cfe4552d0e4bcddc57cc75f4d7e672a33"
+
 [[projects]]
  digest = "1:39ebcc2b11457b703ae9ee2e8cca0f68df21969c6102cb3b705f76cca0ea0239"
  name = "golang.org/x/sync"
@@ -470,6 +587,23 @@
  revision = "f21a4dfb5e38f5895301dc265a8def02365cc3d0"
  version = "v0.3.0"

+[[projects]]
+  digest = "1:7e8b9c5ae49011b12ae8473834ac1a7bb8ac029ba201270c723e4c280c9e4855"
+  name = "google.golang.org/appengine"
+  packages = [
+    "cloudsql",
+    "internal",
+    "internal/base",
+    "internal/datastore",
+    "internal/log",
+    "internal/remote_api",
+    "internal/urlfetch",
+    "urlfetch",
+  ]
+  pruneopts = "UT"
+  revision = "b2f4a3cf3c67576a2ee09e1fe62656a5086ce880"
+  version = "v1.6.1"
+
 [[projects]]
  branch = "master"
  digest = "1:c3076e7defee87de1236f1814beb588f40a75544c60121e6eb38b3b3721783e2"
@@ -519,6 +653,26 @@
  revision = "236199dd5f8031d698fb64091194aecd1c3895b2"
  version = "v1.20.0"

+[[projects]]
+  branch = "v1"
+  digest = "1:6f70106e7bc1c803e8a0a4519e09c12d154771acfa2559206e97b033bbd1dd38"
+  name = "gopkg.in/coreos/go-oidc.v1"
+  packages = ["jose"]
+  pruneopts = "UT"
+  revision = "e860bd55bfa7d7cb35d30d26a167982584f616b0"
+
+[[projects]]
+  digest = "1:8c05919580be8a5be668709d7e5a69d5cd19b8ee9f23d62ce5b10d3457bf6a13"
+  name = "gopkg.in/square/go-jose.v2"
+  packages = [
+    ".",
+    "cipher",
+    "json",
+  ]
+  pruneopts = "UT"
+  revision = "730df5f748271903322feb182be83b43ebbbe27d"
+  version = "v2.3.1"
+
 [[projects]]
  branch = "altsrc-parse-durations"
  digest = "1:0370b1bceda03dbfade3abbde639a43f1113bab711ec760452e5c0dcc0c14787"
@@ -567,6 +721,7 @@
  analyzer-name = "dep"
  analyzer-version = 1
  input-imports = [
+    "github.com/DATA-DOG/go-sqlmock",
    "github.com/cloudflare/brotli-go",
    "github.com/cloudflare/golibs/lrucache",
    "github.com/coredns/coredns/core/dnsserver",
@@ -576,27 +731,34 @@
    "github.com/coredns/coredns/plugin/pkg/dnstest",
    "github.com/coredns/coredns/plugin/pkg/rcode",
    "github.com/coredns/coredns/request",
-    "github.com/coreos/go-oidc/jose",
-    "github.com/coreos/go-oidc/oidc",
+    "github.com/coreos/go-oidc",
    "github.com/coreos/go-systemd/daemon",
-    "github.com/elgs/gosqljson",
+    "github.com/denisenkom/go-mssqldb",
    "github.com/equinox-io/equinox",
    "github.com/facebookgo/grace/gracenet",
    "github.com/getsentry/raven-go",
+    "github.com/go-sql-driver/mysql",
    "github.com/golang-collections/collections/queue",
    "github.com/google/uuid",
    "github.com/gorilla/mux",
    "github.com/gorilla/websocket",
+    "github.com/jmoiron/sqlx",
+    "github.com/kshvakov/clickhouse",
    "github.com/lib/pq",
    "github.com/mattn/go-colorable",
+    "github.com/mattn/go-sqlite3",
    "github.com/miekg/dns",
    "github.com/mitchellh/go-homedir",
+    "github.com/mitchellh/go-server-timing",
+    "github.com/mitchellh/mapstructure",
    "github.com/pkg/errors",
    "github.com/prometheus/client_golang/prometheus",
    "github.com/prometheus/client_golang/prometheus/promhttp",
    "github.com/rifflock/lfshook",
    "github.com/sirupsen/logrus",
    "github.com/stretchr/testify/assert",
+    "github.com/stretchr/testify/require",
+    "github.com/xo/dburl",
    "golang.org/x/crypto/nacl/box",
    "golang.org/x/crypto/ssh",
    "golang.org/x/crypto/ssh/terminal",
@@ -611,6 +773,7 @@
    "golang.org/x/sys/windows/svc",
    "golang.org/x/sys/windows/svc/eventlog",
    "golang.org/x/sys/windows/svc/mgr",
+    "gopkg.in/coreos/go-oidc.v1/jose",
    "gopkg.in/urfave/cli.v2",
    "gopkg.in/urfave/cli.v2/altsrc",
    "zombiezen.com/go/capnproto2",
@@ -6,8 +6,6 @@
    name = "github.com/cloudflare/brotli-go"
    unused-packages = false

-
-
 [[constraint]]
  name = "github.com/facebookgo/grace"
  revision = "75cf19382434e82df4dd84953f566b8ad23d6e9e"
@@ -70,10 +68,6 @@
  name = "github.com/mholt/caddy"
  revision = "d3b731e9255b72d4571a5aac125634cf1b6031dc"

-[[constraint]]
-  name = "github.com/coreos/go-oidc"
-  revision = "a93f71fdfe73d2c0f5413c0565eea0af6523a6df"
-
 [[constraint]]
  name = "golang.org/x/crypto"
  branch = "master"  # master required by github.com/miekg/dns
@@ -85,3 +79,39 @@
 [[constraint]]
  name = "github.com/google/uuid"
  version = "=1.1.1"
+
+[[constraint]]
+  name = "github.com/mitchellh/mapstructure"
+  version = "1.1.2"
+
+[[constraint]]
+  name = "github.com/jmoiron/sqlx"
+  version = "1.2.0"
+
+[[constraint]]
+  name = "github.com/go-sql-driver/mysql"
+  version = "1.4.1"
+
+[[constraint]]
+  name = "github.com/mattn/go-sqlite3"
+  version = "1.11.0"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/denisenkom/go-mssqldb"
+
+[[constraint]]
+  name = "github.com/kshvakov/clickhouse"
+  version = "1.3.9"
+
+[[constraint]]
+  name = "github.com/DATA-DOG/go-sqlmock"
+  version = "1.3.3"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/xo/dburl"
+
+[[constraint]]
+  branch = "v2"
+  name = "github.com/coreos/go-oidc"
@@ -78,6 +78,6 @@ tunnelrpc/tunnelrpc.capnp.go: tunnelrpc/tunnelrpc.capnp

 .PHONY: vet
 vet:
-	go vet -composites=false ./...
+	go vet ./...
 	which go-sumtype  # go get github.com/BurntSushi/go-sumtype
 	go-sumtype $$(go list ./...)
@@ -1,3 +1,24 @@
+2019.8.3
+- 2019-08-20 STOR-519: Add db-connect, a SQL over HTTPS server
+- 2019-08-20 Release 2019.8.2
+- 2019-08-20 Revert "AUTH-1941: Adds initial SSH server implementation"
+- 2019-08-11 TUN-2163: Add GrapQLType method to Scope interface
+- 2019-08-06 TUN-2152: Requests with a query in the URL are erroneously escaped
+- 2019-07-18 AUTH-1941: Adds initial SSH server implementation
+
+2019.8.1
+- 2019-08-05 TUN-2111: Implement custom serialization logic for FallibleConfig and OriginConfig
+- 2019-08-06 Revert "TUN-1736: Missing headers when passing an invalid path"
+
+2019.8.0
+- 2019-07-11 TUN-1956: Go 1.12 update
+- 2019-07-24 TUN-1736: Missing headers when passing an invalid path
+- 2019-07-30 TUN-2117: read group/system-name from CLI, send it to edge
+- 2019-08-02 TUN-2125: Add PostgresType() to Scope
+- 2019-08-05 TUN-2147: Implemented ScopeUnmarshaler
+- 2019-07-31 TUN-2110: Implement custom deserialization logic for OriginConfig
+- 2019-07-31 AUTH-1972: Deletes token lock file if backoff retry attempts exceeded and intercepts signals until lock is released
+
 2019.7.0
 - 2019-05-28 TUN-1913: Define OriginService for each type of origin
 - 2019-04-29 Build a docker container
@@ -1,4 +1,4 @@
-pinned_go: &pinned_go go=1.11.5-1
+pinned_go: &pinned_go go=1.12.7-1
 build_dir: &build_dir /cfsetup_build/src/github.com/cloudflare/cloudflared/
 default-flavor: stretch
 stretch: &stretch
@@ -93,3 +93,14 @@ stretch: &stretch
      - make test

 jessie: *stretch
+
+# cfsetup compose
+default-stack: test_dbconnect
+test_dbconnect:
+  compose:
+    up-args:
+      - --renew-anon-volumes
+      - --abort-on-container-exit
+      - --exit-code-from=cloudflared
+    files:
+      - dbconnect/integration_test/dbconnect.yaml
@@ -6,13 +6,15 @@ import (
 	"io/ioutil"
 	"net/url"
 	"os"
+	"os/signal"
+	"syscall"

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/path"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/transfer"
 	"github.com/cloudflare/cloudflared/log"
 	"github.com/cloudflare/cloudflared/origin"
-	"github.com/coreos/go-oidc/jose"
+	"gopkg.in/coreos/go-oidc.v1/jose"
 )

 const (
@@ -24,6 +26,27 @@ var logger = log.CreateLogger()
 type lock struct {
 	lockFilePath string
 	backoff      *origin.BackoffHandler
+	sigHandler   *signalHandler
+}
+
+type signalHandler struct {
+	sigChannel chan os.Signal
+	signals    []os.Signal
+}
+
+func (s *signalHandler) register(handler func()) {
+	s.sigChannel = make(chan os.Signal, 1)
+	signal.Notify(s.sigChannel, s.signals...)
+	go func(s *signalHandler) {
+		for range s.sigChannel {
+			handler()
+		}
+	}(s)
+}
+
+func (s *signalHandler) deregister() {
+	signal.Stop(s.sigChannel)
+	close(s.sigChannel)
 }

 func errDeleteTokenFailed(lockFilePath string) error {
@@ -36,10 +59,19 @@ func newLock(path string) *lock {
 	return &lock{
 		lockFilePath: lockPath,
 		backoff:      &origin.BackoffHandler{MaxRetries: 7},
+		sigHandler: &signalHandler{
+			signals: []os.Signal{syscall.SIGINT, syscall.SIGTERM},
+		},
 	}
 }

 func (l *lock) Acquire() error {
+	// Intercept SIGINT and SIGTERM to release lock before exiting
+	l.sigHandler.register(func() {
+		l.deleteLockFile()
+		os.Exit(0)
+	})
+
 	// Check for a path.lock file
 	// if the lock file exists; start polling
 	// if not, create the lock file and go through the normal flow.
@@ -47,8 +79,10 @@ func (l *lock) Acquire() error {
 	for isTokenLocked(l.lockFilePath) {
 		if l.backoff.Backoff(context.Background()) {
 			continue
-		} else {
-			return errDeleteTokenFailed(l.lockFilePath)
+		}
+
+		if err := l.deleteLockFile(); err != nil {
+			return err
 		}
 	}

@@ -60,13 +94,18 @@ func (l *lock) Acquire() error {
 	return nil
 }

-func (l *lock) Release() error {
+func (l *lock) deleteLockFile() error {
 	if err := os.Remove(l.lockFilePath); err != nil && !os.IsNotExist(err) {
 		return errDeleteTokenFailed(l.lockFilePath)
 	}
 	return nil
 }

+func (l *lock) Release() error {
+	defer l.sigHandler.deregister()
+	return l.deleteLockFile()
+}
+
 // isTokenLocked checks to see if there is another process attempting to get the token already
 func isTokenLocked(lockFilePath string) bool {
 	exists, err := config.FileExists(lockFilePath)
@@ -84,12 +123,13 @@ func FetchToken(appURL *url.URL) (string, error) {
 		return "", err
 	}

-	lock := newLock(path)
-	err = lock.Acquire()
+	fileLock := newLock(path)
+
+	err = fileLock.Acquire()
 	if err != nil {
 		return "", err
 	}
-	defer lock.Release()
+	defer fileLock.Release()

 	// check to see if another process has gotten a token while we waited for the lock
 	if token, err := GetTokenIfExists(appURL); token != "" && err == nil {
@@ -0,0 +1,52 @@
+package token
+
+import (
+	"os"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSignalHandler(t *testing.T) {
+	sigHandler := signalHandler{signals: []os.Signal{syscall.SIGUSR1}}
+	handlerRan := false
+	done := make(chan struct{})
+	timer := time.NewTimer(time.Second)
+	sigHandler.register(func(){
+		handlerRan = true
+		done <- struct{}{}
+	})
+
+	p, err := os.FindProcess(os.Getpid())
+	require.Nil(t, err)
+	p.Signal(syscall.SIGUSR1)
+
+	// Blocks for up to one second to make sure the handler callback runs before the assert.
+	select {
+		case <- done:
+			assert.True(t, handlerRan)
+		case <- timer.C:
+			t.Fail()
+	}
+	sigHandler.deregister()
+}
+
+func TestSignalHandlerClose(t *testing.T) {
+	sigHandler := signalHandler{signals: []os.Signal{syscall.SIGUSR1}}
+	done := make(chan struct{})
+	timer := time.NewTimer(time.Second)
+	sigHandler.register(func(){done <- struct{}{}})
+	sigHandler.deregister()
+
+	p, err := os.FindProcess(os.Getpid())
+	require.Nil(t, err)
+	p.Signal(syscall.SIGUSR1)
+	select {
+	case <- done:
+		t.Fail()
+	case <- timer.C:
+	}
+}
@@ -7,12 +7,12 @@ import (
 	"net"
 	"net/url"
 	"os"
+	"reflect"
 	"runtime/trace"
 	"sync"
-	"syscall"
 	"time"

-	"github.com/cloudflare/cloudflared/h2mux"
+	"github.com/cloudflare/cloudflared/dbconnect"
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"

 	"github.com/cloudflare/cloudflared/connection"
@@ -20,12 +20,10 @@ import (
 	"github.com/google/uuid"

 	"github.com/getsentry/raven-go"
-	"golang.org/x/crypto/ssh/terminal"

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/buildinfo"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
-	"github.com/cloudflare/cloudflared/cmd/sqlgateway"
 	"github.com/cloudflare/cloudflared/hello"
 	"github.com/cloudflare/cloudflared/metrics"
 	"github.com/cloudflare/cloudflared/origin"
@@ -100,43 +98,7 @@ func Commands() []*cli.Command {
 			ArgsUsage: " ", // can't be the empty string or we get the default output
 			Hidden:    false,
 		},
-		{
-			Name: "db",
-			Action: func(c *cli.Context) error {
-				tags := make(map[string]string)
-				tags["hostname"] = c.String("hostname")
-				raven.SetTagsContext(tags)
-
-				fmt.Printf("\nSQL Database Password: ")
-				pass, err := terminal.ReadPassword(int(syscall.Stdin))
-				if err != nil {
-					logger.Error(err)
-				}
-
-				go sqlgateway.StartProxy(c, logger, string(pass))
-
-				raven.CapturePanic(func() { err = tunnel(c) }, nil)
-				if err != nil {
-					raven.CaptureError(err, nil)
-				}
-				return err
-			},
-			Before: Before,
-			Usage:  "SQL Gateway is an SQL over HTTP reverse proxy",
-			Flags: []cli.Flag{
-				&cli.BoolFlag{
-					Name:  "db",
-					Value: true,
-					Usage: "Enable the SQL Gateway Proxy",
-				},
-				&cli.StringFlag{
-					Name:  "address",
-					Value: "",
-					Usage: "Database connection string: db://user:pass",
-				},
-			},
-			Hidden: true,
-		},
+		dbConnectCmd(),
 	}

 	var subcommands []*cli.Command
@@ -386,6 +348,17 @@ func startDeclarativeTunnel(ctx context.Context,
 		logger.WithError(err)
 		return err
 	}
+	reverseProxyConfig, err := pogs.NewReverseProxyConfig(
+		c.String("hostname"),
+		reverseProxyOrigin,
+		c.Uint64("retries"),
+		c.Duration("proxy-connection-timeout"),
+		c.Uint64("compression-quality"),
+	)
+	if err != nil {
+		logger.WithError(err).Error("Cannot initialize default client config because reverse proxy config is invalid")
+		return err
+	}
 	defaultClientConfig := &pogs.ClientConfig{
 		Version: pogs.InitVersion(),
 		SupervisorConfig: &pogs.SupervisorConfig{
@@ -399,13 +372,8 @@ func startDeclarativeTunnel(ctx context.Context,
 			Timeout:             c.Duration("dial-edge-timeout"),
 			MaxFailedHeartbeats: c.Uint64("heartbeat-count"),
 		},
-		DoHProxyConfigs: []*pogs.DoHProxyConfig{},
-		ReverseProxyConfigs: []*pogs.ReverseProxyConfig{
-			{
-				TunnelHostname: h2mux.TunnelHostname(c.String("hostname")),
-				Origin:         reverseProxyOrigin,
-			},
-		},
+		DoHProxyConfigs:     []*pogs.DoHProxyConfig{},
+		ReverseProxyConfigs: []*pogs.ReverseProxyConfig{reverseProxyConfig},
 	}

 	autoupdater := updater.NewAutoUpdater(defaultClientConfig.SupervisorConfig.AutoUpdateFrequency, listeners)
@@ -427,10 +395,22 @@ func startDeclarativeTunnel(ctx context.Context,
 		return err
 	}

+	var scope pogs.Scope
+	if c.IsSet("group") == c.IsSet("system-name") {
+		err = fmt.Errorf("exactly one of --group or --system-name must be specified")
+		logger.WithError(err).Error("unable to determine scope")
+		return err
+	} else if c.IsSet("group") {
+		scope = pogs.NewGroup(c.String("group"))
+	} else {
+		scope = pogs.NewSystemName(c.String("system-name"))
+	}
+
 	cloudflaredConfig := &connection.CloudflaredConfig{
-		CloudflaredID: cloudflaredID,
-		Tags:          tags,
 		BuildInfo:     buildInfo,
+		CloudflaredID: cloudflaredID,
+		Scope:         scope,
+		Tags:          tags,
 	}

 	serviceDiscoverer, err := serviceDiscoverer(c, logger)
@@ -542,6 +522,60 @@ func addPortIfMissing(uri *url.URL, port int) string {
 	return fmt.Sprintf("%s:%d", uri.Hostname(), port)
 }

+func dbConnectCmd() *cli.Command {
+	cmd := dbconnect.Cmd()
+
+	// Append the tunnel commands so users can customize the daemon settings.
+	cmd.Flags = appendFlags(Flags(), cmd.Flags...)
+
+	// Override before to run tunnel validation before dbconnect validation.
+	cmd.Before = func(c *cli.Context) error {
+		err := Before(c)
+		if err == nil {
+			err = dbconnect.CmdBefore(c)
+		}
+		return err
+	}
+
+	// Override action to setup the Proxy, then if successful, start the tunnel daemon.
+	cmd.Action = func(c *cli.Context) error {
+		err := dbconnect.CmdAction(c)
+		if err == nil {
+			err = tunnel(c)
+		}
+		return err
+	}
+
+	return cmd
+}
+
+// appendFlags will append extra flags to a slice of flags.
+//
+// The cli package will panic if two flags exist with the same name,
+// so if extraFlags contains a flag that was already defined, modify the
+// original flags to use the extra version.
+func appendFlags(flags []cli.Flag, extraFlags ...cli.Flag) []cli.Flag {
+	for _, extra := range extraFlags {
+		var found bool
+
+		// Check if an extra flag overrides an existing flag.
+		for i, flag := range flags {
+			if reflect.DeepEqual(extra.Names(), flag.Names()) {
+				flags[i] = extra
+				found = true
+				break
+			}
+		}
+
+		// Append the extra flag if it has nothing to override.
+		if !found {
+			flags = append(flags, extra)
+		}
+	}
+
+	return flags
+}
+
 func tunnelFlags(shouldHide bool) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
@@ -838,6 +872,18 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_USE_DECLARATIVE"},
 			Hidden:  true,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "system-name",
+			Usage:   "Unique identifier for this cloudflared instance. It can be configured individually in the Declarative Tunnel UI. Mutually exclusive with `--group`.",
+			EnvVars: []string{"TUNNEL_SYSTEM_NAME"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "group",
+			Usage:   "Name of a group of cloudflared instances, of which this instance should be an identical copy. They can be configured collectively in the Declarative Tunnel UI. Mutually exclusive with `--system-name`.",
+			EnvVars: []string{"TUNNEL_GROUP"},
+			Hidden:  true,
+		}),
 		altsrc.NewDurationFlag(&cli.DurationFlag{
 			Name:    "dial-edge-timeout",
 			Usage:   "Maximum wait time to set up a connection with the edge",
@@ -1,148 +0,0 @@
-package sqlgateway
-
-import (
-	"database/sql"
-	"encoding/json"
-	"fmt"
-	"math/rand"
-	"net/http"
-	"strings"
-	"time"
-
-	_ "github.com/lib/pq"
-	cli "gopkg.in/urfave/cli.v2"
-
-	"github.com/elgs/gosqljson"
-
-	"github.com/gorilla/mux"
-	"github.com/sirupsen/logrus"
-)
-
-type Message struct {
-	Connection Connection    `json:"connection"`
-	Command    string        `json:"command"`
-	Params     []interface{} `json:"params"`
-}
-
-type Connection struct {
-	SSLMode string `json:"sslmode"`
-	Token   string `json:"token"`
-}
-
-type Response struct {
-	Columns []string   `json:"columns"`
-	Rows    [][]string `json:"rows"`
-	Error   string     `json:"error"`
-}
-
-type Proxy struct {
-	Context  *cli.Context
-	Router   *mux.Router
-	Token    string
-	User     string
-	Password string
-	Driver   string
-	Database string
-	Logger   *logrus.Logger
-}
-
-func StartProxy(c *cli.Context, logger *logrus.Logger, password string) error {
-	proxy := NewProxy(c, logger, password)
-
-	logger.Infof("Starting SQL Gateway Proxy on port %s", strings.Split(c.String("url"), ":")[1])
-
-	err := http.ListenAndServe(":"+strings.Split(c.String("url"), ":")[1], proxy.Router)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func randID(n int, c *cli.Context) string {
-	charBytes := []byte("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890")
-	b := make([]byte, n)
-	for i := range b {
-		b[i] = charBytes[rand.Intn(len(charBytes))]
-	}
-	return fmt.Sprintf("%s&%s", c.String("hostname"), b)
-}
-
-// db://user@dbname
-func parseInfo(input string) (string, string, string) {
-	p1 := strings.Split(input, "://")
-	p2 := strings.Split(p1[1], "@")
-	return p1[0], p2[0], p2[1]
-}
-
-func NewProxy(c *cli.Context, logger *logrus.Logger, pass string) *Proxy {
-	rand.Seed(time.Now().UnixNano())
-	driver, user, dbname := parseInfo(c.String("address"))
-	proxy := Proxy{
-		Context:  c,
-		Router:   mux.NewRouter(),
-		Token:    randID(64, c),
-		Logger:   logger,
-		User:     user,
-		Password: pass,
-		Database: dbname,
-		Driver:   driver,
-	}
-
-	logger.Info(fmt.Sprintf(`
-
-	--------------------
-	SQL Gateway Proxy
-	Token: %s
-	--------------------
-
-	`, proxy.Token))
-
-	proxy.Router.HandleFunc("/", proxy.proxyRequest).Methods("POST")
-	return &proxy
-}
-
-func (proxy *Proxy) proxyRequest(rw http.ResponseWriter, req *http.Request) {
-	var message Message
-	response := Response{}
-
-	err := json.NewDecoder(req.Body).Decode(&message)
-	if err != nil {
-		proxy.Logger.Error(err)
-		http.Error(rw, fmt.Sprintf("400 - %s", err.Error()), http.StatusBadRequest)
-		return
-	}
-
-	if message.Connection.Token != proxy.Token {
-		proxy.Logger.Error("Invalid token")
-		http.Error(rw, "400 - Invalid token", http.StatusBadRequest)
-		return
-	}
-
-	connStr := fmt.Sprintf("user=%s password=%s dbname=%s sslmode=%s", proxy.User, proxy.Password, proxy.Database, message.Connection.SSLMode)
-
-	db, err := sql.Open(proxy.Driver, connStr)
-	defer db.Close()
-
-	if err != nil {
-		proxy.Logger.Error(err)
-		http.Error(rw, fmt.Sprintf("400 - %s", err.Error()), http.StatusBadRequest)
-		return
-
-	} else {
-		proxy.Logger.Info("Forwarding SQL: ", message.Command)
-		rw.Header().Set("Content-Type", "application/json")
-
-		headers, data, err := gosqljson.QueryDbToArray(db, "lower", message.Command, message.Params...)
-
-		if err != nil {
-			proxy.Logger.Error(err)
-			http.Error(rw, fmt.Sprintf("400 - %s", err.Error()), http.StatusBadRequest)
-			return
-
-		} else {
-			response = Response{headers, data, ""}
-		}
-	}
-	json.NewEncoder(rw).Encode(response)
-}
@@ -47,6 +47,7 @@ type CloudflaredConfig struct {
 	CloudflaredID uuid.UUID
 	Tags          []pogs.Tag
 	BuildInfo     *buildinfo.BuildInfo
+	Scope         pogs.Scope
 }

 func NewEdgeManager(
@@ -120,32 +121,34 @@ func (em *EdgeManager) newConnection(ctx context.Context) error {
 		Logger:            em.logger.WithField("subsystem", "muxer"),
 	})
 	if err != nil {
-		return errors.Wrap(err, "handshake with edge error")
+		return errors.Wrap(err, "couldn't perform handshake with edge")
 	}

 	h2muxConn, err := newConnection(muxer, edgeIP)
 	if err != nil {
-		return errors.Wrap(err, "create h2mux connection error")
+		return errors.Wrap(err, "couldn't create h2mux connection")
 	}

 	go em.serveConn(ctx, h2muxConn)

 	connResult, err := h2muxConn.Connect(ctx, &pogs.ConnectParameters{
-		OriginCert:          em.state.getUserCredential(),
 		CloudflaredID:       em.cloudflaredConfig.CloudflaredID,
-		NumPreviousAttempts: 0,
 		CloudflaredVersion:  em.cloudflaredConfig.BuildInfo.CloudflaredVersion,
+		NumPreviousAttempts: 0,
+		OriginCert:          em.state.getUserCredential(),
+		Scope:               em.cloudflaredConfig.Scope,
+		Tags:                em.cloudflaredConfig.Tags,
 	}, em.logger)
 	if err != nil {
 		h2muxConn.Shutdown()
-		return errors.Wrap(err, "connect with edge error")
+		return errors.Wrap(err, "couldn't connect to edge")
 	}

 	if connErr := connResult.Err; connErr != nil {
 		if !connErr.ShouldRetry {
 			return errors.Wrap(connErr, em.noRetryMessage())
 		}
-		return errors.Wrapf(connErr, "server respond with retry at %v", connErr.RetryAfter)
+		return errors.Wrapf(connErr, "edge responded with RetryAfter=%v", connErr.RetryAfter)
 	}

 	em.state.newConnection(h2muxConn)
@@ -0,0 +1,145 @@
+package dbconnect
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"strings"
+	"time"
+	"unicode"
+	"unicode/utf8"
+)
+
+// Client is an interface to talk to any database.
+//
+// Currently, the only implementation is SQLClient, but its structure
+// should be designed to handle a MongoClient or RedisClient in the future.
+type Client interface {
+	Ping(context.Context) error
+	Submit(context.Context, *Command) (interface{}, error)
+}
+
+// NewClient creates a database client based on its URL scheme.
+func NewClient(ctx context.Context, originURL *url.URL) (Client, error) {
+	return NewSQLClient(ctx, originURL)
+}
+
+// Command is a standard, non-vendor format for submitting database commands.
+//
+// When determining the scope of this struct, refer to the following litmus test:
+// Could this (roughly) conform to SQL, Document-based, and Key-value command formats?
+type Command struct {
+	Statement string        `json:"statement"`
+	Arguments Arguments     `json:"arguments,omitempty"`
+	Mode      string        `json:"mode,omitempty"`
+	Isolation string        `json:"isolation,omitempty"`
+	Timeout   time.Duration `json:"timeout,omitempty"`
+}
+
+// Validate enforces the contract of Command: non empty statement (both in length and logic),
+// lowercase mode and isolation, non-zero timeout, and valid Arguments.
+func (cmd *Command) Validate() error {
+	if cmd.Statement == "" {
+		return fmt.Errorf("cannot provide an empty statement")
+	}
+
+	if strings.Map(func(char rune) rune {
+		if char == ';' || unicode.IsSpace(char) {
+			return -1
+		}
+		return char
+	}, cmd.Statement) == "" {
+		return fmt.Errorf("cannot provide a statement with no logic: '%s'", cmd.Statement)
+	}
+
+	cmd.Mode = strings.ToLower(cmd.Mode)
+	cmd.Isolation = strings.ToLower(cmd.Isolation)
+
+	if cmd.Timeout.Nanoseconds() <= 0 {
+		cmd.Timeout = 24 * time.Hour
+	}
+
+	return cmd.Arguments.Validate()
+}
+
+// UnmarshalJSON converts a byte representation of JSON into a Command, which is also validated.
+func (cmd *Command) UnmarshalJSON(data []byte) error {
+	// Alias is required to avoid infinite recursion from the default UnmarshalJSON.
+	type Alias Command
+	alias := &struct {
+		*Alias
+	}{
+		Alias: (*Alias)(cmd),
+	}
+
+	err := json.Unmarshal(data, &alias)
+	if err == nil {
+		err = cmd.Validate()
+	}
+
+	return err
+}
+
+// Arguments is a wrapper for either map-based or array-based Command arguments.
+//
+// Each field is mutually-exclusive and some Client implementations may not
+// support both fields (eg. MySQL does not accept named arguments).
+type Arguments struct {
+	Named      map[string]interface{}
+	Positional []interface{}
+}
+
+// Validate enforces the contract of Arguments: non nil, mutually exclusive, and no empty or reserved keys.
+func (args *Arguments) Validate() error {
+	if args.Named == nil {
+		args.Named = map[string]interface{}{}
+	}
+	if args.Positional == nil {
+		args.Positional = []interface{}{}
+	}
+
+	if len(args.Named) > 0 && len(args.Positional) > 0 {
+		return fmt.Errorf("both named and positional arguments cannot be specified: %+v and %+v", args.Named, args.Positional)
+	}
+
+	for key := range args.Named {
+		if key == "" {
+			return fmt.Errorf("named arguments cannot contain an empty key: %+v", args.Named)
+		}
+		if !utf8.ValidString(key) {
+			return fmt.Errorf("named argument does not conform to UTF-8 encoding: %s", key)
+		}
+		if strings.HasPrefix(key, "_") {
+			return fmt.Errorf("named argument cannot start with a reserved keyword '_': %s", key)
+		}
+		if unicode.IsNumber([]rune(key)[0]) {
+			return fmt.Errorf("named argument cannot start with a number: %s", key)
+		}
+	}
+
+	return nil
+}
+
+// UnmarshalJSON converts a byte representation of JSON into Arguments, which is also validated.
+func (args *Arguments) UnmarshalJSON(data []byte) error {
+	var obj interface{}
+	err := json.Unmarshal(data, &obj)
+	if err != nil {
+		return err
+	}
+
+	named, ok := obj.(map[string]interface{})
+	if ok {
+		args.Named = named
+	} else {
+		positional, ok := obj.([]interface{})
+		if ok {
+			args.Positional = positional
+		} else {
+			return fmt.Errorf("arguments must either be an object {\"0\":\"val\"} or an array [\"val\"]: %s", string(data))
+		}
+	}
+
+	return args.Validate()
+}
@@ -0,0 +1,183 @@
+package dbconnect
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCommandValidateEmpty(t *testing.T) {
+	stmts := []string{
+		"",
+		";",
+		" \n\t",
+		";\n;\t;",
+	}
+
+	for _, stmt := range stmts {
+		cmd := Command{Statement: stmt}
+
+		assert.Error(t, cmd.Validate(), stmt)
+	}
+}
+
+func TestCommandValidateMode(t *testing.T) {
+	modes := []string{
+		"",
+		"query",
+		"ExEc",
+		"PREPARE",
+	}
+
+	for _, mode := range modes {
+		cmd := Command{Statement: "Ok", Mode: mode}
+
+		assert.NoError(t, cmd.Validate(), mode)
+		assert.Equal(t, strings.ToLower(mode), cmd.Mode)
+	}
+}
+
+func TestCommandValidateIsolation(t *testing.T) {
+	isos := []string{
+		"",
+		"default",
+		"read_committed",
+		"SNAPshot",
+	}
+
+	for _, iso := range isos {
+		cmd := Command{Statement: "Ok", Isolation: iso}
+
+		assert.NoError(t, cmd.Validate(), iso)
+		assert.Equal(t, strings.ToLower(iso), cmd.Isolation)
+	}
+}
+
+func TestCommandValidateTimeout(t *testing.T) {
+	cmd := Command{Statement: "Ok", Timeout: 0}
+
+	assert.NoError(t, cmd.Validate())
+	assert.NotZero(t, cmd.Timeout)
+
+	cmd = Command{Statement: "Ok", Timeout: 1 * time.Second}
+
+	assert.NoError(t, cmd.Validate())
+	assert.Equal(t, 1*time.Second, cmd.Timeout)
+}
+
+func TestCommandValidateArguments(t *testing.T) {
+	cmd := Command{Statement: "Ok", Arguments: Arguments{
+		Named:      map[string]interface{}{"key": "val"},
+		Positional: []interface{}{"val"},
+	}}
+
+	assert.Error(t, cmd.Validate())
+}
+
+func TestCommandUnmarshalJSON(t *testing.T) {
+	strs := []string{
+		"{\"statement\":\"Ok\"}",
+		"{\"statement\":\"Ok\",\"arguments\":[0, 3.14, \"apple\"],\"mode\":\"query\"}",
+		"{\"statement\":\"Ok\",\"isolation\":\"read_uncommitted\",\"timeout\":1000}",
+	}
+
+	for _, str := range strs {
+		var cmd Command
+		assert.NoError(t, json.Unmarshal([]byte(str), &cmd), str)
+	}
+
+	strs = []string{
+		"",
+		"\"",
+		"{}",
+		"{\"argument\":{\"key\":\"val\"}}",
+		"{\"statement\":[\"Ok\"]}",
+	}
+
+	for _, str := range strs {
+		var cmd Command
+		assert.Error(t, json.Unmarshal([]byte(str), &cmd), str)
+	}
+}
+
+func TestArgumentsValidateNotNil(t *testing.T) {
+	args := Arguments{}
+
+	assert.NoError(t, args.Validate())
+	assert.NotNil(t, args.Named)
+	assert.NotNil(t, args.Positional)
+}
+
+func TestArgumentsValidateMutuallyExclusive(t *testing.T) {
+	args := []Arguments{
+		Arguments{},
+		Arguments{Named: map[string]interface{}{"key": "val"}},
+		Arguments{Positional: []interface{}{"val"}},
+	}
+
+	for _, arg := range args {
+		assert.NoError(t, arg.Validate())
+		assert.False(t, len(arg.Named) > 0 && len(arg.Positional) > 0)
+	}
+
+	args = []Arguments{
+		Arguments{
+			Named:      map[string]interface{}{"key": "val"},
+			Positional: []interface{}{"val"},
+		},
+	}
+
+	for _, arg := range args {
+		assert.Error(t, arg.Validate())
+		assert.True(t, len(arg.Named) > 0 && len(arg.Positional) > 0)
+	}
+}
+
+func TestArgumentsValidateKeys(t *testing.T) {
+	keys := []string{
+		"",
+		"_",
+		"_key",
+		"1",
+		"1key",
+		"\xf0\x28\x8c\xbc", // non-utf8
+	}
+
+	for _, key := range keys {
+		args := Arguments{Named: map[string]interface{}{key: "val"}}
+
+		assert.Error(t, args.Validate(), key)
+	}
+}
+
+func TestArgumentsUnmarshalJSON(t *testing.T) {
+	strs := []string{
+		"{}",
+		"{\"key\":\"val\"}",
+		"{\"key\":[1, 3.14, {\"key\":\"val\"}]}",
+		"[]",
+		"[\"key\",\"val\"]",
+		"[{}]",
+	}
+
+	for _, str := range strs {
+		var args Arguments
+		assert.NoError(t, json.Unmarshal([]byte(str), &args), str)
+	}
+
+	strs = []string{
+		"",
+		"\"",
+		"1",
+		"\"key\"",
+		"{\"key\",\"val\"}",
+	}
+
+	for _, str := range strs {
+		var args Arguments
+		assert.Error(t, json.Unmarshal([]byte(str), &args), str)
+	}
+}
@@ -0,0 +1,157 @@
+package dbconnect
+
+import (
+	"context"
+	"log"
+	"net"
+	"strconv"
+
+	"gopkg.in/urfave/cli.v2"
+	"gopkg.in/urfave/cli.v2/altsrc"
+)
+
+// Cmd is the entrypoint command for dbconnect.
+//
+// The tunnel package is responsible for appending this to tunnel.Commands().
+func Cmd() *cli.Command {
+	return &cli.Command{
+		Category:  "Database Connect (ALPHA)",
+		Name:      "db-connect",
+		Usage:     "Access your SQL database from Cloudflare Workers or the browser",
+		ArgsUsage: " ",
+		Description: `
+		Creates a connection between your database and the Cloudflare edge.
+		Now you can execute SQL commands anywhere you can send HTTPS requests.
+
+		Connect your database with any of the following commands, you can also try the "playground" without a database:
+
+			cloudflared db-connect --hostname sql.mysite.com --url postgres://user:pass@localhost?sslmode=disable \
+			                       --auth-domain mysite.cloudflareaccess.com --application-aud my-access-policy-tag
+			cloudflared db-connect --hostname sql-dev.mysite.com --url mysql://localhost --insecure
+			cloudflared db-connect --playground
+		
+		Requests should be authenticated using Cloudflare Access, learn more about how to enable it here:
+
+			https://developers.cloudflare.com/access/service-auth/service-token/
+		`,
+		Flags: []cli.Flag{
+			altsrc.NewStringFlag(&cli.StringFlag{
+				Name:    "url",
+				Usage:   "URL to the database (eg. postgres://user:pass@localhost?sslmode=disable)",
+				EnvVars: []string{"TUNNEL_URL"},
+			}),
+			altsrc.NewStringFlag(&cli.StringFlag{
+				Name:    "hostname",
+				Usage:   "Hostname to accept commands over HTTPS (eg. sql.mysite.com)",
+				EnvVars: []string{"TUNNEL_HOSTNAME"},
+			}),
+			altsrc.NewStringFlag(&cli.StringFlag{
+				Name:    "auth-domain",
+				Usage:   "Cloudflare Access authentication domain for your account (eg. mysite.cloudflareaccess.com)",
+				EnvVars: []string{"TUNNEL_ACCESS_AUTH_DOMAIN"},
+			}),
+			altsrc.NewStringFlag(&cli.StringFlag{
+				Name:    "application-aud",
+				Usage:   "Cloudflare Access application \"AUD\" to verify JWTs from requests",
+				EnvVars: []string{"TUNNEL_ACCESS_APPLICATION_AUD"},
+			}),
+			altsrc.NewBoolFlag(&cli.BoolFlag{
+				Name:    "insecure",
+				Usage:   "Disable authentication, the database will be open to the Internet",
+				Value:   false,
+				EnvVars: []string{"TUNNEL_ACCESS_INSECURE"},
+			}),
+			altsrc.NewBoolFlag(&cli.BoolFlag{
+				Name:    "playground",
+				Usage:   "Run a temporary, in-memory SQLite3 database for testing",
+				Value:   false,
+				EnvVars: []string{"TUNNEL_HELLO_WORLD"},
+			}),
+			altsrc.NewStringFlag(&cli.StringFlag{
+				Name:    "loglevel",
+				Value:   "debug", // Make it more verbose than the tunnel default 'info'.
+				EnvVars: []string{"TUNNEL_LOGLEVEL"},
+				Hidden:  true,
+			}),
+		},
+		Before: CmdBefore,
+		Action: CmdAction,
+		Hidden: true,
+	}
+}
+
+// CmdBefore runs some validation checks before running the command.
+func CmdBefore(c *cli.Context) error {
+	// Show the help text is no flags are specified.
+	if c.NumFlags() == 0 {
+		return cli.ShowSubcommandHelp(c)
+	}
+
+	// Hello-world and playground are synonymous with each other,
+	// unset hello-world to prevent tunnel from initializing the hello package.
+	if c.IsSet("hello-world") {
+		c.Set("playground", "true")
+		c.Set("hello-world", "false")
+	}
+
+	// Unix-socket database urls are supported, but the logic is the same as url.
+	if c.IsSet("unix-socket") {
+		c.Set("url", c.String("unix-socket"))
+		c.Set("unix-socket", "")
+	}
+
+	// When playground mode is enabled, run with an in-memory database.
+	if c.IsSet("playground") {
+		c.Set("url", "sqlite3::memory:?cache=shared")
+		c.Set("insecure", strconv.FormatBool(!c.IsSet("auth-domain") && !c.IsSet("application-aud")))
+	}
+
+	// At this point, insecure configurations are valid.
+	if c.Bool("insecure") {
+		return nil
+	}
+
+	// Ensure that secure configurations specify a hostname, domain, and tag for JWT validation.
+	if !c.IsSet("hostname") || !c.IsSet("auth-domain") || !c.IsSet("application-aud") {
+		log.Fatal("must specify --hostname, --auth-domain, and --application-aud unless you want to run in --insecure mode")
+	}
+
+	return nil
+}
+
+// CmdAction starts the Proxy and sets the url in cli.Context to point to the Proxy address.
+func CmdAction(c *cli.Context) error {
+	// STOR-612: sync with context in tunnel daemon.
+	ctx := context.Background()
+
+	var proxy *Proxy
+	var err error
+	if c.Bool("insecure") {
+		proxy, err = NewInsecureProxy(ctx, c.String("url"))
+	} else {
+		proxy, err = NewSecureProxy(ctx, c.String("url"), c.String("auth-domain"), c.String("application-aud"))
+	}
+
+	if err != nil {
+		log.Fatal(err)
+		return err
+	}
+
+	listenerC := make(chan net.Listener)
+	defer close(listenerC)
+
+	// Since the Proxy should only talk to the tunnel daemon, find the next available
+	// localhost port and start to listen to requests.
+	go func() {
+		err := proxy.Start(ctx, "127.0.0.1:", listenerC)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}()
+
+	// Block until the the Proxy is online, retreive its address, and change the url to point to it.
+	// This is effectively "handing over" control to the tunnel package so it can run the tunnel daemon.
+	c.Set("url", "https://"+(<-listenerC).Addr().String())
+
+	return nil
+}
@@ -0,0 +1,27 @@
+package dbconnect
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"gopkg.in/urfave/cli.v2"
+)
+
+func TestCmd(t *testing.T) {
+	tests := [][]string{
+		{"cloudflared", "db-connect", "--playground"},
+		{"cloudflared", "db-connect", "--playground", "--hostname", "sql.mysite.com"},
+		{"cloudflared", "db-connect", "--url", "sqlite3::memory:?cache=shared", "--insecure"},
+		{"cloudflared", "db-connect", "--url", "sqlite3::memory:?cache=shared", "--hostname", "sql.mysite.com", "--auth-domain", "mysite.cloudflareaccess.com", "--application-aud", "aud"},
+	}
+
+	app := &cli.App{
+		Name:     "cloudflared",
+		Commands: []*cli.Command{Cmd()},
+	}
+
+	for _, test := range tests {
+		assert.NoError(t, app.Run(test))
+	}
+}
@@ -0,0 +1,78 @@
+# docker-compose -f ./dbconnect/integration_test/dbconnect.yaml up --build --force-recreate --renew-anon-volumes --exit-code-from cloudflared
+
+version: "2.3"
+networks:
+  test-dbconnect-network:
+    driver: bridge
+services:
+  cloudflared:
+    build:
+      context: ../../
+      dockerfile: dev.Dockerfile
+    command: go test github.com/cloudflare/cloudflared/dbconnect/integration_test -v
+    depends_on:
+      postgres:
+        condition: service_healthy
+      mysql:
+        condition: service_healthy
+      mssql:
+        condition: service_healthy
+      clickhouse:
+        condition: service_healthy
+    environment:
+      DBCONNECT_INTEGRATION_TEST: "true"
+      POSTGRESQL_URL: postgres://postgres:secret@postgres/db?sslmode=disable
+      MYSQL_URL: mysql://root:secret@mysql/db?tls=false
+      MSSQL_URL: mssql://sa:secret12345!@mssql
+      CLICKHOUSE_URL: clickhouse://clickhouse:9000/db
+    networks:
+      - test-dbconnect-network
+  postgres:
+    image: postgres:11.4-alpine
+    environment:
+      POSTGRES_DB: db
+      POSTGRES_PASSWORD: secret
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres"]
+      start_period: 3s
+      interval: 1s
+      timeout: 3s
+      retries: 10
+    networks:
+      - test-dbconnect-network
+  mysql:
+    image: mysql:8.0
+    environment:
+      MYSQL_DATABASE: db
+      MYSQL_ROOT_PASSWORD: secret
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping"]
+      start_period: 3s
+      interval: 1s
+      timeout: 3s
+      retries: 10
+    networks:
+      - test-dbconnect-network
+  mssql:
+    image: mcr.microsoft.com/mssql/server:2017-CU8-ubuntu
+    environment:
+      ACCEPT_EULA: "Y"
+      SA_PASSWORD: secret12345!
+    healthcheck:
+      test: ["CMD", "/opt/mssql-tools/bin/sqlcmd", "-S", "localhost", "-U", "sa", "-P", "secret12345!", "-Q", "SELECT 1"]
+      start_period: 3s
+      interval: 1s
+      timeout: 3s
+      retries: 10
+    networks:
+      - test-dbconnect-network
+  clickhouse:
+    image: yandex/clickhouse-server:19.11
+    healthcheck:
+      test: ["CMD", "clickhouse-client", "--query", "SELECT 1"]
+      start_period: 3s
+      interval: 1s
+      timeout: 3s
+      retries: 10
+    networks:
+      - test-dbconnect-network
@@ -0,0 +1,265 @@
+package dbconnect_test
+
+import (
+	"context"
+	"log"
+	"net/url"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/cloudflare/cloudflared/dbconnect"
+)
+
+func TestIntegrationPostgreSQL(t *testing.T) {
+	ctx, pq := helperNewSQLClient(t, "POSTGRESQL_URL")
+
+	err := pq.Ping(ctx)
+	assert.NoError(t, err)
+
+	_, err = pq.Submit(ctx, &dbconnect.Command{
+		Statement: "CREATE TABLE t (a TEXT, b UUID, c JSON, d INET[], e SERIAL);",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+
+	_, err = pq.Submit(ctx, &dbconnect.Command{
+		Statement: "INSERT INTO t VALUES ($1, $2, $3, $4);",
+		Mode:      "exec",
+		Arguments: dbconnect.Arguments{
+			Positional: []interface{}{
+				"text",
+				"6b8d686d-bd8e-43bc-b09a-cfcbbe702c10",
+				"{\"bool\":true,\"array\":[\"a\", 1, 3.14],\"embed\":{\"num\":21}}",
+				[]string{"1.1.1.1", "1.0.0.1"},
+			},
+		},
+	})
+	assert.NoError(t, err)
+
+	_, err = pq.Submit(ctx, &dbconnect.Command{
+		Statement: "UPDATE t SET b = NULL;",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+
+	res, err := pq.Submit(ctx, &dbconnect.Command{
+		Statement: "SELECT * FROM t;",
+		Mode:      "query",
+	})
+	assert.NoError(t, err)
+	assert.IsType(t, make([]map[string]interface{}, 0), res)
+
+	actual := res.([]map[string]interface{})[0]
+	expected := map[string]interface{}{
+		"a": "text",
+		"b": nil,
+		"c": map[string]interface{}{
+			"bool":  true,
+			"array": []interface{}{"a", float64(1), 3.14},
+			"embed": map[string]interface{}{"num": float64(21)},
+		},
+		"d": "{1.1.1.1,1.0.0.1}",
+		"e": int64(1),
+	}
+	assert.EqualValues(t, expected, actual)
+
+	_, err = pq.Submit(ctx, &dbconnect.Command{
+		Statement: "DROP TABLE t;",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+}
+
+func TestIntegrationMySQL(t *testing.T) {
+	ctx, my := helperNewSQLClient(t, "MYSQL_URL")
+
+	err := my.Ping(ctx)
+	assert.NoError(t, err)
+
+	_, err = my.Submit(ctx, &dbconnect.Command{
+		Statement: "CREATE TABLE t (a CHAR, b TINYINT, c FLOAT, d JSON, e YEAR);",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+
+	_, err = my.Submit(ctx, &dbconnect.Command{
+		Statement: "INSERT INTO t VALUES (?, ?, ?, ?, ?);",
+		Mode:      "exec",
+		Arguments: dbconnect.Arguments{
+			Positional: []interface{}{
+				"a",
+				10,
+				3.14,
+				"{\"bool\":true}",
+				2000,
+			},
+		},
+	})
+	assert.NoError(t, err)
+
+	_, err = my.Submit(ctx, &dbconnect.Command{
+		Statement: "ALTER TABLE t ADD COLUMN f GEOMETRY;",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+
+	res, err := my.Submit(ctx, &dbconnect.Command{
+		Statement: "SELECT * FROM t;",
+		Mode:      "query",
+	})
+	assert.NoError(t, err)
+	assert.IsType(t, make([]map[string]interface{}, 0), res)
+
+	actual := res.([]map[string]interface{})[0]
+	expected := map[string]interface{}{
+		"a": "a",
+		"b": float64(10),
+		"c": 3.14,
+		"d": map[string]interface{}{"bool": true},
+		"e": float64(2000),
+		"f": nil,
+	}
+	assert.EqualValues(t, expected, actual)
+
+	_, err = my.Submit(ctx, &dbconnect.Command{
+		Statement: "DROP TABLE t;",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+}
+
+func TestIntegrationMSSQL(t *testing.T) {
+	ctx, ms := helperNewSQLClient(t, "MSSQL_URL")
+
+	err := ms.Ping(ctx)
+	assert.NoError(t, err)
+
+	_, err = ms.Submit(ctx, &dbconnect.Command{
+		Statement: "CREATE TABLE t (a BIT, b DECIMAL, c MONEY, d TEXT);",
+		Mode:      "exec"})
+	assert.NoError(t, err)
+
+	_, err = ms.Submit(ctx, &dbconnect.Command{
+		Statement: "INSERT INTO t VALUES (?, ?, ?, ?);",
+		Mode:      "exec",
+		Arguments: dbconnect.Arguments{
+			Positional: []interface{}{
+				0,
+				3,
+				"$0.99",
+				"text",
+			},
+		},
+	})
+	assert.NoError(t, err)
+
+	_, err = ms.Submit(ctx, &dbconnect.Command{
+		Statement: "UPDATE t SET d = NULL;",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+
+	res, err := ms.Submit(ctx, &dbconnect.Command{
+		Statement: "SELECT * FROM t;",
+		Mode:      "query",
+	})
+	assert.NoError(t, err)
+	assert.IsType(t, make([]map[string]interface{}, 0), res)
+
+	actual := res.([]map[string]interface{})[0]
+	expected := map[string]interface{}{
+		"a": false,
+		"b": float64(3),
+		"c": float64(0.99),
+		"d": nil,
+	}
+	assert.EqualValues(t, expected, actual)
+
+	_, err = ms.Submit(ctx, &dbconnect.Command{
+		Statement: "DROP TABLE t;",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+}
+
+func TestIntegrationClickhouse(t *testing.T) {
+	ctx, ch := helperNewSQLClient(t, "CLICKHOUSE_URL")
+
+	err := ch.Ping(ctx)
+	assert.NoError(t, err)
+
+	_, err = ch.Submit(ctx, &dbconnect.Command{
+		Statement: "CREATE TABLE t (a UUID, b String, c Float64, d UInt32, e Int16, f Array(Enum8('a'=1, 'b'=2, 'c'=3))) engine=Memory;",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+
+	_, err = ch.Submit(ctx, &dbconnect.Command{
+		Statement: "INSERT INTO t VALUES (?, ?, ?, ?, ?, ?);",
+		Mode:      "exec",
+		Arguments: dbconnect.Arguments{
+			Positional: []interface{}{
+				"ec65f626-6f50-4c86-9628-6314ef1edacd",
+				"",
+				3.14,
+				314,
+				-144,
+				[]string{"a", "b", "c"},
+			},
+		},
+	})
+	assert.NoError(t, err)
+
+	res, err := ch.Submit(ctx, &dbconnect.Command{
+		Statement: "SELECT * FROM t;",
+		Mode:      "query",
+	})
+	assert.NoError(t, err)
+	assert.IsType(t, make([]map[string]interface{}, 0), res)
+
+	actual := res.([]map[string]interface{})[0]
+	expected := map[string]interface{}{
+		"a": "ec65f626-6f50-4c86-9628-6314ef1edacd",
+		"b": "",
+		"c": float64(3.14),
+		"d": uint32(314),
+		"e": int16(-144),
+		"f": []string{"a", "b", "c"},
+	}
+	assert.EqualValues(t, expected, actual)
+
+	_, err = ch.Submit(ctx, &dbconnect.Command{
+		Statement: "DROP TABLE t;",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+}
+
+func helperNewSQLClient(t *testing.T, env string) (context.Context, dbconnect.Client) {
+	_, ok := os.LookupEnv("DBCONNECT_INTEGRATION_TEST")
+	if ok {
+		t.Helper()
+	} else {
+		t.SkipNow()
+	}
+
+	val, ok := os.LookupEnv(env)
+	if !ok {
+		log.Fatalf("must provide database url as environment variable: %s", env)
+	}
+
+	parsed, err := url.Parse(val)
+	if err != nil {
+		log.Fatalf("cannot provide invalid database url: %s=%s", env, val)
+	}
+
+	ctx := context.Background()
+	client, err := dbconnect.NewSQLClient(ctx, parsed)
+	if err != nil {
+		log.Fatalf("could not start test client: %s", err)
+	}
+
+	return ctx, client
+}
@@ -0,0 +1,274 @@
+package dbconnect
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/cloudflare/cloudflared/hello"
+	"github.com/cloudflare/cloudflared/validation"
+	"github.com/gorilla/mux"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	timing "github.com/mitchellh/go-server-timing"
+)
+
+// Proxy is an HTTP server that proxies requests to a Client.
+type Proxy struct {
+	client          Client
+	accessValidator *validation.Access
+	logger          *logrus.Logger
+}
+
+// NewInsecureProxy creates a Proxy that talks to a Client at an origin.
+//
+// In insecure mode, the Proxy will allow all Command requests.
+func NewInsecureProxy(ctx context.Context, origin string) (*Proxy, error) {
+	originURL, err := url.Parse(origin)
+	if err != nil {
+		return nil, errors.Wrap(err, "must provide a valid database url")
+	}
+
+	client, err := NewClient(ctx, originURL)
+	if err != nil {
+		return nil, err
+	}
+
+	err = client.Ping(ctx)
+	if err != nil {
+		return nil, errors.Wrap(err, "could not connect to the database")
+	}
+
+	return &Proxy{client, nil, logrus.New()}, nil
+}
+
+// NewSecureProxy creates a Proxy that talks to a Client at an origin.
+//
+// In secure mode, the Proxy will reject any Command requests that are
+// not authenticated by Cloudflare Access with a valid JWT.
+func NewSecureProxy(ctx context.Context, origin, authDomain, applicationAUD string) (*Proxy, error) {
+	proxy, err := NewInsecureProxy(ctx, origin)
+	if err != nil {
+		return nil, err
+	}
+
+	validator, err := validation.NewAccessValidator(ctx, authDomain, authDomain, applicationAUD)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy.accessValidator = validator
+	return proxy, err
+}
+
+// IsInsecure gets whether the Proxy will accept a Command from any source.
+func (proxy *Proxy) IsInsecure() bool {
+	return proxy.accessValidator == nil
+}
+
+// IsAllowed checks whether a http.Request is allowed to receive data.
+//
+// By default, requests must pass through Cloudflare Access for authentication.
+// If the proxy is explcitly set to insecure mode, all requests will be allowed.
+func (proxy *Proxy) IsAllowed(r *http.Request, verbose ...bool) bool {
+	if proxy.IsInsecure() {
+		return true
+	}
+
+	// Access and Tunnel should prevent bad JWTs from even reaching the origin,
+	// but validate tokens anyway as an abundance of caution.
+	err := proxy.accessValidator.ValidateRequest(r.Context(), r)
+	if err == nil {
+		return true
+	}
+
+	// Warn administrators that invalid JWTs are being rejected. This is indicative
+	// of either a misconfiguration of the CLI or a massive failure of upstream systems.
+	if len(verbose) > 0 {
+		proxy.httpLog(r, err).Error("Failed JWT authentication")
+	}
+
+	return false
+}
+
+// Start the Proxy at a given address and notify the listener channel when the server is online.
+func (proxy *Proxy) Start(ctx context.Context, addr string, listenerC chan<- net.Listener) error {
+	// STOR-611: use a seperate listener and consider web socket support.
+	httpListener, err := hello.CreateTLSListener(addr)
+	if err != nil {
+		return errors.Wrapf(err, "could not create listener at %s", addr)
+	}
+
+	errC := make(chan error)
+	defer close(errC)
+
+	// Starts the HTTP server and begins to serve requests.
+	go func() {
+		errC <- proxy.httpListen(ctx, httpListener)
+	}()
+
+	// Continually ping the server until it comes online or 10 attempts fail.
+	go func() {
+		var err error
+		for i := 0; i < 10; i++ {
+			_, err = http.Get("http://" + httpListener.Addr().String())
+
+			// Once no error was detected, notify the listener channel and return.
+			if err == nil {
+				listenerC <- httpListener
+				return
+			}
+
+			// Backoff between requests to ping the server.
+			<-time.After(1 * time.Second)
+		}
+		errC <- errors.Wrap(err, "took too long for the http server to start")
+	}()
+
+	return <-errC
+}
+
+// httpListen starts the httpServer and blocks until the context closes.
+func (proxy *Proxy) httpListen(ctx context.Context, listener net.Listener) error {
+	httpServer := &http.Server{
+		Addr:         listener.Addr().String(),
+		Handler:      timing.Middleware(proxy.httpRouter(), nil),
+		ReadTimeout:  10 * time.Second,
+		WriteTimeout: 60 * time.Second,
+		IdleTimeout:  60 * time.Second,
+	}
+
+	go func() {
+		<-ctx.Done()
+		httpServer.Close()
+		listener.Close()
+	}()
+
+	return httpServer.Serve(listener)
+}
+
+// httpRouter creates a mux.Router for the Proxy.
+func (proxy *Proxy) httpRouter() *mux.Router {
+	router := mux.NewRouter()
+
+	router.HandleFunc("/ping", proxy.httpPing()).Methods("GET", "HEAD")
+	router.HandleFunc("/submit", proxy.httpSubmit()).Methods("POST")
+
+	return router
+}
+
+// httpPing tests the connection to the database.
+//
+// By default, this endpoint is unauthenticated to allow for health checks.
+// To enable authentication, Cloudflare Access must be enabled on this route.
+func (proxy *Proxy) httpPing() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		metric := timing.FromContext(ctx).NewMetric("db").Start()
+		err := proxy.client.Ping(ctx)
+		metric.Stop()
+
+		if err == nil {
+			proxy.httpRespond(w, r, http.StatusOK, "")
+		} else {
+			proxy.httpRespondErr(w, r, http.StatusInternalServerError, err)
+		}
+	}
+}
+
+// httpSubmit sends a command to the database and returns its response.
+//
+// By default, this endpoint will reject requests that do not pass through Cloudflare Access.
+// To disable authentication, the --insecure flag must be specified in the command line.
+func (proxy *Proxy) httpSubmit() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !proxy.IsAllowed(r, true) {
+			proxy.httpRespondErr(w, r, http.StatusForbidden, fmt.Errorf(""))
+			return
+		}
+
+		var cmd Command
+		err := json.NewDecoder(r.Body).Decode(&cmd)
+		if err != nil {
+			proxy.httpRespondErr(w, r, http.StatusBadRequest, err)
+			return
+		}
+
+		ctx := r.Context()
+		metric := timing.FromContext(ctx).NewMetric("db").Start()
+		data, err := proxy.client.Submit(ctx, &cmd)
+		metric.Stop()
+
+		if err != nil {
+			proxy.httpRespondErr(w, r, http.StatusUnprocessableEntity, err)
+			return
+		}
+
+		w.Header().Set("Content-type", "application/json")
+		err = json.NewEncoder(w).Encode(data)
+		if err != nil {
+			proxy.httpRespondErr(w, r, http.StatusInternalServerError, err)
+		}
+	}
+}
+
+// httpRespond writes a status code and string response to the response writer.
+func (proxy *Proxy) httpRespond(w http.ResponseWriter, r *http.Request, status int, message string) {
+	w.WriteHeader(status)
+
+	// Only expose the message detail of the reponse if the request is not HEAD
+	// and the user is authenticated. For example, this prevents an unauthenticated
+	// failed health check from accidentally leaking sensitive information about the Client.
+	if r.Method != http.MethodHead && proxy.IsAllowed(r) {
+		if message == "" {
+			message = http.StatusText(status)
+		}
+		fmt.Fprint(w, message)
+	}
+}
+
+// httpRespondErr is similar to httpRespond, except it formats errors to be more friendly.
+func (proxy *Proxy) httpRespondErr(w http.ResponseWriter, r *http.Request, defaultStatus int, err error) {
+	status, err := httpError(defaultStatus, err)
+
+	proxy.httpRespond(w, r, status, err.Error())
+	proxy.httpLog(r, err).Warn("Database connect error")
+}
+
+// httpLog returns a logrus.Entry that is formatted to output a request Cf-ray.
+func (proxy *Proxy) httpLog(r *http.Request, err error) *logrus.Entry {
+	return proxy.logger.WithContext(r.Context()).WithField("CF-RAY", r.Header.Get("Cf-ray")).WithError(err)
+}
+
+// httpError extracts common errors and returns an status code and friendly error.
+func httpError(defaultStatus int, err error) (int, error) {
+	if err == nil {
+		return http.StatusNotImplemented, fmt.Errorf("error expected but found none")
+	}
+
+	if err == io.EOF {
+		return http.StatusBadRequest, fmt.Errorf("request body cannot be empty")
+	}
+
+	if err == context.DeadlineExceeded {
+		return http.StatusRequestTimeout, err
+	}
+
+	_, ok := err.(net.Error)
+	if ok {
+		return http.StatusRequestTimeout, err
+	}
+
+	if err == context.Canceled {
+		// Does not exist in Golang, but would be: http.StatusClientClosedWithoutResponse
+		return 444, err
+	}
+
+	return defaultStatus, err
+}
@@ -0,0 +1,238 @@
+package dbconnect
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewInsecureProxy(t *testing.T) {
+	origins := []string{
+		"",
+		":/",
+		"http://localhost",
+		"tcp://localhost:9000?debug=true",
+		"mongodb://127.0.0.1",
+	}
+
+	for _, origin := range origins {
+		proxy, err := NewInsecureProxy(context.Background(), origin)
+
+		assert.Error(t, err)
+		assert.Empty(t, proxy)
+	}
+}
+
+func TestProxyIsAllowed(t *testing.T) {
+	proxy := helperNewProxy(t)
+	req := httptest.NewRequest("GET", "https://1.1.1.1/ping", nil)
+	assert.True(t, proxy.IsAllowed(req))
+
+	proxy = helperNewProxy(t, true)
+	req.Header.Set("Cf-access-jwt-assertion", "xxx")
+	assert.False(t, proxy.IsAllowed(req))
+}
+
+func TestProxyStart(t *testing.T) {
+	proxy := helperNewProxy(t)
+	ctx := context.Background()
+	listenerC := make(chan net.Listener)
+
+	err := proxy.Start(ctx, "1.1.1.1:", listenerC)
+	assert.Error(t, err)
+
+	err = proxy.Start(ctx, "127.0.0.1:-1", listenerC)
+	assert.Error(t, err)
+
+	ctx, cancel := context.WithTimeout(ctx, 0)
+	defer cancel()
+
+	err = proxy.Start(ctx, "127.0.0.1:", listenerC)
+	assert.IsType(t, http.ErrServerClosed, err)
+}
+
+func TestProxyHTTPRouter(t *testing.T) {
+	proxy := helperNewProxy(t)
+	router := proxy.httpRouter()
+
+	tests := []struct {
+		path   string
+		method string
+		valid  bool
+	}{
+		{"", "GET", false},
+		{"/", "GET", false},
+		{"/ping", "GET", true},
+		{"/ping", "HEAD", true},
+		{"/ping", "POST", false},
+		{"/submit", "POST", true},
+		{"/submit", "GET", false},
+		{"/submit/extra", "POST", false},
+	}
+
+	for _, test := range tests {
+		match := &mux.RouteMatch{}
+		ok := router.Match(httptest.NewRequest(test.method, "https://1.1.1.1"+test.path, nil), match)
+
+		assert.True(t, ok == test.valid, test.path)
+	}
+}
+
+func TestProxyHTTPPing(t *testing.T) {
+	proxy := helperNewProxy(t)
+
+	server := httptest.NewServer(proxy.httpPing())
+	defer server.Close()
+	client := server.Client()
+
+	res, err := client.Get(server.URL)
+	assert.NoError(t, err)
+	assert.Equal(t, http.StatusOK, res.StatusCode)
+	assert.Equal(t, int64(2), res.ContentLength)
+
+	res, err = client.Head(server.URL)
+	assert.NoError(t, err)
+	assert.Equal(t, http.StatusOK, res.StatusCode)
+	assert.Equal(t, int64(-1), res.ContentLength)
+}
+
+func TestProxyHTTPSubmit(t *testing.T) {
+	proxy := helperNewProxy(t)
+
+	server := httptest.NewServer(proxy.httpSubmit())
+	defer server.Close()
+	client := server.Client()
+
+	tests := []struct {
+		input  string
+		status int
+		output string
+	}{
+		{"", http.StatusBadRequest, "request body cannot be empty"},
+		{"{}", http.StatusBadRequest, "cannot provide an empty statement"},
+		{"{\"statement\":\"Ok\"}", http.StatusUnprocessableEntity, "cannot provide invalid sql mode: ''"},
+		{"{\"statement\":\"Ok\",\"mode\":\"query\"}", http.StatusUnprocessableEntity, "near \"Ok\": syntax error"},
+		{"{\"statement\":\"CREATE TABLE t (a INT);\",\"mode\":\"exec\"}", http.StatusOK, "{\"last_insert_id\":0,\"rows_affected\":0}\n"},
+	}
+
+	for _, test := range tests {
+		res, err := client.Post(server.URL, "application/json", strings.NewReader(test.input))
+
+		assert.NoError(t, err)
+		assert.Equal(t, test.status, res.StatusCode)
+		if res.StatusCode > http.StatusOK {
+			assert.Equal(t, "text/plain; charset=utf-8", res.Header.Get("Content-type"))
+		} else {
+			assert.Equal(t, "application/json", res.Header.Get("Content-type"))
+		}
+
+		data, err := ioutil.ReadAll(res.Body)
+		defer res.Body.Close()
+		str := string(data)
+
+		assert.NoError(t, err)
+		assert.Equal(t, test.output, str)
+	}
+}
+
+func TestProxyHTTPSubmitForbidden(t *testing.T) {
+	proxy := helperNewProxy(t, true)
+
+	server := httptest.NewServer(proxy.httpSubmit())
+	defer server.Close()
+	client := server.Client()
+
+	res, err := client.Get(server.URL)
+
+	assert.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, res.StatusCode)
+	assert.Zero(t, res.ContentLength)
+}
+
+func TestProxyHTTPRespond(t *testing.T) {
+	proxy := helperNewProxy(t)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		proxy.httpRespond(w, r, http.StatusAccepted, "Hello")
+	}))
+	defer server.Close()
+	client := server.Client()
+
+	res, err := client.Get(server.URL)
+	assert.NoError(t, err)
+	assert.Equal(t, http.StatusAccepted, res.StatusCode)
+	assert.Equal(t, int64(5), res.ContentLength)
+
+	data, err := ioutil.ReadAll(res.Body)
+	defer res.Body.Close()
+	assert.Equal(t, []byte("Hello"), data)
+}
+
+func TestProxyHTTPRespondForbidden(t *testing.T) {
+	proxy := helperNewProxy(t, true)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		proxy.httpRespond(w, r, http.StatusAccepted, "Hello")
+	}))
+	defer server.Close()
+	client := server.Client()
+
+	res, err := client.Get(server.URL)
+
+	assert.NoError(t, err)
+	assert.Equal(t, http.StatusAccepted, res.StatusCode)
+	assert.Equal(t, int64(0), res.ContentLength)
+}
+
+func TestHTTPError(t *testing.T) {
+	_, errTimeout := net.DialTimeout("tcp", "127.0.0.1", 0)
+	assert.Error(t, errTimeout)
+
+	tests := []struct {
+		input  error
+		status int
+		output error
+	}{
+		{nil, http.StatusNotImplemented, fmt.Errorf("error expected but found none")},
+		{io.EOF, http.StatusBadRequest, fmt.Errorf("request body cannot be empty")},
+		{context.DeadlineExceeded, http.StatusRequestTimeout, nil},
+		{context.Canceled, 444, nil},
+		{errTimeout, http.StatusRequestTimeout, nil},
+		{fmt.Errorf(""), http.StatusInternalServerError, nil},
+	}
+
+	for _, test := range tests {
+		status, err := httpError(http.StatusInternalServerError, test.input)
+
+		assert.Error(t, err)
+		assert.Equal(t, test.status, status)
+		if test.output == nil {
+			test.output = test.input
+		}
+		assert.Equal(t, test.output, err)
+	}
+}
+
+func helperNewProxy(t *testing.T, secure ...bool) *Proxy {
+	t.Helper()
+
+	proxy, err := NewSecureProxy(context.Background(), "file::memory:?cache=shared", "test.cloudflareaccess.com", "")
+	assert.NoError(t, err)
+	assert.NotNil(t, proxy)
+
+	if len(secure) == 0 {
+		proxy.accessValidator = nil // Mark as insecure
+	}
+
+	return proxy
+}
@@ -0,0 +1,318 @@
+package dbconnect
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"reflect"
+	"strings"
+
+	"github.com/jmoiron/sqlx"
+	"github.com/pkg/errors"
+	"github.com/xo/dburl"
+
+	// SQL drivers self-register with the database/sql package.
+	// https://github.com/golang/go/wiki/SQLDrivers
+	_ "github.com/denisenkom/go-mssqldb"
+	_ "github.com/go-sql-driver/mysql"
+	_ "github.com/mattn/go-sqlite3"
+
+	"github.com/kshvakov/clickhouse"
+	"github.com/lib/pq"
+)
+
+// SQLClient is a Client that talks to a SQL database.
+type SQLClient struct {
+	Dialect string
+	driver  *sqlx.DB
+}
+
+// NewSQLClient creates a SQL client based on its URL scheme.
+func NewSQLClient(ctx context.Context, originURL *url.URL) (Client, error) {
+	res, err := dburl.Parse(originURL.String())
+	if err != nil {
+		helpText := fmt.Sprintf("supported drivers: %+q, see documentation for more details: %s", sql.Drivers(), "https://godoc.org/github.com/xo/dburl")
+		return nil, fmt.Errorf("could not parse sql database url '%s': %s\n%s", originURL, err.Error(), helpText)
+	}
+
+	// Establishes the driver, but does not test the connection.
+	driver, err := sqlx.Open(res.Driver, res.DSN)
+	if err != nil {
+		return nil, fmt.Errorf("could not open sql driver %s: %s\n%s", res.Driver, err.Error(), res.DSN)
+	}
+
+	// Closes the driver, will occur when the context finishes.
+	go func() {
+		<-ctx.Done()
+		driver.Close()
+	}()
+
+	return &SQLClient{driver.DriverName(), driver}, nil
+}
+
+// Ping verifies a connection to the database is still alive.
+func (client *SQLClient) Ping(ctx context.Context) error {
+	return client.driver.PingContext(ctx)
+}
+
+// Submit queries or executes a command to the SQL database.
+func (client *SQLClient) Submit(ctx context.Context, cmd *Command) (interface{}, error) {
+	txx, err := cmd.ValidateSQL(client.Dialect)
+	if err != nil {
+		return nil, err
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, cmd.Timeout)
+	defer cancel()
+
+	var res interface{}
+
+	// Get the next available sql.Conn and submit the Command.
+	err = sqlConn(ctx, client.driver, txx, func(conn *sql.Conn) error {
+		stmt := cmd.Statement
+		args := cmd.Arguments.Positional
+
+		if cmd.Mode == "query" {
+			res, err = sqlQuery(ctx, conn, stmt, args)
+		} else {
+			res, err = sqlExec(ctx, conn, stmt, args)
+		}
+
+		return err
+	})
+
+	return res, err
+}
+
+// ValidateSQL extends the contract of Command for SQL dialects:
+// mode is conformed, arguments are []sql.NamedArg, and isolation is a sql.IsolationLevel.
+//
+// When the command should not be wrapped in a transaction, *sql.TxOptions and error will both be nil.
+func (cmd *Command) ValidateSQL(dialect string) (*sql.TxOptions, error) {
+	err := cmd.Validate()
+	if err != nil {
+		return nil, err
+	}
+
+	mode, err := sqlMode(cmd.Mode)
+	if err != nil {
+		return nil, err
+	}
+
+	// Mutates Arguments to only use positional arguments with the type sql.NamedArg.
+	// This is a required by the sql.Driver before submitting arguments.
+	cmd.Arguments.sql(dialect)
+
+	iso, err := sqlIsolation(cmd.Isolation)
+	if err != nil {
+		return nil, err
+	}
+
+	// When isolation is out-of-range, this is indicative that no
+	// transaction should be executed and sql.TxOptions should be nil.
+	if iso < sql.LevelDefault {
+		return nil, nil
+	}
+
+	// In query mode, execute the transaction in read-only, unless it's Microsoft SQL
+	// which does not support that type of transaction.
+	readOnly := mode == "query" && dialect != "mssql"
+
+	return &sql.TxOptions{Isolation: iso, ReadOnly: readOnly}, nil
+}
+
+// sqlConn gets the next available sql.Conn in the connection pool and runs a function to use it.
+//
+// If the transaction options are nil, run the useIt function outside a transaction.
+// This is potentially an unsafe operation if the command does not clean up its state.
+func sqlConn(ctx context.Context, driver *sqlx.DB, txx *sql.TxOptions, useIt func(*sql.Conn) error) error {
+	conn, err := driver.Conn(ctx)
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+
+	// If transaction options are specified, begin and defer a rollback to catch errors.
+	var tx *sql.Tx
+	if txx != nil {
+		tx, err = conn.BeginTx(ctx, txx)
+		if err != nil {
+			return err
+		}
+		defer tx.Rollback()
+	}
+
+	err = useIt(conn)
+
+	// Check if useIt was successful and a transaction exists before committing.
+	if err == nil && tx != nil {
+		err = tx.Commit()
+	}
+
+	return err
+}
+
+// sqlQuery queries rows on a sql.Conn and returns an array of result objects.
+func sqlQuery(ctx context.Context, conn *sql.Conn, stmt string, args []interface{}) ([]map[string]interface{}, error) {
+	rows, err := conn.QueryContext(ctx, stmt, args...)
+	if err == nil {
+		return sqlRows(rows)
+	}
+	return nil, err
+}
+
+// sqlExec executes a command on a sql.Conn and returns the result of the operation.
+func sqlExec(ctx context.Context, conn *sql.Conn, stmt string, args []interface{}) (sqlResult, error) {
+	exec, err := conn.ExecContext(ctx, stmt, args...)
+	if err == nil {
+		return sqlResultFrom(exec), nil
+	}
+	return sqlResult{}, err
+}
+
+// sql mutates Arguments to contain a positional []sql.NamedArg.
+//
+// The actual return type is []interface{} due to the native Golang
+// function signatures for sql.Exec and sql.Query being generic.
+func (args *Arguments) sql(dialect string) {
+	result := args.Positional
+
+	for i, val := range result {
+		result[i] = sqlArg("", val, dialect)
+	}
+
+	for key, val := range args.Named {
+		result = append(result, sqlArg(key, val, dialect))
+	}
+
+	args.Positional = result
+	args.Named = map[string]interface{}{}
+}
+
+// sqlArg creates a sql.NamedArg from a key-value pair and an optional dialect.
+//
+// Certain dialects will need to wrap objects, such as arrays, to conform its driver requirements.
+func sqlArg(key, val interface{}, dialect string) sql.NamedArg {
+	switch reflect.ValueOf(val).Kind() {
+
+	// PostgreSQL and Clickhouse require arrays to be wrapped before
+	// being inserted into the driver interface.
+	case reflect.Slice, reflect.Array:
+		switch dialect {
+		case "postgres":
+			val = pq.Array(val)
+		case "clickhouse":
+			val = clickhouse.Array(val)
+		}
+	}
+
+	return sql.Named(fmt.Sprint(key), val)
+}
+
+// sqlIsolation tries to match a string to a sql.IsolationLevel.
+func sqlIsolation(str string) (sql.IsolationLevel, error) {
+	if str == "none" {
+		return sql.IsolationLevel(-1), nil
+	}
+
+	for iso := sql.LevelDefault; ; iso++ {
+		if iso > sql.LevelLinearizable {
+			return -1, fmt.Errorf("cannot provide an invalid sql isolation level: '%s'", str)
+		}
+
+		if str == "" || strings.EqualFold(iso.String(), strings.ReplaceAll(str, "_", " ")) {
+			return iso, nil
+		}
+	}
+}
+
+// sqlMode tries to match a string to a command mode: 'query' or 'exec' for now.
+func sqlMode(str string) (string, error) {
+	switch str {
+	case "query", "exec":
+		return str, nil
+	default:
+		return "", fmt.Errorf("cannot provide invalid sql mode: '%s'", str)
+	}
+}
+
+// sqlRows scans through a SQL result set and returns an array of objects.
+func sqlRows(rows *sql.Rows) ([]map[string]interface{}, error) {
+	columns, err := rows.Columns()
+	if err != nil {
+		return nil, errors.Wrap(err, "could not extract columns from result")
+	}
+	defer rows.Close()
+
+	types, err := rows.ColumnTypes()
+	if err != nil {
+		// Some drivers do not support type extraction, so fail silently and continue.
+		types = make([]*sql.ColumnType, len(columns))
+	}
+
+	values := make([]interface{}, len(columns))
+	pointers := make([]interface{}, len(columns))
+
+	var results []map[string]interface{}
+	for rows.Next() {
+		for i := range columns {
+			pointers[i] = &values[i]
+		}
+		rows.Scan(pointers...)
+
+		// Convert a row, an array of values, into an object where
+		// each key is the name of its respective column.
+		entry := make(map[string]interface{})
+		for i, col := range columns {
+			entry[col] = sqlValue(values[i], types[i])
+		}
+		results = append(results, entry)
+	}
+
+	return results, nil
+}
+
+// sqlValue handles special cases where sql.Rows does not return a "human-readable" object.
+func sqlValue(val interface{}, col *sql.ColumnType) interface{} {
+	bytes, ok := val.([]byte)
+	if ok {
+		// Opportunistically check for embeded JSON and convert it to a first-class object.
+		var embeded interface{}
+		if json.Unmarshal(bytes, &embeded) == nil {
+			return embeded
+		}
+
+		// STOR-604: investigate a way to coerce PostgreSQL arrays '{a, b, ...}' into JSON.
+		// Although easy with strings, it becomes more difficult with special types like INET[].
+
+		return string(bytes)
+	}
+
+	return val
+}
+
+// sqlResult is a thin wrapper around sql.Result.
+type sqlResult struct {
+	LastInsertId int64 `json:"last_insert_id"`
+	RowsAffected int64 `json:"rows_affected"`
+}
+
+// sqlResultFrom converts sql.Result into a JSON-marshable sqlResult.
+func sqlResultFrom(res sql.Result) sqlResult {
+	insertID, errID := res.LastInsertId()
+	rowsAffected, errRows := res.RowsAffected()
+
+	// If an error occurs when extracting the result, it is because the
+	// driver does not support that specific field. Instead of passing this
+	// to the user, omit the field in the response.
+	if errID != nil {
+		insertID = -1
+	}
+	if errRows != nil {
+		rowsAffected = -1
+	}
+
+	return sqlResult{insertID, rowsAffected}
+}
@@ -0,0 +1,336 @@
+package dbconnect
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kshvakov/clickhouse"
+	"github.com/lib/pq"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewSQLClient(t *testing.T) {
+	originURLs := []string{
+		"postgres://localhost",
+		"cockroachdb://localhost:1337",
+		"postgresql://user:pass@127.0.0.1",
+		"mysql://localhost",
+		"clickhouse://127.0.0.1:9000/?debug",
+		"sqlite3::memory:",
+		"file:test.db?cache=shared",
+	}
+
+	for _, originURL := range originURLs {
+		origin, _ := url.Parse(originURL)
+		_, err := NewSQLClient(context.Background(), origin)
+
+		assert.NoError(t, err, originURL)
+	}
+
+	originURLs = []string{
+		"",
+		"/",
+		"http://localhost",
+		"coolthing://user:pass@127.0.0.1",
+	}
+
+	for _, originURL := range originURLs {
+		origin, _ := url.Parse(originURL)
+		_, err := NewSQLClient(context.Background(), origin)
+
+		assert.Error(t, err, originURL)
+	}
+}
+
+func TestArgumentsSQL(t *testing.T) {
+	args := []Arguments{
+		Arguments{
+			Positional: []interface{}{
+				"val", 10, 3.14,
+			},
+		},
+		Arguments{
+			Named: map[string]interface{}{
+				"key": time.Unix(0, 0),
+			},
+		},
+	}
+
+	var nameType sql.NamedArg
+	for _, arg := range args {
+		arg.sql("")
+		for _, named := range arg.Positional {
+			assert.IsType(t, nameType, named)
+		}
+	}
+}
+
+func TestSQLArg(t *testing.T) {
+	tests := []struct {
+		key     interface{}
+		val     interface{}
+		dialect string
+		arg     sql.NamedArg
+	}{
+		{"key", "val", "mssql", sql.Named("key", "val")},
+		{0, 1, "sqlite3", sql.Named("0", 1)},
+		{1, []string{"a", "b", "c"}, "postgres", sql.Named("1", pq.Array([]string{"a", "b", "c"}))},
+		{"in", []uint{0, 1}, "clickhouse", sql.Named("in", clickhouse.Array([]uint{0, 1}))},
+		{"", time.Unix(0, 0), "", sql.Named("", time.Unix(0, 0))},
+	}
+
+	for _, test := range tests {
+		arg := sqlArg(test.key, test.val, test.dialect)
+		assert.Equal(t, test.arg, arg, test.key)
+	}
+}
+
+func TestSQLIsolation(t *testing.T) {
+	tests := []struct {
+		str string
+		iso sql.IsolationLevel
+	}{
+		{"", sql.LevelDefault},
+		{"DEFAULT", sql.LevelDefault},
+		{"read_UNcommitted", sql.LevelReadUncommitted},
+		{"serializable", sql.LevelSerializable},
+		{"none", sql.IsolationLevel(-1)},
+		{"SNAP shot", -2},
+		{"blah", -2},
+	}
+
+	for _, test := range tests {
+		iso, err := sqlIsolation(test.str)
+
+		if test.iso < -1 {
+			assert.Error(t, err, test.str)
+		} else {
+			assert.NoError(t, err)
+			assert.Equal(t, test.iso, iso, test.str)
+		}
+	}
+}
+
+func TestSQLMode(t *testing.T) {
+	modes := []string{
+		"query",
+		"exec",
+	}
+
+	for _, mode := range modes {
+		actual, err := sqlMode(mode)
+
+		assert.NoError(t, err)
+		assert.Equal(t, strings.ToLower(mode), actual, mode)
+	}
+
+	modes = []string{
+		"",
+		"blah",
+	}
+
+	for _, mode := range modes {
+		_, err := sqlMode(mode)
+
+		assert.Error(t, err)
+	}
+}
+
+func helperRows(mockRows *sqlmock.Rows) *sql.Rows {
+	db, mock, _ := sqlmock.New()
+	mock.ExpectQuery("SELECT").WillReturnRows(mockRows)
+	rows, _ := db.Query("SELECT")
+	return rows
+}
+
+func TestSQLRows(t *testing.T) {
+	actual, err := sqlRows(helperRows(sqlmock.NewRows(
+		[]string{"name", "age", "dept"}).
+		AddRow("alice", 19, "prod")))
+	expected := []map[string]interface{}{map[string]interface{}{
+		"name": "alice",
+		"age":  int64(19),
+		"dept": "prod"}}
+
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expected, actual)
+}
+
+func TestSQLValue(t *testing.T) {
+	tests := []struct {
+		input  interface{}
+		output interface{}
+	}{
+		{"hello", "hello"},
+		{1, 1},
+		{false, false},
+		{[]byte("random"), "random"},
+		{[]byte("{\"json\":true}"), map[string]interface{}{"json": true}},
+		{[]byte("[]"), []interface{}{}},
+	}
+
+	for _, test := range tests {
+		assert.Equal(t, test.output, sqlValue(test.input, nil), test.input)
+	}
+}
+
+func TestSQLResultFrom(t *testing.T) {
+	res := sqlResultFrom(sqlmock.NewResult(1, 2))
+	assert.Equal(t, sqlResult{1, 2}, res)
+
+	res = sqlResultFrom(sqlmock.NewErrorResult(fmt.Errorf("")))
+	assert.Equal(t, sqlResult{-1, -1}, res)
+}
+
+func helperSQLite3(t *testing.T) (context.Context, Client) {
+	t.Helper()
+
+	ctx := context.Background()
+	url, _ := url.Parse("file::memory:?cache=shared")
+
+	sqlite3, err := NewSQLClient(ctx, url)
+	assert.NoError(t, err)
+
+	return ctx, sqlite3
+}
+
+func TestPing(t *testing.T) {
+	ctx, sqlite3 := helperSQLite3(t)
+	err := sqlite3.Ping(ctx)
+
+	assert.NoError(t, err)
+}
+
+func TestSubmit(t *testing.T) {
+	ctx, sqlite3 := helperSQLite3(t)
+
+	res, err := sqlite3.Submit(ctx, &Command{
+		Statement: "CREATE TABLE t (a INTEGER, b FLOAT, c TEXT, d BLOB);",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, sqlResult{0, 0}, res)
+
+	res, err = sqlite3.Submit(ctx, &Command{
+		Statement: "SELECT * FROM t;",
+		Mode:      "query",
+	})
+	assert.NoError(t, err)
+	assert.Empty(t, res)
+
+	res, err = sqlite3.Submit(ctx, &Command{
+		Statement: "INSERT INTO t VALUES (?, ?, ?, ?);",
+		Mode:      "exec",
+		Arguments: Arguments{
+			Positional: []interface{}{
+				1,
+				3.14,
+				"text",
+				"blob",
+			},
+		},
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, sqlResult{1, 1}, res)
+
+	res, err = sqlite3.Submit(ctx, &Command{
+		Statement: "UPDATE t SET c = NULL;",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, sqlResult{1, 1}, res)
+
+	res, err = sqlite3.Submit(ctx, &Command{
+		Statement: "SELECT * FROM t WHERE a = ?;",
+		Mode:      "query",
+		Arguments: Arguments{
+			Positional: []interface{}{1},
+		},
+	})
+	assert.NoError(t, err)
+	assert.Len(t, res, 1)
+
+	resf, ok := res.([]map[string]interface{})
+	assert.True(t, ok)
+	assert.EqualValues(t, map[string]interface{}{
+		"a": int64(1),
+		"b": 3.14,
+		"c": nil,
+		"d": "blob",
+	}, resf[0])
+
+	res, err = sqlite3.Submit(ctx, &Command{
+		Statement: "DROP TABLE t;",
+		Mode:      "exec",
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, sqlResult{1, 1}, res)
+}
+
+func TestSubmitTransaction(t *testing.T) {
+	ctx, sqlite3 := helperSQLite3(t)
+
+	res, err := sqlite3.Submit(ctx, &Command{
+		Statement: "BEGIN;",
+		Mode:      "exec",
+	})
+	assert.Error(t, err)
+	assert.Empty(t, res)
+
+	res, err = sqlite3.Submit(ctx, &Command{
+		Statement: "BEGIN; CREATE TABLE tt (a INT); COMMIT;",
+		Mode:      "exec",
+		Isolation: "none",
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, sqlResult{0, 0}, res)
+
+	rows, err := sqlite3.Submit(ctx, &Command{
+		Statement: "SELECT * FROM tt;",
+		Mode:      "query",
+		Isolation: "repeatable_read",
+	})
+	assert.NoError(t, err)
+	assert.Empty(t, rows)
+}
+
+func TestSubmitTimeout(t *testing.T) {
+	ctx, sqlite3 := helperSQLite3(t)
+
+	res, err := sqlite3.Submit(ctx, &Command{
+		Statement: "SELECT * FROM t;",
+		Mode:      "query",
+		Timeout:   1 * time.Nanosecond,
+	})
+	assert.Error(t, err)
+	assert.Empty(t, res)
+}
+
+func TestSubmitMode(t *testing.T) {
+	ctx, sqlite3 := helperSQLite3(t)
+
+	res, err := sqlite3.Submit(ctx, &Command{
+		Statement: "SELECT * FROM t;",
+		Mode:      "notanoption",
+	})
+	assert.Error(t, err)
+	assert.Empty(t, res)
+}
+
+func TestSubmitEmpty(t *testing.T) {
+	ctx, sqlite3 := helperSQLite3(t)
+
+	res, err := sqlite3.Submit(ctx, &Command{
+		Statement: "; ; ; ;",
+		Mode:      "query",
+	})
+	assert.Error(t, err)
+	assert.Empty(t, res)
+}
@@ -0,0 +1,4 @@
+FROM golang:1.12 as builder
+WORKDIR /go/src/github.com/cloudflare/cloudflared/
+RUN apt-get update
+COPY . .
@@ -18,9 +18,9 @@ import (

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	cfpath "github.com/cloudflare/cloudflared/cmd/cloudflared/path"
-	"github.com/coreos/go-oidc/jose"
 	homedir "github.com/mitchellh/go-homedir"
 	gossh "golang.org/x/crypto/ssh"
+	"gopkg.in/coreos/go-oidc.v1/jose"
 )

 const (
@@ -16,8 +16,8 @@ import (

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	cfpath "github.com/cloudflare/cloudflared/cmd/cloudflared/path"
-	"github.com/coreos/go-oidc/jose"
 	"github.com/stretchr/testify/assert"
+	"gopkg.in/coreos/go-oidc.v1/jose"
 )

 const (
@@ -45,16 +45,13 @@ func H2RequestHeadersToH1Request(h2 []h2mux.Header, h1 *http.Request) error {
 			// Otherwise the host header will be based on the origin URL
 			h1.Host = header.Value
 		case ":path":
-			u, err := url.Parse(header.Value)
-			if err != nil {
-				return fmt.Errorf("unparseable path")
+			// Separate the path and the (optional) query from each other
+			chunks := strings.SplitN(header.Value, "?", 2)
+
+			h1.URL.Path = chunks[0]
+			if len(chunks) > 1 {
+				h1.URL.RawQuery = chunks[1]
 			}
-			resolved := h1.URL.ResolveReference(u)
-			// prevent escaping base URL
-			if !strings.HasPrefix(resolved.String(), h1.URL.String()) {
-				return fmt.Errorf("invalid path")
-			}
-			h1.URL = resolved
 		case "content-length":
 			contentLength, err := strconv.ParseInt(header.Value, 10, 64)
 			if err != nil {
@@ -0,0 +1,104 @@
+package streamhandler
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/cloudflare/cloudflared/h2mux"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestH2RequestHeadersToH1Request_RegularHeaders(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	assert.NoError(t, err)
+
+	headersConversionErr := H2RequestHeadersToH1Request(
+		[]h2mux.Header{
+			h2mux.Header{
+				Name:  "Mock header 1",
+				Value: "Mock value 1",
+			},
+			h2mux.Header{
+				Name:  "Mock header 2",
+				Value: "Mock value 2",
+			},
+		},
+		request,
+	)
+
+	assert.Equal(t, http.Header{
+		"Mock header 1": []string{"Mock value 1"},
+		"Mock header 2": []string{"Mock value 2"},
+	}, request.Header)
+
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_NoHeaders(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	assert.NoError(t, err)
+
+	headersConversionErr := H2RequestHeadersToH1Request(
+		[]h2mux.Header{},
+		request,
+	)
+
+	assert.Equal(t, http.Header{}, request.Header)
+
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_InvalidHostPath(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	assert.NoError(t, err)
+
+	headersConversionErr := H2RequestHeadersToH1Request(
+		[]h2mux.Header{
+			h2mux.Header{
+				Name:  ":path",
+				Value: "//bad_path/",
+			},
+			h2mux.Header{
+				Name:  "Mock header",
+				Value: "Mock value",
+			},
+		},
+		request,
+	)
+
+	assert.Equal(t, http.Header{
+		"Mock header": []string{"Mock value"},
+	}, request.Header)
+
+	assert.Equal(t, "http://example.com//bad_path/", request.URL.String())
+
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_HostPathWithQuery(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
+	assert.NoError(t, err)
+
+	headersConversionErr := H2RequestHeadersToH1Request(
+		[]h2mux.Header{
+			h2mux.Header{
+				Name:  ":path",
+				Value: "/?query",
+			},
+			h2mux.Header{
+				Name:  "Mock header",
+				Value: "Mock value",
+			},
+		},
+		request,
+	)
+
+	assert.Equal(t, http.Header{
+		"Mock header": []string{"Mock value"},
+	}, request.Header)
+
+	assert.Equal(t, "http://example.com/?query", request.URL.String())
+
+	assert.NoError(t, headersConversionErr)
+}
@@ -86,7 +86,7 @@ func (s *StreamHandler) UpdateConfig(newConfig []*pogs.ReverseProxyConfig) (fail
 	s.tunnelHostnameMapper.DeleteAll()
 	for _, tunnelConfig := range newConfig {
 		tunnelHostname := tunnelConfig.TunnelHostname
-		originSerice, err := tunnelConfig.Origin.Service()
+		originSerice, err := tunnelConfig.OriginConfigJSONHandler.OriginConfig.Service()
 		if err != nil {
 			s.logger.WithField("tunnelHostname", tunnelHostname).WithError(err).Error("Invalid origin service config")
 			failedConfigs = append(failedConfigs, &pogs.FailedConfig{
@@ -49,8 +49,10 @@ func TestServeRequest(t *testing.T) {
 	reverseProxyConfigs := []*pogs.ReverseProxyConfig{
 		{
 			TunnelHostname: testTunnelHostname,
-			Origin: &pogs.HTTPOriginConfig{
-				URLString: httpServer.URL,
+			OriginConfigJSONHandler: &pogs.OriginConfigJSONHandler{
+				OriginConfig: &pogs.HTTPOriginConfig{
+					URLString: httpServer.URL,
+				},
 			},
 		},
 	}
@@ -97,8 +99,10 @@ func TestServeBadRequest(t *testing.T) {
 	reverseProxyConfigs := []*pogs.ReverseProxyConfig{
 		{
 			TunnelHostname: testTunnelHostname,
-			Origin: &pogs.HTTPOriginConfig{
-				URLString: "",
+			OriginConfigJSONHandler: &pogs.OriginConfigJSONHandler{
+				OriginConfig: &pogs.HTTPOriginConfig{
+					URLString: "",
+				},
 			},
 		},
 	}
@@ -57,8 +57,8 @@ func NewSupervisor(
 		tunnelHostnames[i] = reverseProxyConfig.TunnelHostname
 	}
 	defaultEdgeMgrConfigurable := &connection.EdgeManagerConfigurable{
-		tunnelHostnames,
-		defaultClientConfig.EdgeConnectionConfig,
+		TunnelHostnames:      tunnelHostnames,
+		EdgeConnectionConfig: defaultClientConfig.EdgeConnectionConfig,
 	}
 	return &Supervisor{
 		connManager: connection.NewEdgeManager(streamHandler, defaultEdgeMgrConfigurable, userCredential, tlsConfig,
@@ -139,8 +139,8 @@ func (s *Supervisor) notifySubsystemsNewConfig(newConfig *pogs.ClientConfig) *po
 	}
 	// Update connManager configurable
 	s.connManager.UpdateConfigurable(&connection.EdgeManagerConfigurable{
-		tunnelHostnames,
-		newConfig.EdgeConnectionConfig,
+		TunnelHostnames:      tunnelHostnames,
+		EdgeConnectionConfig: newConfig.EdgeConnectionConfig,
 	})
 	// Update streamHandler tunnelHostnameMapper mapping
 	failedConfigs := s.streamHandler.UpdateConfig(newConfig.ReverseProxyConfigs)
@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/json"
 	"fmt"
 	"net"
 	"net/http"
@@ -14,6 +15,7 @@ import (
 	"github.com/cloudflare/cloudflared/originservice"
 	"github.com/cloudflare/cloudflared/tlsconfig"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
+
 	"github.com/pkg/errors"
 	capnp "zombiezen.com/go/capnproto2"
 	"zombiezen.com/go/capnproto2/pogs"
@@ -27,11 +29,11 @@ import (

 // ClientConfig is a collection of FallibleConfig that determines how cloudflared should function
 type ClientConfig struct {
-	Version              Version
-	SupervisorConfig     *SupervisorConfig
-	EdgeConnectionConfig *EdgeConnectionConfig
-	DoHProxyConfigs      []*DoHProxyConfig
-	ReverseProxyConfigs  []*ReverseProxyConfig
+	Version              Version               `json:"version"`
+	SupervisorConfig     *SupervisorConfig     `json:"supervisor_config"`
+	EdgeConnectionConfig *EdgeConnectionConfig `json:"edge_connection_config"`
+	DoHProxyConfigs      []*DoHProxyConfig     `json:"doh_proxy_configs"`
+	ReverseProxyConfigs  []*ReverseProxyConfig `json:"reverse_proxy_configs"`
 }

 // Version type models the version of a ClientConfig
@@ -52,13 +54,14 @@ func (v Version) String() string {
 // FallibleConfig is an interface implemented by configs that cloudflared might not be able to apply
 type FallibleConfig interface {
 	FailReason(err error) string
+	jsonType() string
 }

 // SupervisorConfig specifies config of components managed by Supervisor other than ConnectionManager
 type SupervisorConfig struct {
-	AutoUpdateFrequency    time.Duration
-	MetricsUpdateFrequency time.Duration
-	GracePeriod            time.Duration
+	AutoUpdateFrequency    time.Duration `json:"auto_update_frequency"`
+	MetricsUpdateFrequency time.Duration `json:"metrics_update_frequency"`
+	GracePeriod            time.Duration `json:"grace_period"`
 }

 // FailReason impelents FallibleConfig interface for SupervisorConfig
@@ -66,13 +69,23 @@ func (sc *SupervisorConfig) FailReason(err error) string {
 	return fmt.Sprintf("Cannot apply SupervisorConfig, err: %v", err)
 }

+func (sc *SupervisorConfig) MarshalJSON() ([]byte, error) {
+	marshaler := make(map[string]SupervisorConfig, 1)
+	marshaler[sc.jsonType()] = *sc
+	return json.Marshal(marshaler)
+}
+
+func (sc *SupervisorConfig) jsonType() string {
+	return "supervisor_config"
+}
+
 // EdgeConnectionConfig specifies what parameters and how may connections should ConnectionManager establish with edge
 type EdgeConnectionConfig struct {
-	NumHAConnections    uint8
-	HeartbeatInterval   time.Duration
-	Timeout             time.Duration
-	MaxFailedHeartbeats uint64
-	UserCredentialPath  string
+	NumHAConnections    uint8         `json:"num_ha_connections"`
+	HeartbeatInterval   time.Duration `json:"heartbeat_interval"`
+	Timeout             time.Duration `json:"timeout"`
+	MaxFailedHeartbeats uint64        `json:"max_failed_heartbeats"`
+	UserCredentialPath  string        `json:"user_credential_path"`
 }

 // FailReason impelents FallibleConfig interface for EdgeConnectionConfig
@@ -80,11 +93,21 @@ func (cmc *EdgeConnectionConfig) FailReason(err error) string {
 	return fmt.Sprintf("Cannot apply EdgeConnectionConfig, err: %v", err)
 }

+func (cmc *EdgeConnectionConfig) MarshalJSON() ([]byte, error) {
+	marshaler := make(map[string]EdgeConnectionConfig, 1)
+	marshaler[cmc.jsonType()] = *cmc
+	return json.Marshal(marshaler)
+}
+
+func (cmc *EdgeConnectionConfig) jsonType() string {
+	return "edge_connection_config"
+}
+
 // DoHProxyConfig is configuration for DNS over HTTPS service
 type DoHProxyConfig struct {
-	ListenHost string
-	ListenPort uint16
-	Upstreams  []string
+	ListenHost string   `json:"listen_host"`
+	ListenPort uint16   `json:"listen_port"`
+	Upstreams  []string `json:"upstreams"`
 }

 // FailReason impelents FallibleConfig interface for DoHProxyConfig
@@ -92,13 +115,23 @@ func (dpc *DoHProxyConfig) FailReason(err error) string {
 	return fmt.Sprintf("Cannot apply DoHProxyConfig, err: %v", err)
 }

+func (dpc *DoHProxyConfig) MarshalJSON() ([]byte, error) {
+	marshaler := make(map[string]DoHProxyConfig, 1)
+	marshaler[dpc.jsonType()] = *dpc
+	return json.Marshal(marshaler)
+}
+
+func (dpc *DoHProxyConfig) jsonType() string {
+	return "doh_proxy_config"
+}
+
 // ReverseProxyConfig how and for what hostnames can this cloudflared proxy
 type ReverseProxyConfig struct {
-	TunnelHostname     h2mux.TunnelHostname
-	Origin             OriginConfig
-	Retries            uint64
-	ConnectionTimeout  time.Duration
-	CompressionQuality uint64
+	TunnelHostname          h2mux.TunnelHostname     `json:"tunnel_hostname"`
+	OriginConfigJSONHandler *OriginConfigJSONHandler `json:"origin_config"`
+	Retries                 uint64                   `json:"retries"`
+	ConnectionTimeout       time.Duration            `json:"connection_timeout"`
+	CompressionQuality      uint64                   `json:"compression_quality"`
 }

 func NewReverseProxyConfig(
@@ -109,14 +142,14 @@ func NewReverseProxyConfig(
 	compressionQuality uint64,
 ) (*ReverseProxyConfig, error) {
 	if originConfig == nil {
-		return nil, fmt.Errorf("NewReverseProxyConfig: originConfig was null")
+		return nil, fmt.Errorf("NewReverseProxyConfig: originConfigUnmarshaler was null")
 	}
 	return &ReverseProxyConfig{
-		TunnelHostname:     h2mux.TunnelHostname(tunnelHostname),
-		Origin:             originConfig,
-		Retries:            retries,
-		ConnectionTimeout:  connectionTimeout,
-		CompressionQuality: compressionQuality,
+		TunnelHostname:          h2mux.TunnelHostname(tunnelHostname),
+		OriginConfigJSONHandler: &OriginConfigJSONHandler{originConfig},
+		Retries:                 retries,
+		ConnectionTimeout:       connectionTimeout,
+		CompressionQuality:      compressionQuality,
 	}, nil
 }

@@ -125,27 +158,58 @@ func (rpc *ReverseProxyConfig) FailReason(err error) string {
 	return fmt.Sprintf("Cannot apply ReverseProxyConfig, err: %v", err)
 }

+func (rpc *ReverseProxyConfig) MarshalJSON() ([]byte, error) {
+	marshaler := make(map[string]ReverseProxyConfig, 1)
+	marshaler[rpc.jsonType()] = *rpc
+	return json.Marshal(marshaler)
+}
+
+func (rpc *ReverseProxyConfig) jsonType() string {
+	return "reverse_proxy_config"
+}
+
 //go-sumtype:decl OriginConfig
 type OriginConfig interface {
 	// Service returns a OriginService used to proxy to the origin
 	Service() (originservice.OriginService, error)
 	// go-sumtype requires at least one unexported method, otherwise it will complain that interface is not sealed
-	isOriginConfig()
+	jsonType() string
+}
+
+type originType int
+
+const (
+	httpType originType = iota
+	wsType
+	helloWorldType
+)
+
+func (ot originType) String() string {
+	switch ot {
+	case httpType:
+		return "Http"
+	case wsType:
+		return "WebSocket"
+	case helloWorldType:
+		return "HelloWorld"
+	default:
+		return "unknown"
+	}
 }

 type HTTPOriginConfig struct {
-	URLString              string        `capnp:"urlString"`
-	TCPKeepAlive           time.Duration `capnp:"tcpKeepAlive"`
-	DialDualStack          bool
-	TLSHandshakeTimeout    time.Duration `capnp:"tlsHandshakeTimeout"`
-	TLSVerify              bool          `capnp:"tlsVerify"`
-	OriginCAPool           string
-	OriginServerName       string
-	MaxIdleConnections     uint64
-	IdleConnectionTimeout  time.Duration
-	ProxyConnectionTimeout time.Duration
-	ExpectContinueTimeout  time.Duration
-	ChunkedEncoding        bool
+	URLString              string        `capnp:"urlString" json:"url_string" mapstructure:"url_string"`
+	TCPKeepAlive           time.Duration `capnp:"tcpKeepAlive" json:"tcp_keep_alive" mapstructure:"tcp_keep_alive"`
+	DialDualStack          bool          `json:"dial_dual_stack" mapstructure:"dial_dual_stack"`
+	TLSHandshakeTimeout    time.Duration `capnp:"tlsHandshakeTimeout" json:"tls_handshake_timeout" mapstructure:"tls_handshake_timeout"`
+	TLSVerify              bool          `capnp:"tlsVerify" json:"tls_verify" mapstructure:"tls_verify"`
+	OriginCAPool           string        `json:"origin_ca_pool" mapstructure:"origin_ca_pool"`
+	OriginServerName       string        `json:"origin_server_name" mapstructure:"origin_server_name"`
+	MaxIdleConnections     uint64        `json:"max_idle_connections" mapstructure:"max_idle_connections"`
+	IdleConnectionTimeout  time.Duration `json:"idle_connection_timeout" mapstructure:"idle_connection_timeout"`
+	ProxyConnectionTimeout time.Duration `json:"proxy_connection_timeout" mapstructure:"proxy_connection_timeout"`
+	ExpectContinueTimeout  time.Duration `json:"expect_continue_timeout" mapstructure:"expect_continue_timeout"`
+	ChunkedEncoding        bool          `json:"chunked_encoding" mapstructure:"chunked_encoding"`
 }

 func (hc *HTTPOriginConfig) Service() (originservice.OriginService, error) {
@@ -184,13 +248,15 @@ func (hc *HTTPOriginConfig) Service() (originservice.OriginService, error) {
 	return originservice.NewHTTPService(transport, url, hc.ChunkedEncoding), nil
 }

-func (_ *HTTPOriginConfig) isOriginConfig() {}
+func (_ *HTTPOriginConfig) jsonType() string {
+	return httpType.String()
+}

 type WebSocketOriginConfig struct {
-	URLString        string `capnp:"urlString"`
-	TLSVerify        bool   `capnp:"tlsVerify"`
-	OriginCAPool     string
-	OriginServerName string
+	URLString        string `capnp:"urlString" json:"url_string" mapstructure:"url_string"`
+	TLSVerify        bool   `capnp:"tlsVerify" json:"tls_verify" mapstructure:"tls_verify"`
+	OriginCAPool     string `json:"origin_ca_pool" mapstructure:"origin_ca_pool"`
+	OriginServerName string `json:"origin_server_name" mapstructure:"origin_server_name"`
 }

 func (wsc *WebSocketOriginConfig) Service() (originservice.OriginService, error) {
@@ -211,7 +277,9 @@ func (wsc *WebSocketOriginConfig) Service() (originservice.OriginService, error)
 	return originservice.NewWebSocketService(tlsConfig, url)
 }

-func (_ *WebSocketOriginConfig) isOriginConfig() {}
+func (_ *WebSocketOriginConfig) jsonType() string {
+	return wsType.String()
+}

 type HelloWorldOriginConfig struct{}

@@ -240,7 +308,9 @@ func (_ *HelloWorldOriginConfig) Service() (originservice.OriginService, error)
 	return originservice.NewHelloWorldService(transport)
 }

-func (_ *HelloWorldOriginConfig) isOriginConfig() {}
+func (_ *HelloWorldOriginConfig) jsonType() string {
+	return helloWorldType.String()
+}

 /*
 * Boilerplate to convert between these structs and the primitive structs
@@ -449,7 +519,7 @@ func UnmarshalDoHProxyConfig(s tunnelrpc.DoHProxyConfig) (*DoHProxyConfig, error

 func MarshalReverseProxyConfig(s tunnelrpc.ReverseProxyConfig, p *ReverseProxyConfig) error {
 	s.SetTunnelHostname(p.TunnelHostname.String())
-	switch config := p.Origin.(type) {
+	switch config := p.OriginConfigJSONHandler.OriginConfig.(type) {
 	case *HTTPOriginConfig:
 		ss, err := s.Origin().NewHttp()
 		if err != nil {
@@ -500,7 +570,7 @@ func UnmarshalReverseProxyConfig(s tunnelrpc.ReverseProxyConfig) (*ReverseProxyC
 		if err != nil {
 			return nil, err
 		}
-		p.Origin = config
+		p.OriginConfigJSONHandler = &OriginConfigJSONHandler{config}
 	case tunnelrpc.ReverseProxyConfig_origin_Which_websocket:
 		ss, err := s.Origin().Websocket()
 		if err != nil {
@@ -510,7 +580,7 @@ func UnmarshalReverseProxyConfig(s tunnelrpc.ReverseProxyConfig) (*ReverseProxyC
 		if err != nil {
 			return nil, err
 		}
-		p.Origin = config
+		p.OriginConfigJSONHandler = &OriginConfigJSONHandler{config}
 	case tunnelrpc.ReverseProxyConfig_origin_Which_helloWorld:
 		ss, err := s.Origin().HelloWorld()
 		if err != nil {
@@ -520,7 +590,7 @@ func UnmarshalReverseProxyConfig(s tunnelrpc.ReverseProxyConfig) (*ReverseProxyC
 		if err != nil {
 			return nil, err
 		}
-		p.Origin = config
+		p.OriginConfigJSONHandler = &OriginConfigJSONHandler{config}
 	}
 	p.Retries = s.Retries()
 	p.ConnectionTimeout = time.Duration(s.ConnectionTimeout())
@@ -620,13 +690,13 @@ func (i ClientService_PogsImpl) UseConfiguration(p tunnelrpc.ClientService_useCo
 }

 type UseConfigurationResult struct {
-	Success       bool
-	FailedConfigs []*FailedConfig
+	Success       bool            `json:"success"`
+	FailedConfigs []*FailedConfig `json:"failed_configs"`
 }

 type FailedConfig struct {
-	Config FallibleConfig
-	Reason string
+	Config FallibleConfig `json:"config"`
+	Reason string         `json:"reason"`
 }

 func MarshalFailedConfig(s tunnelrpc.FailedConfig, p *FailedConfig) error {
@@ -641,7 +711,7 @@ func MarshalFailedConfig(s tunnelrpc.FailedConfig, p *FailedConfig) error {
 			return err
 		}
 	case *EdgeConnectionConfig:
-		ss, err := s.Config().EdgeConnection()
+		ss, err := s.Config().NewEdgeConnection()
 		if err != nil {
 			return err
 		}
@@ -12,6 +12,15 @@ import (
 	capnp "zombiezen.com/go/capnproto2"
 )

+// Assert *HTTPOriginConfig implements OriginConfig
+var _ OriginConfig = (*HTTPOriginConfig)(nil)
+
+// Assert *WebSocketOriginConfig implements OriginConfig
+var _ OriginConfig = (*WebSocketOriginConfig)(nil)
+
+// Assert *HelloWorldOriginConfig implements OriginConfig
+var _ OriginConfig = (*HelloWorldOriginConfig)(nil)
+
 func TestVersion(t *testing.T) {
 	firstVersion := InitVersion()
 	secondVersion := Version(1)
@@ -32,13 +41,13 @@ func TestClientConfig(t *testing.T) {
 			sampleReverseProxyConfig(func(c *ReverseProxyConfig) {
 			}),
 			sampleReverseProxyConfig(func(c *ReverseProxyConfig) {
-				c.Origin = sampleHTTPOriginConfig()
+				c.OriginConfigJSONHandler = &OriginConfigJSONHandler{sampleHTTPOriginConfig()}
 			}),
 			sampleReverseProxyConfig(func(c *ReverseProxyConfig) {
-				c.Origin = sampleHTTPOriginUnixPathConfig()
+				c.OriginConfigJSONHandler = &OriginConfigJSONHandler{sampleHTTPOriginConfigUnixPath()}
 			}),
 			sampleReverseProxyConfig(func(c *ReverseProxyConfig) {
-				c.Origin = sampleWebSocketOriginConfig()
+				c.OriginConfigJSONHandler = &OriginConfigJSONHandler{sampleWebSocketOriginConfig()}
 			}),
 		}
 	}
@@ -133,13 +142,13 @@ func TestReverseProxyConfig(t *testing.T) {
 	testCases := []*ReverseProxyConfig{
 		sampleReverseProxyConfig(),
 		sampleReverseProxyConfig(func(c *ReverseProxyConfig) {
-			c.Origin = sampleHTTPOriginConfig()
+			c.OriginConfigJSONHandler = &OriginConfigJSONHandler{sampleHTTPOriginConfig()}
 		}),
 		sampleReverseProxyConfig(func(c *ReverseProxyConfig) {
-			c.Origin = sampleHTTPOriginUnixPathConfig()
+			c.OriginConfigJSONHandler = &OriginConfigJSONHandler{sampleHTTPOriginConfigUnixPath()}
 		}),
 		sampleReverseProxyConfig(func(c *ReverseProxyConfig) {
-			c.Origin = sampleWebSocketOriginConfig()
+			c.OriginConfigJSONHandler = &OriginConfigJSONHandler{sampleWebSocketOriginConfig()}
 		}),
 	}
 	for i, testCase := range testCases {
@@ -224,21 +233,22 @@ func TestOriginConfigInvalidURL(t *testing.T) {

 //////////////////////////////////////////////////////////////////////////////
 // Functions to generate sample data for ease of testing
+//
+// There's one "sample" function per struct type. Each goes like this:
+//   1. Initialize an instance of the relevant struct.
+//   2. Ensure the instance has no zero-valued fields. (This catches the
+//      error-case where a field was added, but we forgot to add code to
+//      marshal/unmarshal this field in CapnProto.)
+//   3. Apply one or more "override" functions (which accept a
+//      pointer-to-struct, so they can mutate the instance).

+// sampleClientConfig initializes a new ClientConfig literal,
+// applies any number of overrides to it, and returns it.
 func sampleClientConfig(overrides ...func(*ClientConfig)) *ClientConfig {
 	sample := &ClientConfig{
-		Version: Version(1337),
-		SupervisorConfig: &SupervisorConfig{
-			AutoUpdateFrequency:    21 * time.Hour,
-			MetricsUpdateFrequency: 11 * time.Minute,
-			GracePeriod:            31 * time.Second,
-		},
-		EdgeConnectionConfig: &EdgeConnectionConfig{
-			NumHAConnections:    49,
-			Timeout:             9 * time.Second,
-			HeartbeatInterval:   5 * time.Second,
-			MaxFailedHeartbeats: 9001,
-		},
+		Version:              Version(1337),
+		SupervisorConfig:     sampleSupervisorConfig(),
+		EdgeConnectionConfig: sampleEdgeConnectionConfig(),
 	}
 	sample.ensureNoZeroFields()
 	for _, f := range overrides {
@@ -247,11 +257,35 @@ func sampleClientConfig(overrides ...func(*ClientConfig)) *ClientConfig {
 	return sample
 }

+func sampleSupervisorConfig() *SupervisorConfig {
+	sample := &SupervisorConfig{
+		AutoUpdateFrequency:    21 * time.Hour,
+		MetricsUpdateFrequency: 11 * time.Minute,
+		GracePeriod:            31 * time.Second,
+	}
+	sample.ensureNoZeroFields()
+	return sample
+}
+
+func sampleEdgeConnectionConfig() *EdgeConnectionConfig {
+	sample := &EdgeConnectionConfig{
+		NumHAConnections:    49,
+		HeartbeatInterval:   5 * time.Second,
+		Timeout:             9 * time.Second,
+		MaxFailedHeartbeats: 9001,
+		UserCredentialPath:  "/Users/example/.cloudflared/cert.pem",
+	}
+	sample.ensureNoZeroFields()
+	return sample
+}
+
+// sampleDoHProxyConfig initializes a new DoHProxyConfig struct,
+// applies any number of overrides to it, and returns it.
 func sampleDoHProxyConfig(overrides ...func(*DoHProxyConfig)) *DoHProxyConfig {
 	sample := &DoHProxyConfig{
 		ListenHost: "127.0.0.1",
 		ListenPort: 53,
-		Upstreams:  []string{"https://1.example.com", "https://2.example.com"},
+		Upstreams:  []string{"1.1.1.1", "1.0.0.1"},
 	}
 	sample.ensureNoZeroFields()
 	for _, f := range overrides {
@@ -260,13 +294,15 @@ func sampleDoHProxyConfig(overrides ...func(*DoHProxyConfig)) *DoHProxyConfig {
 	return sample
 }

+// sampleReverseProxyConfig initializes a new ReverseProxyConfig struct,
+// applies any number of overrides to it, and returns it.
 func sampleReverseProxyConfig(overrides ...func(*ReverseProxyConfig)) *ReverseProxyConfig {
 	sample := &ReverseProxyConfig{
-		TunnelHostname:     "hijk.example.com",
-		Origin:             &HelloWorldOriginConfig{},
-		Retries:            18,
-		ConnectionTimeout:  5 * time.Second,
-		CompressionQuality: 4,
+		TunnelHostname:          "mock-non-lb-tunnel.example.com",
+		OriginConfigJSONHandler: &OriginConfigJSONHandler{&HelloWorldOriginConfig{}},
+		Retries:                 18,
+		ConnectionTimeout:       5 * time.Second,
+		CompressionQuality:      3,
 	}
 	sample.ensureNoZeroFields()
 	for _, f := range overrides {
@@ -297,7 +333,7 @@ func sampleHTTPOriginConfig(overrides ...func(*HTTPOriginConfig)) *HTTPOriginCon
 	return sample
 }

-func sampleHTTPOriginUnixPathConfig(overrides ...func(*HTTPOriginConfig)) *HTTPOriginConfig {
+func sampleHTTPOriginConfigUnixPath(overrides ...func(*HTTPOriginConfig)) *HTTPOriginConfig {
 	sample := &HTTPOriginConfig{
 		URLString:              "unix:/var/lib/file.sock",
 		TCPKeepAlive:           7 * time.Second,
@@ -337,6 +373,14 @@ func (c *ClientConfig) ensureNoZeroFields() {
 	ensureNoZeroFieldsInSample(reflect.ValueOf(c), []string{"DoHProxyConfigs", "ReverseProxyConfigs"})
 }

+func (c *SupervisorConfig) ensureNoZeroFields() {
+	ensureNoZeroFieldsInSample(reflect.ValueOf(c), []string{})
+}
+
+func (c *EdgeConnectionConfig) ensureNoZeroFields() {
+	ensureNoZeroFieldsInSample(reflect.ValueOf(c), []string{})
+}
+
 func (c *DoHProxyConfig) ensureNoZeroFields() {
 	ensureNoZeroFieldsInSample(reflect.ValueOf(c), []string{})
 }
@@ -366,7 +410,6 @@ func (c *WebSocketOriginConfig) ensureNoZeroFields() {
 // include a field in the sample value, it won't be covered under tests.
 // This check reduces that risk by requiring fields to be either initialized
 // or explicitly uninitialized.
-// https://bitbucket.cfdata.org/projects/TUN/repos/cloudflared/pull-requests/151/overview?commentId=348012
 func ensureNoZeroFieldsInSample(ptrToSampleValue reflect.Value, allowedZeroFieldNames []string) {
 	sampleValue := ptrToSampleValue.Elem()
 	structType := ptrToSampleValue.Type().Elem()
@@ -0,0 +1,101 @@
+package pogs
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/mitchellh/mapstructure"
+	"github.com/pkg/errors"
+)
+
+// ScopeUnmarshaler can marshal a Scope pog from JSON.
+type ScopeUnmarshaler struct {
+	Scope Scope
+}
+
+// UnmarshalJSON takes in a JSON string, and attempts to marshal it into a Scope.
+// If successful, the Scope member of this ScopeUnmarshaler is set and nil is returned.
+// If unsuccessful, returns an error.
+func (su *ScopeUnmarshaler) UnmarshalJSON(b []byte) error {
+	var scopeJSON map[string]interface{}
+	if err := json.Unmarshal(b, &scopeJSON); err != nil {
+		return errors.Wrapf(err, "cannot unmarshal %s into scopeJSON", string(b))
+	}
+
+	if group, ok := scopeJSON["group"]; ok {
+		if val, ok := group.(string); ok {
+			su.Scope = NewGroup(val)
+			return nil
+		}
+		return fmt.Errorf("JSON should have been a Scope, but the 'group' key contained %v", group)
+	}
+
+	if systemName, ok := scopeJSON["system_name"]; ok {
+		if val, ok := systemName.(string); ok {
+			su.Scope = NewSystemName(val)
+			return nil
+		}
+		return fmt.Errorf("JSON should have been a Scope, but the 'system_name' key contained %v", systemName)
+	}
+
+	return fmt.Errorf("JSON should have been an object with one root key, either 'system_name' or 'group'")
+}
+
+// OriginConfigJSONHandler is a wrapper to serialize OriginConfig with type information, and deserialize JSON
+// into an OriginConfig.
+type OriginConfigJSONHandler struct {
+	OriginConfig OriginConfig
+}
+
+func (ocjh *OriginConfigJSONHandler) MarshalJSON() ([]byte, error) {
+	marshaler := make(map[string]OriginConfig, 1)
+	marshaler[ocjh.OriginConfig.jsonType()] = ocjh.OriginConfig
+	return json.Marshal(marshaler)
+}
+
+func (ocjh *OriginConfigJSONHandler) UnmarshalJSON(b []byte) error {
+	var originJSON map[string]interface{}
+	if err := json.Unmarshal(b, &originJSON); err != nil {
+		return errors.Wrapf(err, "cannot unmarshal %s into originJSON", string(b))
+	}
+
+	if originConfig, ok := originJSON[httpType.String()]; ok {
+		httpOriginConfig := &HTTPOriginConfig{}
+		if err := mapstructure.Decode(originConfig, httpOriginConfig); err != nil {
+			return errors.Wrapf(err, "cannot decode %+v into HTTPOriginConfig", originConfig)
+		}
+		ocjh.OriginConfig = httpOriginConfig
+		return nil
+	}
+
+	if originConfig, ok := originJSON[wsType.String()]; ok {
+		wsOriginConfig := &WebSocketOriginConfig{}
+		if err := mapstructure.Decode(originConfig, wsOriginConfig); err != nil {
+			return errors.Wrapf(err, "cannot decode %+v into WebSocketOriginConfig", originConfig)
+		}
+		ocjh.OriginConfig = wsOriginConfig
+		return nil
+	}
+
+	if originConfig, ok := originJSON[helloWorldType.String()]; ok {
+		helloWorldOriginConfig := &HelloWorldOriginConfig{}
+		if err := mapstructure.Decode(originConfig, helloWorldOriginConfig); err != nil {
+			return errors.Wrapf(err, "cannot decode %+v into HelloWorldOriginConfig", originConfig)
+		}
+		ocjh.OriginConfig = helloWorldOriginConfig
+		return nil
+	}
+
+	return fmt.Errorf("cannot unmarshal %s into OriginConfig", string(b))
+}
+
+// FallibleConfigMarshaler is a wrapper for FallibleConfig to implement custom marshal logic
+type FallibleConfigMarshaler struct {
+	FallibleConfig FallibleConfig
+}
+
+func (fcm *FallibleConfigMarshaler) MarshalJSON() ([]byte, error) {
+	marshaler := make(map[string]FallibleConfig, 1)
+	marshaler[fcm.FallibleConfig.jsonType()] = fcm.FallibleConfig
+	return json.Marshal(marshaler)
+}
@@ -0,0 +1,342 @@
+package pogs
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestScopeUnmarshaler_UnmarshalJSON(t *testing.T) {
+	type fields struct {
+		Scope Scope
+	}
+	type args struct {
+		b []byte
+	}
+	tests := []struct {
+		name      string
+		fields    fields
+		args      args
+		wantErr   bool
+		wantScope Scope
+	}{
+		{
+			name:      "group_successful",
+			args:      args{b: []byte(`{"group": "my-group"}`)},
+			wantScope: NewGroup("my-group"),
+		},
+		{
+			name:      "system_name_successful",
+			args:      args{b: []byte(`{"system_name": "my-computer"}`)},
+			wantScope: NewSystemName("my-computer"),
+		},
+		{
+			name:    "not_a_scope",
+			args:    args{b: []byte(`{"x": "y"}`)},
+			wantErr: true,
+		},
+		{
+			name:    "malformed_group",
+			args:    args{b: []byte(`{"group": ["a", "b"]}`)},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			su := &ScopeUnmarshaler{
+				Scope: tt.fields.Scope,
+			}
+			err := su.UnmarshalJSON(tt.args.b)
+			if !tt.wantErr {
+				if err != nil {
+					t.Errorf("ScopeUnmarshaler.UnmarshalJSON() error = %v, wantErr %v", err, tt.wantErr)
+				}
+				if !eqScope(tt.wantScope, su.Scope) {
+					t.Errorf("Wanted scope %v but got scope %v", tt.wantScope, su.Scope)
+				}
+			}
+		})
+	}
+}
+
+func TestUnmarshalOrigin(t *testing.T) {
+	tests := []struct {
+		jsonLiteral          string
+		exceptedOriginConfig OriginConfig
+	}{
+		{
+			jsonLiteral: `{
+				"Http":{
+					"url_string":"https.example.com",
+					"tcp_keep_alive":7000000000,
+					"dial_dual_stack":true,
+					"tls_handshake_timeout":11000000000,
+					"tls_verify":true,
+					"origin_ca_pool":"/etc/cert.pem",
+					"origin_server_name":"secure.example.com",
+					"max_idle_connections":19,
+					"idle_connection_timeout":17000000000,
+					"proxy_connection_timeout":15000000000,
+					"expect_continue_timeout":21000000000,
+					"chunked_encoding":true
+				}
+			}`,
+			exceptedOriginConfig: sampleHTTPOriginConfig(),
+		},
+		{
+			jsonLiteral: `{
+				"WebSocket":{
+					"url_string":"ssh://example.com",
+					"tls_verify":true,
+					"origin_ca_pool":"/etc/cert.pem",
+					"origin_server_name":"secure.example.com"
+				}
+			}`,
+			exceptedOriginConfig: sampleWebSocketOriginConfig(),
+		},
+		{
+			jsonLiteral: `{
+				"HelloWorld": {}
+			}`,
+			exceptedOriginConfig: &HelloWorldOriginConfig{},
+		},
+	}
+
+	for _, test := range tests {
+		originConfigJSON := prettyToValidJSON(test.jsonLiteral)
+		var OriginConfigJSONHandler OriginConfigJSONHandler
+		err := json.Unmarshal([]byte(originConfigJSON), &OriginConfigJSONHandler)
+		assert.NoError(t, err)
+		assert.Equal(t, test.exceptedOriginConfig, OriginConfigJSONHandler.OriginConfig)
+	}
+}
+
+func TestUnmarshalClientConfig(t *testing.T) {
+	prettyClientConfigJSON := `{
+		"version":10,
+		"supervisor_config":{
+			"auto_update_frequency":86400000000000,
+			"metrics_update_frequency":300000000000,
+			"grace_period":30000000000
+		},
+		"edge_connection_config":{
+			"num_ha_connections":4,
+			"heartbeat_interval":5000000000,
+			"timeout":30000000000,
+			"max_failed_heartbeats":5,
+			"user_credential_path":"~/.cloudflared/cert.pem"
+		},
+		"doh_proxy_configs":[{
+			"listen_host": "localhost",
+			"listen_port": 53,
+			"upstreams": ["https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"]
+		}],
+		"reverse_proxy_configs":[{
+			"tunnel_hostname":"sdfjadk33.cftunnel.com",
+			"origin_config":{
+				"Http":{
+					"url_string":"https://127.0.0.1:8080",
+					"tcp_keep_alive":30000000000,
+					"dial_dual_stack":true,
+					"tls_handshake_timeout":10000000000,
+					"tls_verify":true,
+					"origin_ca_pool":"",
+					"origin_server_name":"",
+					"max_idle_connections":100,
+					"idle_connection_timeout":90000000000,
+					"proxy_connection_timeout":90000000000,
+					"expect_continue_timeout":90000000000,
+					"chunked_encoding":true
+				}
+			},
+			"retries":5,
+			"connection_timeout":30,
+			"compression_quality":0
+		}]
+	}`
+	// replace new line and tab
+	clientConfigJSON := prettyToValidJSON(prettyClientConfigJSON)
+
+	var clientConfig ClientConfig
+	err := json.Unmarshal([]byte(clientConfigJSON), &clientConfig)
+	assert.NoError(t, err)
+
+	assert.Equal(t, Version(10), clientConfig.Version)
+
+	supervisorConfig := SupervisorConfig{
+		AutoUpdateFrequency:    time.Hour * 24,
+		MetricsUpdateFrequency: time.Second * 300,
+		GracePeriod:            time.Second * 30,
+	}
+	assert.Equal(t, supervisorConfig, *clientConfig.SupervisorConfig)
+
+	edgeConnectionConfig := EdgeConnectionConfig{
+		NumHAConnections:    4,
+		HeartbeatInterval:   time.Second * 5,
+		Timeout:             time.Second * 30,
+		MaxFailedHeartbeats: 5,
+		UserCredentialPath:  "~/.cloudflared/cert.pem",
+	}
+	assert.Equal(t, edgeConnectionConfig, *clientConfig.EdgeConnectionConfig)
+
+	dohProxyConfig := DoHProxyConfig{
+		ListenHost: "localhost",
+		ListenPort: 53,
+		Upstreams:  []string{"https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"},
+	}
+
+	assert.Len(t, clientConfig.DoHProxyConfigs, 1)
+	assert.Equal(t, dohProxyConfig, *clientConfig.DoHProxyConfigs[0])
+
+	reverseProxyConfig := ReverseProxyConfig{
+		TunnelHostname: "sdfjadk33.cftunnel.com",
+		OriginConfigJSONHandler: &OriginConfigJSONHandler{
+			OriginConfig: &HTTPOriginConfig{
+				URLString:              "https://127.0.0.1:8080",
+				TCPKeepAlive:           time.Second * 30,
+				DialDualStack:          true,
+				TLSHandshakeTimeout:    time.Second * 10,
+				TLSVerify:              true,
+				OriginCAPool:           "",
+				OriginServerName:       "",
+				MaxIdleConnections:     100,
+				IdleConnectionTimeout:  time.Second * 90,
+				ProxyConnectionTimeout: time.Second * 90,
+				ExpectContinueTimeout:  time.Second * 90,
+				ChunkedEncoding:        true,
+			},
+		},
+		Retries:            5,
+		ConnectionTimeout:  30,
+		CompressionQuality: 0,
+	}
+
+	assert.Len(t, clientConfig.ReverseProxyConfigs, 1)
+	assert.Equal(t, reverseProxyConfig, *clientConfig.ReverseProxyConfigs[0])
+}
+
+func TestMarshalFallibleConfig(t *testing.T) {
+	tests := []struct {
+		fallibleConfig     FallibleConfig
+		expctedJSONLiteral string
+	}{
+		{
+			fallibleConfig: sampleSupervisorConfig(),
+			expctedJSONLiteral: `{
+				"supervisor_config":{
+					"auto_update_frequency":75600000000000,
+					"metrics_update_frequency":660000000000,
+					"grace_period":31000000000
+				}
+			}`,
+		},
+		{
+			fallibleConfig: sampleEdgeConnectionConfig(),
+			expctedJSONLiteral: `{
+				"edge_connection_config":{
+					"num_ha_connections":49,
+					"heartbeat_interval":5000000000,
+					"timeout":9000000000,
+					"max_failed_heartbeats":9001,
+					"user_credential_path":"/Users/example/.cloudflared/cert.pem"
+				}
+			}`,
+		},
+		{
+			fallibleConfig: sampleDoHProxyConfig(),
+			expctedJSONLiteral: `{
+				"doh_proxy_config":{
+					"listen_host":"127.0.0.1",
+					"listen_port":53,
+					"upstreams":["1.1.1.1","1.0.0.1"]
+				}
+			}`,
+		},
+		{
+			fallibleConfig: sampleReverseProxyConfig(func(c *ReverseProxyConfig) {
+				c.OriginConfigJSONHandler = &OriginConfigJSONHandler{sampleHTTPOriginConfig()}
+			}),
+			expctedJSONLiteral: `{
+				"reverse_proxy_config":{
+					"tunnel_hostname":"mock-non-lb-tunnel.example.com",
+					"origin_config":{
+						"Http":{
+							"url_string":"https.example.com",
+							"tcp_keep_alive":7000000000,
+							"dial_dual_stack":true,
+							"tls_handshake_timeout":11000000000,
+							"tls_verify":true,
+							"origin_ca_pool":"/etc/cert.pem",
+							"origin_server_name":"secure.example.com",
+							"max_idle_connections":19,
+							"idle_connection_timeout":17000000000,
+							"proxy_connection_timeout":15000000000,
+							"expect_continue_timeout":21000000000,
+							"chunked_encoding":true
+						}
+					},
+					"retries":18,
+					"connection_timeout":5000000000,
+					"compression_quality":3
+				}
+			}`,
+		},
+		{
+			fallibleConfig: sampleReverseProxyConfig(func(c *ReverseProxyConfig) {
+				c.OriginConfigJSONHandler = &OriginConfigJSONHandler{sampleWebSocketOriginConfig()}
+			}),
+			expctedJSONLiteral: `{
+				"reverse_proxy_config":{
+					"tunnel_hostname":"mock-non-lb-tunnel.example.com",
+					"origin_config":{
+						"WebSocket":{
+							"url_string":"ssh://example.com",
+							"tls_verify":true,
+							"origin_ca_pool":"/etc/cert.pem",
+							"origin_server_name":"secure.example.com"
+						}
+					},
+					"retries":18,
+					"connection_timeout":5000000000,
+					"compression_quality":3
+				}
+			}`,
+		},
+		{
+			fallibleConfig: sampleReverseProxyConfig(func(c *ReverseProxyConfig) {
+				c.OriginConfigJSONHandler = &OriginConfigJSONHandler{&HelloWorldOriginConfig{}}
+			}),
+			expctedJSONLiteral: `{
+				"reverse_proxy_config":{
+					"tunnel_hostname":"mock-non-lb-tunnel.example.com",
+					"origin_config":{
+						"HelloWorld":{}
+					},
+					"retries":18,
+					"connection_timeout":5000000000,
+					"compression_quality":3
+				}
+			}`,
+		},
+	}
+
+	for _, test := range tests {
+		b, err := json.Marshal(test.fallibleConfig)
+		assert.NoError(t, err)
+		assert.Equal(t, prettyToValidJSON(test.expctedJSONLiteral), string(b))
+	}
+
+}
+
+type prettyJSON string
+
+func prettyToValidJSON(prettyJSON string) string {
+	return strings.ReplaceAll(strings.ReplaceAll(prettyJSON, "\n", ""), "\t", "")
+}
+
+func eqScope(s1, s2 Scope) bool {
+	return s1.Value() == s2.Value() && s1.PostgresType() == s2.PostgresType()
+}
@@ -2,6 +2,7 @@ package pogs

 import (
 	"context"
+	"fmt"
 	"time"

 	"github.com/cloudflare/cloudflared/tunnelrpc"
@@ -127,52 +128,175 @@ func UnmarshalServerInfo(s tunnelrpc.ServerInfo) (*ServerInfo, error) {
 	return p, err
 }

+//go-sumtype:decl Scope
+type Scope interface {
+	Value() string
+	PostgresType() string
+	GraphQLType() string
+	isScope()
+}
+
+type SystemName struct {
+	systemName string
+}
+
+func NewSystemName(systemName string) *SystemName {
+	return &SystemName{systemName: systemName}
+}
+
+func (s *SystemName) Value() string        { return s.systemName }
+func (_ *SystemName) PostgresType() string { return "system_name" }
+func (_ *SystemName) GraphQLType() string { return "SYSTEM_NAME" }
+
+func (_ *SystemName) isScope() {}
+
+type Group struct {
+	group string
+}
+
+func NewGroup(group string) *Group {
+	return &Group{group: group}
+}
+
+func (g *Group) Value() string        { return g.group }
+func (_ *Group) PostgresType() string { return "group" }
+func (_ *Group) GraphQLType() string { return "GROUP" }
+
+func (_ *Group) isScope() {}
+
+func MarshalScope(s tunnelrpc.Scope, p Scope) error {
+	ss := s.Value()
+	switch scope := p.(type) {
+	case *SystemName:
+		ss.SetSystemName(scope.systemName)
+	case *Group:
+		ss.SetGroup(scope.group)
+	default:
+		return fmt.Errorf("unexpected Scope value: %v", p)
+	}
+	return nil
+}
+
+func UnmarshalScope(s tunnelrpc.Scope) (Scope, error) {
+	ss := s.Value()
+	switch ss.Which() {
+	case tunnelrpc.Scope_value_Which_systemName:
+		systemName, err := ss.SystemName()
+		if err != nil {
+			return nil, err
+		}
+		return NewSystemName(systemName), nil
+	case tunnelrpc.Scope_value_Which_group:
+		group, err := ss.Group()
+		if err != nil {
+			return nil, err
+		}
+		return NewGroup(group), nil
+	default:
+		return nil, fmt.Errorf("unexpected Scope tag: %v", ss.Which())
+	}
+}
+
 type ConnectParameters struct {
 	OriginCert          []byte
 	CloudflaredID       uuid.UUID
 	NumPreviousAttempts uint8
 	Tags                []Tag
 	CloudflaredVersion  string
-}
-
-// CapnpConnectParameters is ConnectParameters represented in Cap'n Proto build-in types
-type CapnpConnectParameters struct {
-	OriginCert          []byte
-	CloudflaredID       []byte
-	NumPreviousAttempts uint8
-	Tags                []Tag
-	CloudflaredVersion  string
+	Scope               Scope
 }

 func MarshalConnectParameters(s tunnelrpc.CapnpConnectParameters, p *ConnectParameters) error {
+	if err := s.SetOriginCert(p.OriginCert); err != nil {
+		return err
+	}
 	cloudflaredIDBytes, err := p.CloudflaredID.MarshalBinary()
 	if err != nil {
 		return err
 	}
-	capnpConnectParameters := &CapnpConnectParameters{
-		OriginCert:          p.OriginCert,
-		CloudflaredID:       cloudflaredIDBytes,
-		NumPreviousAttempts: p.NumPreviousAttempts,
-		CloudflaredVersion:  p.CloudflaredVersion,
+	if err := s.SetCloudflaredID(cloudflaredIDBytes); err != nil {
+		return err
 	}
-	return pogs.Insert(tunnelrpc.CapnpConnectParameters_TypeID, s.Struct, capnpConnectParameters)
+	s.SetNumPreviousAttempts(p.NumPreviousAttempts)
+	if len(p.Tags) > 0 {
+		tagsCapnpList, err := s.NewTags(int32(len(p.Tags)))
+		if err != nil {
+			return err
+		}
+		for i, tag := range p.Tags {
+			tagCapnp := tagsCapnpList.At(i)
+			if err := tagCapnp.SetName(tag.Name); err != nil {
+				return err
+			}
+			if err := tagCapnp.SetValue(tag.Value); err != nil {
+				return err
+			}
+		}
+	}
+	if err := s.SetCloudflaredVersion(p.CloudflaredVersion); err != nil {
+		return err
+	}
+	scope, err := s.NewScope()
+	if err != nil {
+		return err
+	}
+	return MarshalScope(scope, p.Scope)
 }

 func UnmarshalConnectParameters(s tunnelrpc.CapnpConnectParameters) (*ConnectParameters, error) {
-	p := new(CapnpConnectParameters)
-	err := pogs.Extract(p, tunnelrpc.CapnpConnectParameters_TypeID, s.Struct)
+	originCert, err := s.OriginCert()
 	if err != nil {
 		return nil, err
 	}
-	cloudflaredID, err := uuid.FromBytes(p.CloudflaredID)
+
+	cloudflaredIDBytes, err := s.CloudflaredID()
 	if err != nil {
 		return nil, err
 	}
+	cloudflaredID, err := uuid.FromBytes(cloudflaredIDBytes)
+	if err != nil {
+		return nil, err
+	}
+
+	tagsCapnpList, err := s.Tags()
+	if err != nil {
+		return nil, err
+	}
+	var tags []Tag
+	for i := 0; i < tagsCapnpList.Len(); i++ {
+		tagCapnp := tagsCapnpList.At(i)
+		name, err := tagCapnp.Name()
+		if err != nil {
+			return nil, err
+		}
+		value, err := tagCapnp.Value()
+		if err != nil {
+			return nil, err
+		}
+		tags = append(tags, Tag{Name: name, Value: value})
+	}
+
+	cloudflaredVersion, err := s.CloudflaredVersion()
+	if err != nil {
+		return nil, err
+	}
+
+	scopeCapnp, err := s.Scope()
+	if err != nil {
+		return nil, err
+	}
+	scope, err := UnmarshalScope(scopeCapnp)
+	if err != nil {
+		return nil, err
+	}
+
 	return &ConnectParameters{
-		OriginCert:          p.OriginCert,
+		OriginCert:          originCert,
 		CloudflaredID:       cloudflaredID,
-		NumPreviousAttempts: p.NumPreviousAttempts,
-		CloudflaredVersion:  p.CloudflaredVersion,
+		NumPreviousAttempts: s.NumPreviousAttempts(),
+		Tags:                tags,
+		CloudflaredVersion:  cloudflaredVersion,
+		Scope:               scope,
 	}, nil
 }

@@ -0,0 +1,97 @@
+package pogs
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/cloudflare/cloudflared/tunnelrpc"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	capnp "zombiezen.com/go/capnproto2"
+)
+
+// Assert *SystemName implements Scope
+var _ Scope = (*SystemName)(nil)
+
+// Assert *Group implements Scope
+var _ Scope = (*Group)(nil)
+
+func TestScope(t *testing.T) {
+	testCases := []Scope{
+		&SystemName{systemName: "my_system"},
+		&Group{group: "my_group"},
+	}
+	for i, testCase := range testCases {
+		_, seg, err := capnp.NewMessage(capnp.SingleSegment(nil))
+		capnpEntity, err := tunnelrpc.NewScope(seg)
+		if !assert.NoError(t, err) {
+			t.Fatal("Couldn't initialize a new message")
+		}
+		err = MarshalScope(capnpEntity, testCase)
+		if !assert.NoError(t, err, "testCase index %v failed to marshal", i) {
+			continue
+		}
+		result, err := UnmarshalScope(capnpEntity)
+		if !assert.NoError(t, err, "testCase index %v failed to unmarshal", i) {
+			continue
+		}
+		assert.Equal(t, testCase, result, "testCase index %v didn't preserve struct through marshalling and unmarshalling", i)
+	}
+}
+
+func TestConnectParameters(t *testing.T) {
+	testCases := []*ConnectParameters{
+		sampleConnectParameters(),
+		sampleConnectParameters(func(c *ConnectParameters) {
+			c.Scope = &SystemName{systemName: "my_system"}
+		}),
+		sampleConnectParameters(func(c *ConnectParameters) {
+			c.Tags = nil
+		}),
+	}
+	for i, testCase := range testCases {
+		_, seg, err := capnp.NewMessage(capnp.SingleSegment(nil))
+		capnpEntity, err := tunnelrpc.NewCapnpConnectParameters(seg)
+		if !assert.NoError(t, err) {
+			t.Fatal("Couldn't initialize a new message")
+		}
+		err = MarshalConnectParameters(capnpEntity, testCase)
+		if !assert.NoError(t, err, "testCase index %v failed to marshal", i) {
+			continue
+		}
+		result, err := UnmarshalConnectParameters(capnpEntity)
+		if !assert.NoError(t, err, "testCase index %v failed to unmarshal", i) {
+			continue
+		}
+		assert.Equal(t, testCase, result, "testCase index %v didn't preserve struct through marshalling and unmarshalling", i)
+	}
+}
+
+func sampleConnectParameters(overrides ...func(*ConnectParameters)) *ConnectParameters {
+	cloudflaredID, err := uuid.Parse("ED7BA470-8E54-465E-825C-99712043E01C")
+	if err != nil {
+		panic(err)
+	}
+	sample := &ConnectParameters{
+		OriginCert:          []byte("my-origin-cert"),
+		CloudflaredID:       cloudflaredID,
+		NumPreviousAttempts: 19,
+		Tags: []Tag{
+			Tag{
+				Name:  "provision-method",
+				Value: "new",
+			},
+		},
+		CloudflaredVersion: "7.0",
+		Scope:              &Group{group: "my_group"},
+	}
+	sample.ensureNoZeroFields()
+	for _, f := range overrides {
+		f(sample)
+	}
+	return sample
+}
+
+func (c *ConnectParameters) ensureNoZeroFields() {
+	ensureNoZeroFieldsInSample(reflect.ValueOf(c), []string{})
+}
@@ -57,6 +57,17 @@ struct CapnpConnectParameters {
    tags @3 :List(Tag);
    # release version of cloudflared
    cloudflaredVersion @4 :Text;
+    # identifier for this cloudflared instance
+    scope @5 :Scope;
+}
+
+struct Scope {
+    value :union {
+        # Standalone instance
+        systemName @0 :Text;
+        # Associated with a group of identical cloudflared instances
+        group @1 :Text;
+    }
 }

 struct ConnectResult {
@@ -504,12 +504,12 @@ type CapnpConnectParameters struct{ capnp.Struct }
 const CapnpConnectParameters_TypeID = 0xa78f37418c1077c8

 func NewCapnpConnectParameters(s *capnp.Segment) (CapnpConnectParameters, error) {
-	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 4})
+	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 5})
 	return CapnpConnectParameters{st}, err
 }

 func NewRootCapnpConnectParameters(s *capnp.Segment) (CapnpConnectParameters, error) {
-	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 4})
+	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 5})
 	return CapnpConnectParameters{st}, err
 }

@@ -603,12 +603,37 @@ func (s CapnpConnectParameters) SetCloudflaredVersion(v string) error {
 	return s.Struct.SetText(3, v)
 }

+func (s CapnpConnectParameters) Scope() (Scope, error) {
+	p, err := s.Struct.Ptr(4)
+	return Scope{Struct: p.Struct()}, err
+}
+
+func (s CapnpConnectParameters) HasScope() bool {
+	p, err := s.Struct.Ptr(4)
+	return p.IsValid() || err != nil
+}
+
+func (s CapnpConnectParameters) SetScope(v Scope) error {
+	return s.Struct.SetPtr(4, v.Struct.ToPtr())
+}
+
+// NewScope sets the scope field to a newly
+// allocated Scope struct, preferring placement in s's segment.
+func (s CapnpConnectParameters) NewScope() (Scope, error) {
+	ss, err := NewScope(s.Struct.Segment())
+	if err != nil {
+		return Scope{}, err
+	}
+	err = s.Struct.SetPtr(4, ss.Struct.ToPtr())
+	return ss, err
+}
+
 // CapnpConnectParameters_List is a list of CapnpConnectParameters.
 type CapnpConnectParameters_List struct{ capnp.List }

 // NewCapnpConnectParameters creates a new list of CapnpConnectParameters.
 func NewCapnpConnectParameters_List(s *capnp.Segment, sz int32) (CapnpConnectParameters_List, error) {
-	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 8, PointerCount: 4}, sz)
+	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 8, PointerCount: 5}, sz)
 	return CapnpConnectParameters_List{l}, err
 }

@@ -633,6 +658,147 @@ func (p CapnpConnectParameters_Promise) Struct() (CapnpConnectParameters, error)
 	return CapnpConnectParameters{s}, err
 }

+func (p CapnpConnectParameters_Promise) Scope() Scope_Promise {
+	return Scope_Promise{Pipeline: p.Pipeline.GetPipeline(4)}
+}
+
+type Scope struct{ capnp.Struct }
+type Scope_value Scope
+type Scope_value_Which uint16
+
+const (
+	Scope_value_Which_systemName Scope_value_Which = 0
+	Scope_value_Which_group      Scope_value_Which = 1
+)
+
+func (w Scope_value_Which) String() string {
+	const s = "systemNamegroup"
+	switch w {
+	case Scope_value_Which_systemName:
+		return s[0:10]
+	case Scope_value_Which_group:
+		return s[10:15]
+
+	}
+	return "Scope_value_Which(" + strconv.FormatUint(uint64(w), 10) + ")"
+}
+
+// Scope_TypeID is the unique identifier for the type Scope.
+const Scope_TypeID = 0xc54a4a6fd4d87596
+
+func NewScope(s *capnp.Segment) (Scope, error) {
+	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 1})
+	return Scope{st}, err
+}
+
+func NewRootScope(s *capnp.Segment) (Scope, error) {
+	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 1})
+	return Scope{st}, err
+}
+
+func ReadRootScope(msg *capnp.Message) (Scope, error) {
+	root, err := msg.RootPtr()
+	return Scope{root.Struct()}, err
+}
+
+func (s Scope) String() string {
+	str, _ := text.Marshal(0xc54a4a6fd4d87596, s.Struct)
+	return str
+}
+
+func (s Scope) Value() Scope_value { return Scope_value(s) }
+
+func (s Scope_value) Which() Scope_value_Which {
+	return Scope_value_Which(s.Struct.Uint16(0))
+}
+func (s Scope_value) SystemName() (string, error) {
+	if s.Struct.Uint16(0) != 0 {
+		panic("Which() != systemName")
+	}
+	p, err := s.Struct.Ptr(0)
+	return p.Text(), err
+}
+
+func (s Scope_value) HasSystemName() bool {
+	if s.Struct.Uint16(0) != 0 {
+		return false
+	}
+	p, err := s.Struct.Ptr(0)
+	return p.IsValid() || err != nil
+}
+
+func (s Scope_value) SystemNameBytes() ([]byte, error) {
+	p, err := s.Struct.Ptr(0)
+	return p.TextBytes(), err
+}
+
+func (s Scope_value) SetSystemName(v string) error {
+	s.Struct.SetUint16(0, 0)
+	return s.Struct.SetText(0, v)
+}
+
+func (s Scope_value) Group() (string, error) {
+	if s.Struct.Uint16(0) != 1 {
+		panic("Which() != group")
+	}
+	p, err := s.Struct.Ptr(0)
+	return p.Text(), err
+}
+
+func (s Scope_value) HasGroup() bool {
+	if s.Struct.Uint16(0) != 1 {
+		return false
+	}
+	p, err := s.Struct.Ptr(0)
+	return p.IsValid() || err != nil
+}
+
+func (s Scope_value) GroupBytes() ([]byte, error) {
+	p, err := s.Struct.Ptr(0)
+	return p.TextBytes(), err
+}
+
+func (s Scope_value) SetGroup(v string) error {
+	s.Struct.SetUint16(0, 1)
+	return s.Struct.SetText(0, v)
+}
+
+// Scope_List is a list of Scope.
+type Scope_List struct{ capnp.List }
+
+// NewScope creates a new list of Scope.
+func NewScope_List(s *capnp.Segment, sz int32) (Scope_List, error) {
+	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 8, PointerCount: 1}, sz)
+	return Scope_List{l}, err
+}
+
+func (s Scope_List) At(i int) Scope { return Scope{s.List.Struct(i)} }
+
+func (s Scope_List) Set(i int, v Scope) error { return s.List.SetStruct(i, v.Struct) }
+
+func (s Scope_List) String() string {
+	str, _ := text.MarshalList(0xc54a4a6fd4d87596, s.List)
+	return str
+}
+
+// Scope_Promise is a wrapper for a Scope promised by a client call.
+type Scope_Promise struct{ *capnp.Pipeline }
+
+func (p Scope_Promise) Struct() (Scope, error) {
+	s, err := p.Pipeline.Struct()
+	return Scope{s}, err
+}
+
+func (p Scope_Promise) Value() Scope_value_Promise { return Scope_value_Promise{p.Pipeline} }
+
+// Scope_value_Promise is a wrapper for a Scope_value promised by a client call.
+type Scope_value_Promise struct{ *capnp.Pipeline }
+
+func (p Scope_value_Promise) Struct() (Scope_value, error) {
+	s, err := p.Pipeline.Struct()
+	return Scope_value{s}, err
+}
+
 type ConnectResult struct{ capnp.Struct }

 // ConnectResult_TypeID is the unique identifier for the type ConnectResult.
@@ -3509,218 +3675,228 @@ func (p ClientService_useConfiguration_Results_Promise) Result() UseConfiguratio
 	return UseConfigurationResult_Promise{Pipeline: p.Pipeline.GetPipeline(0)}
 }

-const schema_db8274f9144abc7e = "x\xda\xacY}\x8c\x1c\xe5y\x7f\x9ey\xf7v|\xe6" +
-	"\xce{\xe3\xb9\x80}\xd8\xba\xd6\x02%\x10Lq\\Z" +
-	"\xb8\xb6Y\xdf\x9d\xcf\xb9\xbd\xf8c\xe7\xf6\xce\x80\xb1%" +
-	"\x8fw\xdf\xdb\x1b{vf=\x1f\xf6\x9d\xe5\xc4`\xd9" +
-	"\x05\xae\x10l\x82%\xec\x90\x08\xdc\xba|\x08\x1aC@" +
-	"\x15\xd4\xa4\xa1jK\xda\xa8\"U\x93\xaai\xf3O\x03" +
-	"VU\xd4\x88\x9a\xa4B\xa9\x80\xa9\x9ew>oo9" +
-	"\xdbU\xf8\x03\x8f\x9e}\xde\xf7}>\x7f\xcf\xc7\xddv" +
-	"n\xc9\x06i]\xc7_v\x01h\x8fw\xe4\x83\xdfo" +
-	"\xbc}\xf6wN\xfd\xe0\x18(}R\xf0\xd5\x0bc\xbd" +
-	"\xbf\xf2\x8e\xfe\x1b\x00\xae\x1f\xc9\x1fB\xf5\x9e\xbc\x0c\xa0" +
-	"N\xe6\xb7\x01\x06\xfft\xdb\xe1ww\xff\xe2\xe4\x83\xa0" +
-	"\xf4a\xca\x99\x93\x01\xd67\xf2s\xa8\x1e\xcf\xcb\xc0\x82" +
-	"o\xde\xdb\xfb\xf7\xf8\xd4\x87'A\xf9\x1c\x02t \xfd" +
-	"\xac\xe7\x97J\x80\xeal\xbe\x08\x18\xbc}\xcb\x85\xd7O" +
-	"|\xe7\x81o\x80\xf6YD\x08\xcf\x9f\xce\xff/\x02\xaa" +
-	"/\x0a\x86K\x7f\xf2\xf9\xdc\x8bo/\xff\x96`\x08\xce" +
-	"\xfd\xe3]/\x9f\xf8\xceo\xbc\x07\x93\x92\x8c9\x80\xf5" +
-	"?\xce;\xc4\xfb\xef\xf9\xff\x00\x0c\x1e\xff\x977\xb66" +
-	"N\x9e9\x0b\xcag\xe3\xbb\xde\x94%\x09r\xc1\xed\xff" +
-	"zq\xdb\x96\x97\xa7\x9e\x09\x7f\x09\xe5xU~\x99\x8e" +
-	"\xfe\x8dL\xcf|\xff`\xcf\xc3\x83\xbf\xfb\xe83\xa0\xf5" +
-	"aF\x9f\x0eq\xc9\x7f\xcas\xa8\xe2\x12\xfa\xfcX\xee" +
-	"G\xc0`\xee\xce7\xb6\xff\xe2\x0f\xdd\xe7A[\x8b\xb9" +
-	"\xe0\xaf\x1fz\xe7\xc0M\xcfM\xbd%\xa4b\x00\xebo" +
-	"\xef<KW\x8ft~\x1b0\xe8\xfe\x8b\x9b\xb7>\xfa" +
-	"\xee\xe6\x97\xe8\xea\x8cQC!.v\x0e\xa0\xfa?\x9d" +
-	"d\xd7K\x82\xfb\x87\xb7l\xff\xeew\xcf\xd7_j\x15" +
-	"D\"\xee\x93K\xc7P=\xb7\x94\xb8\x9f^J\xdc\x9f" +
-	")\xe1O\xbf\xb7.\xf7\xe7\x91^\x8c\x98&\xafy\x8f" +
-	"\x1e7\xae!\x86{?z\xf5\xafF\xde\xff\xd1kY" +
-	"\x07tvI\xe4\x80\xd5]\xa4\xf8\xea\x9f\x0fu[\xef" +
-	"\x1f\xfd\xde|?\x867\x8dt\x8d\xa1zO\x97pz" +
-	"\xd7\xb7\x01?|\xfe\x81\x13\xa5w6\xbe\xa5\xf5a\xae" +
-	"U\x91K]\x87P\xed\xe8\xa6O\xec\x166J\xac\xd2" +
-	"\xc2.4Y\xb7l/\xaa#\xcb\xe8sp\x99`\x1f" +
-	"\xbb\xf7\xeb\x8fu\\\xfc\xfa[\xadf\x92\x89\xa7Tp" +
-	"P\xddU\xa0\xcf{\x0a\xcfH\x80A\xdf\xf9\xdf\xfb\xb3" +
-	"\xa1\xdaO~\xd0\"7]\xae\x8e,\xff@\xd5\x96\xd3" +
-	"\xd7\x96\xe5\x07\x01\x83\x07>?{h\xeb\x8ds?n" +
-	"\xb5\xa9\x10\xfc\xb9\xe5s\xa8\xbe)\xb8\xdf\x10\xdc\xd2E" +
-	"}\xe5}\xff\xfc\xc5\x9ff\xa2h\xad\xfa3\x84\\\xb0" +
-	"u\xfb\xbd{;\xbf\xf2\xce;\xd9(\xfaMUX\xfb" +
-	"v\x95\x8c\xf9\x8a\xf2\x98z\xe1\xe9?}\x97\x1e\x92[" +
-	"\xad9\xa9\xee@\xd5P\xe9\x93\xabB\x87$\x9a\xdb\xf9" +
-	"Z\xbfv\x00\xd5\xfd\xd7\x92\\\x8dkI\xae\xdbw\x0f" +
-	"\xf2\x9dw\xdc\xfd\x1e(}l^n\xbeH\x9co\x10" +
-	"\xe7\xfa\xd7\xae\x95Q5\xae\x93\x01\x82\xaf\xd5w\xfc\xdd" +
-	"\xa5\xe1\xa7\xff\xbbmDk\xd7\x0d\xa0\xaa\x13\xdf\xfa]" +
-	"\xd7\x09\xf3\xaf_\xf7G??\xf5\xc7\xc3\x97\x16\xdc\xfe" +
-	"\xdc\x8a!T_[Ar\xbc\xba\xe2K\xea\xc5\x15\xe2" +
-	"\xf2\xafn\xdcv\xe7\x9a7?\xc8Z\xe2\x1fV| " +
-	"Rq\x05Yb\xea\x8e\xff\xfa\xd2\x8d_\xfb\xdb\x0fZ" +
-	"\xdc#\x18q\xe5\xcd\xa8*+\xe9\xc6\xee\x95E\xc0\xf7" +
-	"7}\xebG}\x85\xbe_\xb6\x13t\xddJ\x8a\x93\x95" +
-	"\"NV\x0aA\xef\xfe\xd9\x99\x83\xc5o\xfc\xf2C\xd2" +
-	"\x8b\xb5 \xcf\xfe\xbe\x1d\xa8\x1e\xef\xa3\x9b\xef\xef\xa3\xf0" +
-	"\xdf\xfc\xc2O\xbe8}\xea\xfb\xbfj5\x82p\xc8\xda" +
-	"\xeb\x8f\xa2:x=q\xff\xc1\xf5\x84\x1f\x87\xdf?=" +
-	"\xfa\xe8\xce\x17>\xc9ju\xe3\xaa\xd7\x85\x7fW\x91V" +
-	"{O\x1d\xf6F\x9fx$h\x13t\xeb'W\x0d\xa1" +
-	"\xcaW\xd1m\xfa\xaa\x83\xb06\xf0|\xcb\xe2\xa6\xd3\xcc" +
-	"U\x7f+\xfe\xac\xdeZ\xd5\x9bVs`d\xc6p=" +
-	"\xc3\xaaO\x08z\xb1l\x9bFu\xb6\x8c\xa8u\xa1\x04" +
-	"\xa0\xac\x1e\x00@T>\xb3\x03\x00%E\x19\x02(\x1a" +
-	"u\xcbvxP3\xdc\xaamY\x1cX\xd5;\xb2G" +
-	"7u\xab\xca\x93\x87:\x16>4\xcaM\xd3\xbe\xcbv" +
-	"\xcc\xda6\xc7\xa8\x1b\xd6\xb0mM\x19u\x802br" +
-	"L^xl\xd84\xb8\xe5U\xb8s\xc0\xa8\xf2[}" +
-	"\x97\x87\xe7|G\xf7\x0c\xdb\xbaa\x9c\xbb\xbe\xe9\xb9\x00" +
-	"Z\x8e\xe5\x00r\x08\xa0t\x0f\x00hK\x18j\xbd\x12" +
-	"\x16\x1d\xc1\x80=i\xe6\x01b\x0f\xa4o\xe6\x17\xbe\x19" +
-	"\xda\x82\xde\xe4\xce\xad\xbe\xe5\xf0\xba\xe1z\xdc\x09\xc97" +
-	"\x14\xcb\xba\xa37\xdc\xec\x83g\x00\xb4\x1e\x86\xda*\x09" +
-	"\x83\xba\xa3Wy\x99;h\xd8\xb5\xad\xbaeW\x18\xaf" +
-	"b\x07H\xd8\x91y\xb4\x8d#6\xe9\x86\xc9k\xa1v" +
-	"\xb7V\xfb\xc5\xbfZ\x0f\xcbu\x05\x81xD\xdf\x01\xa0" +
-	"\xedf\xa8\x99\x12v\xe3'A/\x15)\xc58\x04\xa0" +
-	"M3\xd4<\x09\xbb\xa5\x8f\x83^\xe1\xb5\xfdk\x004" +
-	"\x93\xa16#a7\xfb(\xe8\xa5R\xa0\xf8{\x014" +
-	"\x8f\xa1v\x9f\x84\x81\xeb7\xc9\xa6.0\xdb\xc1\x9e4" +
-	"\x94#\xeb\xf0Z\x9d,mA\x91W\xc9\xd0\xd8\x13#" +
-	"n\xc8 \xd7\xeci\xecIKDt\xcc\xe1\x07\xb8\xe3" +
-	"\xf22\x14\x1c{f\x16{R\xe4m\xb1z\xf7\xd5Z" +
-	"=vtrj\xf1\xf3\"4\xab\xde\x0d\xe5\xfe\x05\xce" +
-	"\";v1\xd4VH\x184\xe9W\xeeq`\x8e\x8b" +
-	"=i\xe9m\x91\xb6M8\x0f\xd3\xff\x87\xc3W\xca\xd1" +
-	"-\x8e+\xc2Y\xebM\x1e\xfb\x0a=v\x98\xa1\xf6\xa0" +
-	"\x84\x0ab\xe8\xb3\xe3\x0e\x80v\x8c\xa1vBB\x94B" +
-	"\x8f=r\x16@;\xc1P{RB\x85I\xa1\xc3N" +
-	"\xdfL\xbd\x10C\xed\xbc\x84J\x8e\xf5R\x9b\xa1\xbcH" +
-	"\xc1v\x9e\xa1vA\xc2\xc0\x0eS\x89\xe4\xf7\xb0\x1b$" +
-	"\xec\x06\x0c\xaa\xa6\xed\xd7\xa6L\x1d\xfa\x1d^+mL" +
-	"\xe8\x96\xdf(;\xfc\x80\x81\xb6\xef\x0ez\x1eo\xc8M" +
-	"\xcf\xc5<H\x98\x07,xz\xdd\xc5e\x80e\x86\xd8" +
-	"\x93\xd64@\"&w\xa2\xc3k\xdb\xb9\xe3\x1a\xcc\xb6" +
-	"\xb0\x0b$\xecZ\xdcL\xe3Q@P8D\xb1m;" +
-	"\x86\\7,\xad\x8b\xe5V\x05Ad\x93\x11Ru\x03" +
-	"Cm\xb3\x84\xab\xf1\x13\"\x93YJ\xe3\x00\xda(C" +
-	"mB\xc2\xd5\xd2\xc7D&\xc3hd\xd62Cm\xa7" +
-	"\x84\x85i\xcfkbOZ\xf0\"\xdf\x1d\xe4{\\\xbb" +
-	"\xba\x8f\x03R\xf6'\xe8\x1b\xfd:\x1d\xa1\x110\xb3\x86" +
-	"=i\x0b\xd9\xe2x\xd6\xc6\xf1\xc2\xe7Eo\xc4ql" +
-	"G\x00e\xe2\xed\x91/\xa4J\xc4\xce.\xedH5P" +
-	"\xa4\x0d\xa1Z\xda\x9eT\xfe\xfe\xaa\xee\xbb<\xb1\xa5\xc3" +
-	"=gvp\xca\x03\xc6\x9d\x046\xdci\xdb7k\xe3" +
-	"\x1cd\xcf\x99E\x04\x09qq0\xd9h\x8ffL\x1e" +
-	"FeFN\x92i#C\xad\x9c\xca\xb9\x85h\x9b\x19" +
-	"jw\x93\x9c\x91\xf9'\xc9\xfc\x13\x0c\xb5\xa6\x84\x81I" +
-	"\xe9h\x8d\xda\xc0\\/\x117$\x96m\x11\x802H" +
-	"(\x03\x06~\xd3\xf5\x1c\xae7\x00\x93\x88\"\xfeeW" +
-	"\x81\xba-\xd9_\xd6\x0b\"\x8d\xdb\xeb\x90d\xd6\x96\xb1" +
-	"\xac\x12QjM\x0e\xa5\xc6n\x9f0\xd3\xb6\xebYz" +
-	"\x83\x03@\xac\xd8\x11\xbbI\xb0G\xa0\x90t\x83-\xb1" +
-	"q\xf5\xc5*,\x1c\xf3J\xd5\xd9L\xe5\xa8F\xa7Q" +
-	"\x1c\x1f\xb6-y\xca\xa8cO\xda>\xb5\x08\xd0\xc6\xef" +
-	"\x83\xbe7\xcd-\xcf\xa8\x8a\x07\x17\xf8}M\x1a\x9f\x89" +
-	"\xcdJ_\xc8\x182\xb6\xd9\x96=\xa9!\xe5}|6" +
-	"6K?o\xe8\x86\x99x?\xb2\xe6 \xc8_Ny" +
-	"\x16\xed6\xa2\xb2\x12\x16\x95bh\x9e\x16\xc8\x9c\x03\xd0" +
-	"\xeec\xa8=\x9c\x11\xf2\xa1\xc7\x00\xb4\x87\x19jOd" +
-	"\x84<5\x94\xc5L\x16a&Y\xf4I\x86\xda\xb3\x12" +
-	"b.\x84\xccs\x04\x99\xcf2\xd4^\x91\x04\x0a\x8e\x0e" +
-	"\x0e\xdb\x16FB\xb8\x001\x06\x06\xd3\\w\xbc=\\" +
-	"G\xafdy\xdc9\xa0\xa3\x19\xe7\xe0\x11\xcfhp\xdb" +
-	"\xf7\x92\x9cl\xe83\xa2dcm4<%\xeb\x9e\x8b" +
-	"\x9d a'\xa5\x80\xcb\x9da\x87\xd7\x90\xbc\xa1\x9be" +
-	"\x9dy\xd3Wb\xa0\xf9xYhc\x9eCiE\xa1" +
-	"\xff\xd2\xf9O9>\x00\x92H]\xd2\xb91\x946\x06" +
-	"\xa2\xa0tP_\xf0X\xda\x01\x88\x82\x92\xa7\x1b\xcf\xa4" +
-	"\x06\x8fD\x1b\xb5\xa1\x18\xa6D,s1t\xf5\x11\x82" +
-	"'\x83\xa7zFu\xd6@\xdb\x9a\x10\x06\xc2\xd4BU" +
-	"\xbb\xd1t\xb8\xeb\xa2a[\x9a\xaf\x9b\x06\xf3f\x93\x83" +
-	"\x8b\xda\x80r?\xcc\x99m\xcd~\xe1$2\xc2m\xb1" +
-	"\x11\xd4A\x1c\x03\xa8l@\x86\x95\xcd\x98\x86\x89Z\xc2" +
-	"!\x80\xcaF\xa2\x971\x8d\x14u\x0b\xf6\x01TF\x89" +
-	">\x81\x12b\x18+\xaa\x86\xcf\x03T&\x88\xbc\x1b\xd3" +
-	"\x12\xab\xee\x12\xd7\xef$\xfa4\xd1;r\xc2|*\xc7" +
-	"\x9b\x01*\xbb\x89~\x98\xe8yIXP\x9d\xc5\xbd\x00" +
-	"\x95\x19\xa2\x1f#\xba\xdc\xd1\x8b\xa2\xf1G\x07\xa0r\x1f" +
-	"\xd1\x1f&\xfa\x92\x15\xbd\xb8\x04@}H\xd0\x1f$\xfa" +
-	"\xe3D\xef\\\xd9\x8b\x9d\x00\xeaI<\x0aP9A\xf4" +
-	"'\x89\xbe\x14{q)\x80z\x1a\xcf\x00T\x9e$\xfa" +
-	"\xb3D\xbf&\xdf\x8b\xd7\x00\xa8\xe7\x84<O\x11\xfd\x05" +
-	"L\x00\xa4T\xcb\xe2\x18\x85\x93\x91\xd6jf\xbbI\x18" +
-	"\xf2\xa8\xf5\xc7\x10d\xcbv\x81z\x7f,\xa4\xab\x17@" +
-	",\x00\x06M\xdb6\xb7\xce\xc7\xc7\xcb\xb5\x0bQX@" +
-	"\xc1\xb6J\xb5$\xbf\xc2 \xdalC\x7fU7K\xcd" +
-	"D\x12\xc3\x1d\xf4=\xdboB\x7fM\xf7x-\xa9p" +
-	"\x8eomr\xec\xc6\x04r\xa7aX\xba\x09\xc9/\x8b" +
-	"\xc5V\xc1\xf7\x8d\xda\x82d\x93Z\x03\xad\xbf90\xa1" +
-	"\x8b\xecZ\x92d\xd7M\xd4\x86\xdc\xc0P\xbb-\x03>" +
-	"k\x09!?\xc7P\xfbm\x09\x0b\xd9\xa4\xe8?\xa0\x9b" +
-	">\xbf\x926h\xb2\xa5\x14\x84\xddl\x88\xcf\x99\xd7\x87" +
-	"\xd2\xd7\x93\xc7\xa9Y\xbc\x85\xa16*\xe1\x11\xd7\xafV" +
-	"I\xe9\xd8\x0aS\xd1\xcc\x00\xfdtw\xc6\x1f\xc98\x1f" +
-	"\xf9\xe3J\xcbn\x9d{\xe1W\xc9\x9a\xb2\xa9^\xc9z" +
-	"\xc3\xfd\x7f\x9e\x1e\xe7n\x81Z\xf6\xcbNf\xc9\x80~" +
-	"\xf9\xfa6:1QN\xc7G\x16\x82c\x16\x17\xc6\xb3" +
-	"\xb8\x90\xc2\xc2\xdel\xfa\xc7m\x98\xaa\x89<,\x13}" +
-	"'\xa6}\xb7z\x0f\x9e\x9d\x97\xff\xb9\xc1\x10\x17\xb8\xb8" +
-	"\xbeF\xf4\xa6\xc0\x05\x0cq\xa1!\xee7\x89>\x93\xc5" +
-	"\x05\x1f\xe7\xe6\xe3\x02\x8bq\x81\xf2\xf9\x18\xd1O\x08\\" +
-	"\xc8\x85\xb8\xf0\x08\xbe</\xff;;B\\8\x8d\xaf" +
-	"\xcf\xcb\xff\xa5\xf9\x10\x17\xce\x09\xfeg\x89\xfe\x8a\xc0\x85" +
-	"\xa1\x10\x17^\x128r\x9e\xe8\x17\x08\x17|\xc7\xacx" +
-	"\x8ea\x01\xd6\xd3`\xad6\xbf\xccys\x10\x0a\xa6q" +
-	"\x80'\x98]3ts\xa3\xaf\x9b\xd0_\xf1\xf4\xea\xbe" +
-	"\xb4\xd74\xddQ\xdd\xaa\xb98\xad\xef\xe3\x84\xf4r\xb6" +
-	"\x16z\xa6\xbb\x9d;\xc6\x14`\xda\x9d&\xbdA\xa1l" +
-	"\xdb\xad-\x83hr\xb8\x13\x82J\xf2[C\x9f)\xd5" +
-	"L>\x8cq\x87\xc0\xac\xb4\xd2\x18\xf4\x8bmY\x18\x96" +
-	"\xed\x09\xa3\x7f~=nF\xfdn\\\xd7'\x8a-\x05" +
-	"\x9b\xcf4y\xd5\x1b\xb6\xd1\xf2\x0c\xcb\xe7\x0b.\xa8N" +
-	"\xfb\xd6>^\x1bA\xabj\xd7\x0c\xab\x0e\x0b\x1am\xf6" +
-	"iS{\xa6\x91\x11\xd9\x8c\x99e\xb1r\x13\x95e\x8c" +
-	"\xca\xb22\x90N\x9f\xc5\xaa8Ut\xb8\xee\xb6\x99\xa6" +
-	"\xd8\xa7e[1L2z\xad\x87u\x00$\xabW\x8c" +
-	"wa\xca\xfeC )\x86\x8c\xe9\x0a\x11\xe3\x8d\xa1\xb2" +
-	"\xcb\x01I\x99\x94QJ6\xde\x18o\xab\x95\xd2\x1cH" +
-	"\xca\x88\x8c,YSc\xbc\x89R\xee\x1c\x02IY+" +
-	"\x07qk\x0e\xc5P\x9c\x0d\x18\xc4\x89\x0f\xfd\"\xf57" +
-	"`\x10\xcf\xef\x18\xb7\xf0\x00\x1b\xf0HT\x166`v" +
-	"\xe9\xc3>\xad\x8fn\xdf\x1e\x12F\xce0\xd4\x8e\xa5\x18" +
-	"y\xff\\:P'\xb3\xcb#\xcf\xb7\x9b\xa8\x8f\x02h" +
-	"O\x84\x9d`2Q\xbfD-\xe3+\x0c\xb5\x1fJi" +
-	"\xbd\x8c\xc3.\xde\x93\xa0\xed\xc4\xc3\xd4\"\xeb\x92(8" +
-	"\xa3\xce\xadui\x12\xd4\xeci\xd1\xd9ax\x95\x0b)" +
-	"bg7)\xcb2\x9b\x14\x8c\xc78y\x1e\xc0g\xf7" +
-	"*\xcb\x16\xc7\xccyC\x89\xa889\x115\xf1>\x1e" +
-	"\xe3\xbf\x8c(\x0ay\xbf[\x0e\xe2\xc1\x05\xe3rE\xce" +
-	"\xcb\xba\xec*\xa7\xb7q\xde\xef^I%\x88\xb7\xaf\x97" +
-	"\x1f\xc2\xc3w\x0a\x14l\xa1B\xc9\xbd{3\xdb\x1d\xd3" +
-	"\x8e\xe6\xa0\xc2\xd6L\xd5^\xccV\xa1\xc0q\x03Z\xa0" +
-	"\xc3-\xe1\xb7&\x0d\xbf\xa4A\xb8\x7fMf\xcb\x13O" +
-	"'\xc7\xc7\xa2\xa0|*i8\x95oR\xa0>\xc5P" +
-	"{!\x13~\xcf\x8d\xa5\xd3\x89\xcc\x1d'\x96S\xf6\x9d" +
-	"\x146M\xbb\xbe\xd9\xb0\xb8K-X\xcbH\xdd\xe4N" +
-	"C\xb7\xb8\x85\x1e\x81\x91\xef\x10\xa2\xceG\xae\xd2\xc6L" +
-	"\xe7\xb6\x98\xfa\x95(\xd8\xc3X\x8f\xcakf~<\x9b" +
-	"\xd9e\xc4\xcak\xafG;\x82\xdd\x19\xe5w\xd1\xfc\xb8" +
-	"\x93\xa16-a\xa0\xfb\x9e=\xd9\xac\xe9\xe8\xf1M\x0e" +
-	"\xdf\xefs\xd9\xaa\xce\xa6s\x14M\x14Uw\x12\x9b\xd4" +
-	"\xfbmrxq\xbf\xcf\xb3\x0c\xf1B\x15d\xc3\xae-" +
-	"\xd8\xa4\xb6i\xb6\xee\xe2{*vu\x1f\xf7\xe6-\x9a" +
-	"C\xb8\x8cU\xd1\xc7\xd3mj\xac\x891\x9e\x19\x99b" +
-	"\x18\xd9O\x01\xd5d\xa8\x1d\xce\xc0\xc8\xec\\\xea\xf0\xf6" +
-	"\xd5\xf5\xd7S\x10\x17Q\xb2\xed\xb6s\xbc\xc8\xaf(\xd1" +
-	"\xd2\xbf\x1e\\\xbe\xe5\x8a\xc6\xf5\xa8cmiX\xd7\xb4" +
-	"k\x97wD\x1d\xeb\x1dQ<\xf7\xa4\x7fw\x8c\x9es" +
-	"\xa3.\x11\xd8\x94\xbd\xb0\x01\xfc\xbf\x00\x00\x00\xff\xff\xde" +
-	"T\x04\xc0"
+const schema_db8274f9144abc7e = "x\xda\xacY}l\x1cez\x7f\x9ey\xd7\x1e;\xf1" +
+	"f=\xcc\"b\x13\xcb\xa7\x08t\x17\x8e\xa4\x107-" +
+	"q\xdb\xdb\xd8Nr\xb6/\x1f;\xfe\x08\x10\x12)\x93" +
+	"\xdd\xd7\xebIfg6\xf3\x91\xd8Q\xee\x02i(\xe0" +
+	"\x92#\xe1.\x15\xc9\x85\x13\xa4\x97\xf2\xa1\\K\xb8\xa0" +
+	"\xf6(\x9c\x8e\xaa\x14\xd2;\x09P\xa1\x82\x96\xfe\xd1\x83" +
+	"\xa8\x025\xa2p'!N\x17\xa6z\xe6\xdb\xeb\xc5!" +
+	"U\xffIV\xcf<\xef\xfb>\x9f\xbf\xe7\xc3\xb7\\n" +
+	"Y#\xdc\xdadf\x01\x94SM\xcd\xde\x1fW_;" +
+	"\xfd\x07\xc7\x7fq\x18\xa4N\xc1\xfb\xce\x0b\xc3\xf9\xcf\x9c" +
+	"C\xff\x0e\x80=\x8f6\xefG\xf9\\\xb3\x08 \xff\xb8" +
+	"y3\xa0\xf7/\xb7\x1cx\x7f\xc7\xaf\x8f\xdd\x0fR'" +
+	"&\x9c\x19\x11\xa0\xe7\xe5\xe6\x19\x94\xff\xa3Y\x04\xe6=" +
+	"zW\xfe\x9f\xf1\xb1O\x8f\x81\xf45\x04hB\xfa\xfc" +
+	"\xd3\xe6\x05\x02\xa0\xfcFs\x01\xd0{\xed\xe6\x17\x9e?" +
+	"\xfa\x93\xfb~\x00\xcaW\x11!8\xffq\xf3o\x11P" +
+	"n\x12\x89\xe1\xe3\x1f}=\xf3\xe3\xd7\xae\xf9\xa1\xcf\xe0" +
+	"\x9dy\xe3\xf6g\x8f\xfe\xe4+\x1f\xc2\xb8 b\x06\xa0" +
+	"g\xb9h\x11\xefj\xf1\xbf\x00\xbd\xef\xbf\xfd\xe2\xa6\xea" +
+	"\xb1\x93\xa7A\xfajtWG\x8b @\xc6[\xf5o" +
+	"\x177o|v\xe2\x89\xe0K G\xb6\xe5Y:\xda" +
+	"\xd5B\xcf\xbc\xba\xaf\xfd\xc1\xbe?|\xe8\x09P:1" +
+	"\xa5OS\x13q\xf6\xb5\xcc\xa0|g\x0b\xfd\x1co\xb9" +
+	"\x1d\x01\xbd\x99\xd5/n\xf9\xf5\x9f\xd9O\x83\xb2\x1c3" +
+	"\xde?>\xf0\xde\xdeeOM\xbc\xe2K\xc5\x00z." +
+	"\xb4\x9e\xa6\xab\xdfi\xfd\x1b@/\xfb\xf77mz\xe8" +
+	"\xfd\x0d\xe7\xe8\xea\x94Q\x03!\xa6\x17\xf4\xa2\xfc\xc0\x02" +
+	"\xb2\xeb\xbd\x0b\x88\xfb\xf5\x9b\xb7\xfc\xecg\xcfT\xce\xd5" +
+	"\x0b\"\x10\xf7\x8d\x0b\x87Q^\xbd\x90\xb8W-$\xee" +
+	"k\x87\xf0\xdd\x9f\xdf\x9a\xf9\xdbP/FL\x1f,\xfc" +
+	"\x90\x1e\xbf\xec3\xdc\xf5\xbb\xe7\xfea\xddGo\xfe4" +
+	"\xed\x80G\xdb\x04r\xc0\xb96R\xbc\xebR\x7f\xd6\xf8" +
+	"\xe8\xd0\xcfg\xfb1\xb8\xe9\x9d\xb6a\x94/\xb5\xd1s" +
+	"\x1f\xb4\xd1m\x7f\xe1\xbe\xfd\xa69<\xfcr\xbdp\xfe" +
+	"\xb5\xf7f\x05\x94\x8fe\x89\xfbH\xb6\x00\xf8\xe9\xd3\xf7" +
+	"\x1d\x1dzo\xed+J'f\xeay\x8fe\xf7\xa3|" +
+	"\x86x{\x1e\xcfv\x93Ec\x1b\xd6\xb1\xfbz\xbf\xb1" +
+	"h\x17\xca\x17\x17\xd1\xcf\xff\\\xe4\xb3\x0f\xdf\xf5\xbd\x87" +
+	"\x9b.~\xef\x95z\xa3\x8a\xbe\x05r\x16\xca\x97s\xf4" +
+	"\xf3\xb3\xdc\x13\x02\xa0\xf7\xdb\xb3\x7f\xca/\xaex\xf5\x02" +
+	"(_\xc1\x94\x1a\xe3(\xa2\x00\xd0s\xf1\x9a\x95d\xb2" +
+	"K\xd7\xec\x03\xf4:\x9f\xf9\xa3\xbf\xee/\xbf\xf3\x8b:" +
+	"\x8b\x90 \xf2F\xf9\x13\xf9N\x99~\x8d\xcb\xc4{\xdf" +
+	"\xd7\xa7\xf7o\xbaq\xe6\xad\x86\x069'\xcf\xa0|\xc1" +
+	"\xe7~\xd9\xe7\x16.\xaa\x1dw\xff\xeb7\xdeM\xc5\xe7" +
+	"\xaa\xfc\xaf\x102\xde\xa6-w\xedj\xfd\xf6{\xef\xa5" +
+	"\xe3sY\xde\xf7\xe3\x9f\xe4\xc9M\xe7\xa5\x87\xe5\x17\x1e" +
+	"\xff\xab\xf7\xe9!\xb1\xdeO\xdb\xf3[Q\xde\x93\xa7\x9f" +
+	"\xd5\xbc\xafo\x9c'\x8d\xa2H\xbb\xae\x17\xe5\xe9\xebH" +
+	".\xf7:\x92k\xd5\x8e>\xbe\xed\xb6;>\x04\xa9\x93" +
+	"\xcd\xca\xfa\xe7\x88\xf3e\xe2\xecy\xe9:\x11\xe5=\x8b" +
+	"E\x00\xef\xbb\x95\xad\x17>\x1ex\xfc\x7f\xea/\xf7\x15" +
+	"\xbasq/\xca\x1a\xf1\xf5\xf0\xc5\xbe\xabzn\xfd\xf3" +
+	"K\xc7\xffr\xe0\xe39\xb7\x9f\xeb\xe8G\xf9\xa5\x0e\x92" +
+	"\xe3\xc5\x8eo\xca\x97:\xfc\xcb\xbf\xb3v\xf3\xea\xa5/" +
+	"}\x92\xb6\xc4[\x1d\x9f\x90%>\xe8 KL\xdc\xf6" +
+	"\xdf\xdf\xbc\xf1\xbb\xff\xf4I\x9d{|\xc6\xd6\xce\x9bP" +
+	"\xee\xe8\xa4\x1b\xaf\xed,\x00~\xb4\xfe\x87ov\xe6:" +
+	"\x7f\xd3H\xd0\xd5\x9d\xbbP\xdeH\xbc=C\x9d\xbe\xa0" +
+	"w\xfc\xea\xe4\xbe\xc2\x0f~\xf3)\xe9\xc5\xea0m\xfa" +
+	"\xfa\xad(\x1f\xb9\x9en~\xe0zJ\x85\x0dg\xdf\xf9" +
+	"\xc6\xe4\xf1W?\xab7\x82\xef\x90UK\x0e\xa1<\xb4" +
+	"\x84\xb8\xd7-!d:\xf0\xd1\x89\xc1\x87\xb6\x9d\xfd<" +
+	"\xad\xd5\xf2\xae\xe7}\xffv\x91V\xbb\x8e\x1fp\x06\x1f" +
+	"9\xe25\x08\xba\x9e\xed]\xfd(W\xbb\xe86\xadk" +
+	"\x1f,\xf7\x1c\xd70\xb8n\xd52\xa5\xdf\x8b~\x96V" +
+	"\x94\xd4\x9aQ\xeb]7\xa5\xd9\x8efT\xc6|z\xa1" +
+	"h\xeaZi\xba\x88\xa8\xb4Q\xa0K]\xbd\x00\x88\xd2" +
+	"\xb5[\x01P\x90\xa4~\x80\x82V1L\x8b{e\xcd" +
+	".\x99\x86\xc1\x81\x95\x9c\x83;U]5J<~\xa8" +
+	"i\xeeC\x83\\\xd7\xcd\xdbMK/o\xb6\xb4\x8af" +
+	"\x0c\x98\xc6\x84V\x01(\"\xc6\xc7\xc4\xb9\xc7\x06t\x8d" +
+	"\x1b\xce(\xb7\xf6j%\xbe\xc2\xb5yp\xce\xb5TG" +
+	"3\x8d\x1bF\xb8\xed\xea\x8e\x0d\xa0dX\x06 \x83\x00" +
+	"R\xb6\x17@ia\xa8\xe4\x05,X>\x03\xb6'\x99" +
+	"\x07\x88\xed\x90\xbc\xd9<\xf7\xcd\xc0\x16\xf4&\xb7V\xb8" +
+	"\x86\xc5+\x9a\xedp+ \xdfP(\xaa\x96Z\xb5\xd3" +
+	"\x0f\x9e\x04P\xda\x19*K\x04\xf4*\x96Z\xe2En" +
+	"\xa1f\x967\xa9\x869\xcax\x09\x9b@\xc0\xa6\xd4\xa3" +
+	"\x0d\x1c\xb1^\xd5t^\x0e\xb4[Q\xea\xf6\xffW\xda" +
+	"Y\xa6\xcd\xf3\xfcG\xd4\xad\x00\xca\x0e\x86\x8a.`\x16" +
+	"?\xf7\xf2T\xfe$m?\x802\xc9Pq\x04\xcc\x0a" +
+	"\x97\xbd\xbc\xef\xb5=K\x01\x14\x9d\xa12%`\x96\xfd" +
+	"\xce\xcbS\x91\x91\xdc]\x00\x8a\xc3P\xb9[@\xcfv" +
+	"kdS\x1b\x98ia{\x12\xca\xa1ux\xb9B\x96" +
+	"6\xa0\xc0Kdhl\x8f\xd09`\x10\xcb\xe6$\xb6" +
+	"'\xc5'<f\xf1\xbd\xdc\xb2y\x11r\x9695\x8d" +
+	"\xed\x09J\xd7Y={\xb5V\x8f\x1c\x1d\x9f\x9a\xff\xbc" +
+	"\x1f\x9a%\xe7\x86b\xf7\x1cg\x91\x1d\xdb\x18*\x8b\x05" +
+	"\xf4j\xf4\x95;\x1c\x98ec{R\xd4\xeb\xa4m\x10" +
+	"\xce\x03\xf4\xef@\xf0J1\xbc\xc5\xb2\xfdpV\x16\xc7" +
+	"\x8f\x9d\xa0\xc7\x1ea\xa8\xfcH@\x091\xf0\xd9\xe3\x16" +
+	"\x80\xf2\x18C\xe5\xac\x80(\x04\x1e{\xea4\x80r\x96" +
+	"\xa1\xf2w\x02JL\x08\x1c\xf6\xdcM\x00\xca3\x0c\x95" +
+	"_\x0a(eX\x9e\x1a\x18\xe9\x02\x05\xdb/\x19*o" +
+	"\x0b(5e\xf2\xd8\x04 \xbd\xb5\x12@y\x9d\xa1\xf2" +
+	"\xae\x80\x9e\x19\xe4\x17)\xe5`\x16\x04\xcc\x02z%\xdd" +
+	"t\xcb\x13\xba\x0a\xdd\x16/\x0f\xad\x8d\xe9\x86[-Z" +
+	"|\xaf\x86\xa6k\xf79\x0e\xaf\x8a5\xc7\xc6f\x10\xb0" +
+	"\x190\xe7\xa8\x15\x1b\x17\x01\x16\x19b{R\xe8\x00\x89" +
+	"\x18\xdf\x89\x16/o\xe1\x96\xad1\xd3\xc06\x10\xb0\x0d" +
+	"\xb0\xdb.\x995\x8e\xedI\xed\xbc\xb2MG\xc2\xe8\xa1" +
+	"\xd8\x09\x13\xc1\xb44\xb1\xa2\x19J\x1b\xcb,\xf1\xbc\xd0" +
+	"\x80\xeb\xc8.k\x18*\x1b\x04\xec\xc2\xcf\x89L6\x1c" +
+	"\x1a\x01P\x06\x19*c\x02v\x09\x97\x89LVT\xc8" +
+	"\x07E\x86\xca6\x01s\x93\x8eS\xc3\xf6\xa4:\x86B" +
+	"\xed\xe3;m\xb3\xb4\x9b\x03\x12T\xc4P\x1d~\x9d\x0c" +
+	"\xa1\x0b\x98^\xc6\xf6\xa4\x93\xad\xd3\x885\x88\x12?@" +
+	"\x0a\xce:\xcb2-\x1fU\xe3\xd0X\xb72Q\"\x8a" +
+	"\x8c\xa1\xad\x89\x06\x92\xb0&PK\xd9\x99\xc8\xdf]R" +
+	"]\x9bG6\xf6,\xeeX\xd3}\x13\x0e0n\xc5\x18" +
+	"cO\x9a\xae^\x1e\xe1 :\xd64\"\x08\x88\xf3#" +
+	"\xcfZs0e\xf2 \x84Sr\x92Lk\x19*\xc5" +
+	"D\xce\x8dD\xdb\xc0P\xb9\x83\xe4\x0c\xcd?N\xe6\x1f" +
+	"c\xa8\xd4\x04\xf4t\xca]c\xd0\x04f;\xb1\xb8\x01" +
+	"\xb1h\xfa\x81)\x82\x80\"\xa0\xe7\xd6l\xc7\xe2j\x15" +
+	"0\x8e4\xe2_t\x15\x10]\x07\x15E5\xe7\xe7|" +
+	"c\x1d\xe24\xdc8\x9cV\"\xcc\xc3\xf1\xfe\xc4\xd8\x8d" +
+	"\x13i\xd2\xb4\x1dC\xadr\x00\x88\x14;h\xd6\x08#" +
+	"\x09A\xe26\xb3.6\xae\xbe\xb2\x05UfV];" +
+	"\x9d*3\xa5\xf04\xfa\xc7\x07LC\x9c\xd0*\xd8\x9e" +
+	"\xf4Zu\x024\xf0{\x9f\xebLr\xc3\xd1J\xfe\x83" +
+	"s\xfc\xbe4\x89\xcf\xd8fC+S\x86\x8cl\xb6q" +
+	"gbHq7\x9f\x8e!\x80WUM\x8f\xbd\x1fZ" +
+	"\xb3\x0f\xc4o%<\xf3%\xcf(!\x88/\x95o\x03" +
+	"Lu\xe5Rv%\x08\xdd{U\xdd\xe5\xf367a" +
+	"\x15\x0bjX!00]\x98\x8f\xd5\xfc\xf6\x0c\x80r" +
+	"7C\xe5\xc1\x94\x9a\x0f<\x0c\xa0<\xc8Py$\xa5" +
+	"\xe6q\x0a\x8d\xa3\x0c\x95S\x04\xd1,\x00\x97\x13\xe4\x93" +
+	"S\x0c\x95'\x05\xc4L\x80\xd0g\x08\xa1\x9fd\xa8\x9c" +
+	"\x17||\x1d\xec\x1b0\x0d\x0c\x85\xb0\x01\"t\xf5&" +
+	"\xb9j9;\xb9\x8a\xce\x90\xe1pk\xaf\x8az\x94\xc5" +
+	"\x07\x1d\xad\xcaM\xd7\x89\xb3\xba\xaaN\xf9\x1d\x02\x96\x07" +
+	"\x83S\xa2\xea\xd8\xd8\x0a\x02\xb6R\x12\xd9\xdc\x1a\xb0x" +
+	"\x19\xc9\x9f\xaa^T\x9939\xc7\xc4\x99+!n\xae" +
+	"\x81y\xa8\xbf8\xc0P\xb9\x9f\xb2\x1fS\x83\xacto" +
+	"/\x08~\xf2\x93\xce\xd5\xfe\xa4\x0f\xf1\xeb\x17U\xa5=" +
+	"\x0f'\x0d\x87_\xbf\x9a\xe9\xc6\x93\x89\xc1C\xd1\x06M" +
+	"(\x04I\x15\xc9\\\x08\x82\xe5 \x01\x9c\xc6\x13=\xc3" +
+	"\xb2\xae\xa1i\x8c\xf9\x06\xc2\xc4B%\xb3Z\xb3\xb8m" +
+	"\xa3f\x1a\x8a\xab\xea\x1as\xa6\xe3\x83\xf3\xda\x80\xd0#" +
+	"\xc8\xba\xcd\xb5n\xdfId\x84[\"#\xc8}8\x0c" +
+	"0\xba\x06\x19\x8en\xc0$L\xe4!\xec\x07\x18]K" +
+	"\xf4\"&\x91\"o\xc4N\x80\xd1A\xa2\x8f\xa1\x80\x18" +
+	"\xc4\x8a\xac\xe0\xd3\x00\xa3cD\xde\x81IE\x97\xb7\xfb" +
+	"\xd7o#\xfa$&E]\xe6x\x13\xc0\xe8\x0e\xa2\x1f" +
+	" z\xb3\xe0[P\x9e\xc6]\x00\xa3SD?Lt" +
+	"\xb1)O\xf3\x81|\x0fZ\x00\xa3w\x13\xfdA\xa2\xb7" +
+	",\xcec\x0b\xcd\x1f>\xfd~\xa2\x7f\x9f\xe8\xad\x1dy" +
+	"l\x05\x90\x8f\xe1!\x80\xd1\xa3D?E\xf4\x05\x98\xc7" +
+	"\x05\x00\xf2\x09<\x090z\x8a\xe8O\x12}as\x1e" +
+	"\x17\x02\xc8g|y\x1e#\xfaY\x8c!h\xa8\x9cF" +
+	"B\x0a'-\xe9\x02\x98i\xc7a\xc8\xc3I\x03\x03\x98" +
+	".\x9a9\x1a50\x97\xec\x90\x001\x07\xe8\xd5LS" +
+	"\xdf4\x1ba\xaf\xd4\x88\x84a\x019\xd3\x18*\xc7\xf9" +
+	"\x15\x04\xd1\x06\x13\xbaK\xaa>T\x8b%\xd1\xec>\xd7" +
+	"1\xdd\x1at\x97U\x87\x97\xe3\x1ai\xb9\xc6z\xcb\xac" +
+	"\x8e!\xb7\xaa\x9a\xa1\xea\x10\x7f\x99/\xb6r\xae\xab\x95" +
+	"\xbf4\x9e\xad\x08PKiI:\xfbeT\x9d\xbe\xc6" +
+	"P\xf9\xfdtg\x7f+A\xed\xcd\x0c\x95\xdb\xa8[\x9f" +
+	"\xb6\x1d^\xdd\xa4\x02Kr\xa4\xbbb\x99nm\xce\xc3" +
+	"B\xfd\xc3\xdd\xb5\xde1\xd5O\xeb\x968\xad\x97Q\x07" +
+	"u\x03C\xe5\x96\x14\xea-_\x99\xc8\x91Kgc " +
+	"\xf2\x9c\x97\x1atp\xe3uU,\xe8\xda\x83\xd2\x92z" +
+	"\xbd?y=~\xdc\x0a\xd5\x1d\x14\xf0\xa0\xed\x96Jd" +
+	"\xed\xc8\xfc\x13\xe1l\x04\xddtw*\x10\xe2\xb5E\x18" +
+	"\x08_\xb6c\xa8p'\xf85dL\x98TjE\xb5" +
+	"j\xff\x1fO\x8fp;G\xa3\xc9\x15'\xd0x\x11q" +
+	"\xe5\xd2<86VL\xc6d\x16\xa0r\x1a\x90F\xd2" +
+	"\x80\x94\xe0\xd1\xae4\xeeD\x1d\xa4\xac\xf8\x00P$\xfa" +
+	"6L\xe6\x0b\xf9N<=\x0bx2}\x01 q\xff" +
+	"\xfa2\xd1k> a\x00HU\xff~\x9d\xe8Si" +
+	"@rqf6 \xb1\x08\x90\x08H\x0e\x13\xfd\xa8\x0f" +
+	"H\x99\x00\x90\x8e\xe0\xb3\xb3\x80\xa7\xb5)\x00\xa4\x13\xf8" +
+	"\xfc,\xe0Y\xd0\x1c\x00\xd2\x19\x9f\xffI\xa2\x9f\xf7\x01" +
+	"\xa9?\x00\xa4s>\x80=C\xf4\x17\x08\x90\\K\x1f" +
+	"u,\xcd\x00\xac$\xc1Z\xaa}\x8b\xf3Z\x1f\xe4t" +
+	"m/\x8f\x8bEYS\xf5\xb5\xae\xaaC\xf7\xa8\xa3\x96" +
+	"v'm\xb2n\x0f\xaaF\xd9\xc6Iu7\xa7\x12#" +
+	"\xa6\x8b\xb0\xa3\xdb[\xb8\xa5M\x00&\x8du\xdc\xd6\xe4" +
+	"\x8a\xa6Y\xdf\xed\xf8\xfd\x19\xb7\x024\x8b\xbfU\xd5\xa9" +
+	"\xa1\xb2\xce\x070jM\x98\x91\x948\x8d\xbe\x98\x86\x81" +
+	"A\xbf0\xa6u\xcfn\x04ja\xab\x1e5\x14c\x85" +
+	"\xbaN\x81O\xd5x\xc9\x190\xd1p4\xc3\xe5s." +
+	"(M\xba\xc6n^^\x87F\xc9,kF\x05\xe6\xcc" +
+	"\x08\xec\x8b\xb6\x13\xa9\x0e\xaa%l\xc9\xe2u\xbb\xb4\x8c" +
+	"\xfa\x01\x0c\xfb\x01\xa97\x99\xb2\x0b%\xffT\xc1\xe2\xaa" +
+	"\x9d\x94\x86\xf9^\x0b\x97QA\x92\xd1k\xed\xac\x09 " +
+	"^^c\xb4\xf3\x93\xf6\xec\x07A\xd2DLV\xa5\x18" +
+	"mF\xa5\xed\x16\x08\xd2\xb8\x88B\xfc7\x03\x8c\xf6\xfd" +
+	"\xd2\xd0\x0c\x08\xd2:\x11Y\xbc\xe8\xc7h\xe3&\xad\xee" +
+	"\x07AZ.z\xd1T\x01\x85@\x9c5\xe8E\x89\x0f" +
+	"\xdd~\xea\xafA/\xdaS`4}\x00\xac\xc1\x83a" +
+	"=Z\x83\xe9\xe5\x16\xfb\xa2\x11\xa0q_J\x189\xc5" +
+	"P9\x9c`\xe4=\xd4\xab\x1ef\xa8\x1cM\x8d]G" +
+	"\x9eN\xb7\xa5\xe1\xe6\xe0\xc4\xa1p\xefp>\xb598" +
+	"G\xbd\xeay\x86\xca\xebBR\xa8\xa3\xb0\x8b\xf6Ah" +
+	"Z\xd1\x1c8\xcfZ(\x0c\xce\xb0e\xac_\x0eye" +
+	"s\xd2o)1\xb8\xca\x86\x04\xb1\xd3\x1b\xa3E\xa9\x8d" +
+	"\x11F\x13\xa88\x0b\xe0\xd3\xfb\xa3E\xf3c\xe6\xacy" +
+	"*\x1c\x1b(j\xa2\xbfh`\xf4\xb7%I\"\xefg" +
+	"E/\x9a\xb90*W\xe4\xbc\xb4\xcb\xaer\xf0\x1c\xe1" +
+	"\xdd\xf6\x97\xa9\x04\xd1\x96\xf9\xca\xfb\x83\xe0\x9d\x1c\x05[" +
+	"<\x07\x05\xf7\xeeJm\xb1t3\x1c\xe1r\x9bRU" +
+	"{>[\x05\x02G\x9do\x8e\x0e\xd7\x85\xdf\xd2$\xfc" +
+	"\xe2\x06\xe1\x9e\xa5\xc90\x10\x8fE\xf7\x0e\x87A\xf9X" +
+	"\xdc\xe9J\x8f\xce$\x1b\xae8\xfc\x9e\x1aN\xc6\"\x91" +
+	"[V$\xa7\xe8Z\x09l\xeafe\x83fp\x9bz" +
+	"\xbf\xbam@\x8d[U\xd5\xe0\x06:\x04F\xaeE\x88" +
+	":\x1b\xb9\x86\xd6\xa6Z\xc6\xf9\xd4\x1f\x0d\x83=\x88\xf5" +
+	"\xb0\xbc\xa6F\xdf\xd3\xa95L\xa4\xbc\xf2|\xb8\xde\xd8" +
+	"\x91R~;\x8d\xbe\xdb\x18*\x93\x02z\xaa\xeb\x98\xe3" +
+	"\xb5\xb2\x8a\x0e_o\xf1=.\x17\x8d\xd2t2\xc0\xd1" +
+	"(S\xb2\xc7\xb1FM\xe7z\x8b\x17\xf6\xb8<\xcd\x10" +
+	"-\x8eA\xd4\xcc\xf2\x9c\x8dq\x83f\xebv\xbes\xd4" +
+	",\xed\xe6\xce\xac\x85z\x00\x97\x91*\xeaH\xb25\x8e" +
+	"4\xd1FR\xb3Z\x04#{(\xa0j\x0c\x95\x03)" +
+	"\x18\x99\x9eI\x1c\xde\xb8\xba\xfe\xff\x14\xc4y\x94l\xb8" +
+	"\xd5\x1d)\xf0/\x95h\xc9_I\xae\xdcr\x85{\x82" +
+	"\xb0c\xadkX\x976j\x97\xb7&\x0d\xba\x1f\xcf\xed" +
+	"\xc9_n\xc3\xe7\xec\xb0K\x046a\xcem\x00\xff7" +
+	"\x00\x00\xff\xff\xfd\xa0l\x0d"

 func init() {
 	schemas.Register(schema_db8274f9144abc7e,
@@ -3738,9 +3914,11 @@ func init() {
 		0xb70431c0dc014915,
 		0xb9d4ef45c2b5fc5b,
 		0xc082ef6e0d42ed1d,
+		0xc54a4a6fd4d87596,
 		0xc744e349009087aa,
 		0xc766a92976e389c4,
 		0xc793e50592935b4a,
+		0xc9c82ee56583acfa,
 		0xcbd96442ae3bb01a,
 		0xd58a254e7a792b87,
 		0xdc3ed6801961e502,
@@ -1,6 +1,7 @@
 package validation

 import (
+	"context"
 	"fmt"
 	"net"
 	"net/url"
@@ -9,15 +10,21 @@ import (

 	"net/http"

+	"github.com/coreos/go-oidc"
 	"github.com/pkg/errors"
 	"golang.org/x/net/idna"
 )

-const defaultScheme = "http"
+const (
+	defaultScheme   = "http"
+	accessDomain    = "cloudflareaccess.com"
+	accessCertPath  = "/cdn-cgi/access/certs"
+	accessJwtHeader = "Cf-access-jwt-assertion"
+)

 var (
 	supportedProtocols = []string{"http", "https", "rdp"}
-	validationTimeout = time.Duration(30 * time.Second)
+	validationTimeout  = time.Duration(30 * time.Second)
 )

 func ValidateHostname(hostname string) (string, error) {
@@ -197,3 +204,50 @@ func toggleProtocol(httpProtocol string) string {
 		return httpProtocol
 	}
 }
+
+// Access checks if a JWT from Cloudflare Access is valid.
+type Access struct {
+	verifier *oidc.IDTokenVerifier
+}
+
+func NewAccessValidator(ctx context.Context, domain, issuer, applicationAUD string) (*Access, error) {
+	domainURL, err := ValidateUrl(domain)
+	if err != nil {
+		return nil, err
+	}
+
+	issuerURL, err := ValidateUrl(issuer)
+	if err != nil {
+		return nil, err
+	}
+
+	// An issuerURL from Cloudflare Access will always use HTTPS.
+	issuerURL = strings.Replace(issuerURL, "http:", "https:", 1)
+
+	keySet := oidc.NewRemoteKeySet(ctx, domainURL+accessCertPath)
+	return &Access{oidc.NewVerifier(issuerURL, keySet, &oidc.Config{ClientID: applicationAUD})}, nil
+}
+
+func (a *Access) Validate(ctx context.Context, jwt string) error {
+	token, err := a.verifier.Verify(ctx, jwt)
+
+	if err != nil {
+		return errors.Wrapf(err, "token is invalid: %s", jwt)
+	}
+
+	// Perform extra sanity checks, just to be safe.
+
+	if token == nil {
+		return fmt.Errorf("token is nil: %s", jwt)
+	}
+
+	if !strings.HasSuffix(token.Issuer, accessDomain) {
+		return fmt.Errorf("token has non-cloudflare issuer of %s: %s", token.Issuer, jwt)
+	}
+
+	return nil
+}
+
+func (a *Access) ValidateRequest(ctx context.Context, r *http.Request) error {
+	return a.Validate(ctx, r.Header.Get(accessJwtHeader))
+}
@@ -180,33 +180,6 @@ func TestValidateHTTPService_HTTP2HTTP(t *testing.T) {
 		}
 		panic("Shouldn't reach here")
 	})))
-
-	// Integration-style test with a mock server
-	server, client, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Equal(t, hostname, r.Host)
-		w.WriteHeader(200)
-	}))
-	assert.NoError(t, err)
-	defer server.Close()
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, client.Transport))
-
-	// this will fail if the client follows the 302
-	redirectServer, redirectClient, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/followedRedirect" {
-			t.Fatal("shouldn't have followed the 302")
-		}
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:443", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.Header().Set("Location", "/followedRedirect")
-		w.WriteHeader(302)
-	}))
-	assert.NoError(t, err)
-	defer redirectServer.Close()
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
-
 }

 // Happy path 2: originURL is HTTPS, and HTTPS connections work
@@ -235,36 +208,6 @@ func TestValidateHTTPService_HTTPS2HTTPS(t *testing.T) {
 		}
 		panic("Shouldn't reach here")
 	})))
-
-	// Integration-style test with a mock server
-	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:443", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.WriteHeader(200)
-	}))
-	assert.NoError(t, err)
-	defer server.Close()
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, client.Transport))
-
-	// this will fail if the client follows the 302
-	redirectServer, redirectClient, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/followedRedirect" {
-			t.Fatal("shouldn't have followed the 302")
-		}
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:443", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.Header().Set("Location", "/followedRedirect")
-		w.WriteHeader(302)
-	}))
-	assert.NoError(t, err)
-	defer redirectServer.Close()
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
 }

 // Error path 1: originURL is HTTPS, but HTTP connections work
@@ -293,37 +236,6 @@ func TestValidateHTTPService_HTTPS2HTTP(t *testing.T) {
 		}
 		panic("Shouldn't reach here")
 	})))
-
-	// Integration-style test with a mock server
-	server, client, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:1234", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.WriteHeader(200)
-	}))
-	assert.NoError(t, err)
-	defer server.Close()
-	assert.Error(t, ValidateHTTPService(originURL, hostname, client.Transport))
-
-	// this will fail if the client follows the 302
-	redirectServer, redirectClient, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/followedRedirect" {
-			t.Fatal("shouldn't have followed the 302")
-		}
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:1234", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.Header().Set("Location", "/followedRedirect")
-		w.WriteHeader(302)
-	}))
-	assert.NoError(t, err)
-	defer redirectServer.Close()
-	assert.Error(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
-
 }

 // Error path 2: originURL is HTTP, but HTTPS connections work
@@ -352,21 +264,11 @@ func TestValidateHTTPService_HTTP2HTTPS(t *testing.T) {
 		}
 		panic("Shouldn't reach here")
 	})))
+}

-	// Integration-style test with a mock server
-	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:1234", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.WriteHeader(200)
-	}))
-	assert.NoError(t, err)
-	defer server.Close()
-	assert.Error(t, ValidateHTTPService(originURL, hostname, client.Transport))
-
-	// this will fail if the client follows the 302
+// Ensure the client does not follow 302 responses
+func TestValidateHTTPService_NoFollowRedirects(t *testing.T) {
+	hostname := "example.com"
 	redirectServer, redirectClient, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/followedRedirect" {
 			t.Fatal("shouldn't have followed the 302")
@@ -381,12 +283,12 @@ func TestValidateHTTPService_HTTP2HTTPS(t *testing.T) {
 	}))
 	assert.NoError(t, err)
 	defer redirectServer.Close()
-	assert.Error(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
+	assert.NoError(t, ValidateHTTPService(redirectServer.URL, hostname, redirectClient.Transport))
 }

-// error path 3: origin URL is nonresponsive
+// Ensure validation times out when origin URL is nonresponsive
 func TestValidateHTTPService_NonResponsiveOrigin(t *testing.T) {
-	originURL := "https://127.0.0.1/"
+	originURL := "http://127.0.0.1/"
 	hostname := "example.com"
 	oldValidationTimeout := validationTimeout
 	defer func() {
@@ -394,7 +296,10 @@ func TestValidateHTTPService_NonResponsiveOrigin(t *testing.T) {
 	}()
 	validationTimeout = 500 * time.Millisecond

-	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	// Use createMockServerAndClient, not createSecureMockServerAndClient.
+	// The latter will bail with HTTP 400 immediately on an http:// request,
+	// which defeats the purpose of a 'nonresponsive origin' test.
+	server, client, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "CONNECT" {
 			assert.Equal(t, "127.0.0.1:443", r.Host)
 		} else {
@@ -409,11 +314,45 @@ func TestValidateHTTPService_NonResponsiveOrigin(t *testing.T) {
 	defer server.Close()

 	err = ValidateHTTPService(originURL, hostname, client.Transport)
+	fmt.Println(err)
 	if err, ok := err.(net.Error); assert.True(t, ok) {
 		assert.True(t, err.Timeout())
 	}
 }

+func TestNewAccessValidatorOk(t *testing.T) {
+	ctx := context.Background()
+	url := "test.cloudflareaccess.com"
+	access, err := NewAccessValidator(ctx, url, url, "")
+
+	assert.NoError(t, err)
+	assert.NotNil(t, access)
+
+	assert.Error(t, access.Validate(ctx, ""))
+	assert.Error(t, access.Validate(ctx, "invalid"))
+
+	req := httptest.NewRequest("GET", "https://test.cloudflareaccess.com", nil)
+	req.Header.Set(accessJwtHeader, "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c")
+	assert.Error(t, access.ValidateRequest(ctx, req))
+}
+
+func TestNewAccessValidatorErr(t *testing.T) {
+	ctx := context.Background()
+
+	urls := []string{
+		"",
+		"tcp://test.cloudflareaccess.com",
+		"wss://cloudflarenone.com",
+	}
+
+	for _, url := range urls {
+		access, err := NewAccessValidator(ctx, url, url, "")
+
+		assert.Error(t, err, url)
+		assert.Nil(t, access)
+	}
+}
+
 type testRoundTripper func(req *http.Request) (*http.Response, error)

 func (f testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
@@ -1,4 +1,5 @@
-Apache License
+
+                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

@@ -178,7 +179,7 @@ Apache License
   APPENDIX: How to apply the Apache License to your work.

      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
+      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
@@ -186,7 +187,7 @@ Apache License
      same "printed page" as the copyright notice for easier
      identification within third-party archives.

-   Copyright {yyyy} {name of copyright owner}
+   Copyright [yyyy] [name of copyright owner]

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
@@ -0,0 +1,277 @@
+// Copyright 2016 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package civil implements types for civil time, a time-zone-independent
+// representation of time that follows the rules of the proleptic
+// Gregorian calendar with exactly 24-hour days, 60-minute hours, and 60-second
+// minutes.
+//
+// Because they lack location information, these types do not represent unique
+// moments or intervals of time. Use time.Time for that purpose.
+package civil
+
+import (
+	"fmt"
+	"time"
+)
+
+// A Date represents a date (year, month, day).
+//
+// This type does not include location information, and therefore does not
+// describe a unique 24-hour timespan.
+type Date struct {
+	Year  int        // Year (e.g., 2014).
+	Month time.Month // Month of the year (January = 1, ...).
+	Day   int        // Day of the month, starting at 1.
+}
+
+// DateOf returns the Date in which a time occurs in that time's location.
+func DateOf(t time.Time) Date {
+	var d Date
+	d.Year, d.Month, d.Day = t.Date()
+	return d
+}
+
+// ParseDate parses a string in RFC3339 full-date format and returns the date value it represents.
+func ParseDate(s string) (Date, error) {
+	t, err := time.Parse("2006-01-02", s)
+	if err != nil {
+		return Date{}, err
+	}
+	return DateOf(t), nil
+}
+
+// String returns the date in RFC3339 full-date format.
+func (d Date) String() string {
+	return fmt.Sprintf("%04d-%02d-%02d", d.Year, d.Month, d.Day)
+}
+
+// IsValid reports whether the date is valid.
+func (d Date) IsValid() bool {
+	return DateOf(d.In(time.UTC)) == d
+}
+
+// In returns the time corresponding to time 00:00:00 of the date in the location.
+//
+// In is always consistent with time.Date, even when time.Date returns a time
+// on a different day. For example, if loc is America/Indiana/Vincennes, then both
+//     time.Date(1955, time.May, 1, 0, 0, 0, 0, loc)
+// and
+//     civil.Date{Year: 1955, Month: time.May, Day: 1}.In(loc)
+// return 23:00:00 on April 30, 1955.
+//
+// In panics if loc is nil.
+func (d Date) In(loc *time.Location) time.Time {
+	return time.Date(d.Year, d.Month, d.Day, 0, 0, 0, 0, loc)
+}
+
+// AddDays returns the date that is n days in the future.
+// n can also be negative to go into the past.
+func (d Date) AddDays(n int) Date {
+	return DateOf(d.In(time.UTC).AddDate(0, 0, n))
+}
+
+// DaysSince returns the signed number of days between the date and s, not including the end day.
+// This is the inverse operation to AddDays.
+func (d Date) DaysSince(s Date) (days int) {
+	// We convert to Unix time so we do not have to worry about leap seconds:
+	// Unix time increases by exactly 86400 seconds per day.
+	deltaUnix := d.In(time.UTC).Unix() - s.In(time.UTC).Unix()
+	return int(deltaUnix / 86400)
+}
+
+// Before reports whether d1 occurs before d2.
+func (d1 Date) Before(d2 Date) bool {
+	if d1.Year != d2.Year {
+		return d1.Year < d2.Year
+	}
+	if d1.Month != d2.Month {
+		return d1.Month < d2.Month
+	}
+	return d1.Day < d2.Day
+}
+
+// After reports whether d1 occurs after d2.
+func (d1 Date) After(d2 Date) bool {
+	return d2.Before(d1)
+}
+
+// MarshalText implements the encoding.TextMarshaler interface.
+// The output is the result of d.String().
+func (d Date) MarshalText() ([]byte, error) {
+	return []byte(d.String()), nil
+}
+
+// UnmarshalText implements the encoding.TextUnmarshaler interface.
+// The date is expected to be a string in a format accepted by ParseDate.
+func (d *Date) UnmarshalText(data []byte) error {
+	var err error
+	*d, err = ParseDate(string(data))
+	return err
+}
+
+// A Time represents a time with nanosecond precision.
+//
+// This type does not include location information, and therefore does not
+// describe a unique moment in time.
+//
+// This type exists to represent the TIME type in storage-based APIs like BigQuery.
+// Most operations on Times are unlikely to be meaningful. Prefer the DateTime type.
+type Time struct {
+	Hour       int // The hour of the day in 24-hour format; range [0-23]
+	Minute     int // The minute of the hour; range [0-59]
+	Second     int // The second of the minute; range [0-59]
+	Nanosecond int // The nanosecond of the second; range [0-999999999]
+}
+
+// TimeOf returns the Time representing the time of day in which a time occurs
+// in that time's location. It ignores the date.
+func TimeOf(t time.Time) Time {
+	var tm Time
+	tm.Hour, tm.Minute, tm.Second = t.Clock()
+	tm.Nanosecond = t.Nanosecond()
+	return tm
+}
+
+// ParseTime parses a string and returns the time value it represents.
+// ParseTime accepts an extended form of the RFC3339 partial-time format. After
+// the HH:MM:SS part of the string, an optional fractional part may appear,
+// consisting of a decimal point followed by one to nine decimal digits.
+// (RFC3339 admits only one digit after the decimal point).
+func ParseTime(s string) (Time, error) {
+	t, err := time.Parse("15:04:05.999999999", s)
+	if err != nil {
+		return Time{}, err
+	}
+	return TimeOf(t), nil
+}
+
+// String returns the date in the format described in ParseTime. If Nanoseconds
+// is zero, no fractional part will be generated. Otherwise, the result will
+// end with a fractional part consisting of a decimal point and nine digits.
+func (t Time) String() string {
+	s := fmt.Sprintf("%02d:%02d:%02d", t.Hour, t.Minute, t.Second)
+	if t.Nanosecond == 0 {
+		return s
+	}
+	return s + fmt.Sprintf(".%09d", t.Nanosecond)
+}
+
+// IsValid reports whether the time is valid.
+func (t Time) IsValid() bool {
+	// Construct a non-zero time.
+	tm := time.Date(2, 2, 2, t.Hour, t.Minute, t.Second, t.Nanosecond, time.UTC)
+	return TimeOf(tm) == t
+}
+
+// MarshalText implements the encoding.TextMarshaler interface.
+// The output is the result of t.String().
+func (t Time) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+// UnmarshalText implements the encoding.TextUnmarshaler interface.
+// The time is expected to be a string in a format accepted by ParseTime.
+func (t *Time) UnmarshalText(data []byte) error {
+	var err error
+	*t, err = ParseTime(string(data))
+	return err
+}
+
+// A DateTime represents a date and time.
+//
+// This type does not include location information, and therefore does not
+// describe a unique moment in time.
+type DateTime struct {
+	Date Date
+	Time Time
+}
+
+// Note: We deliberately do not embed Date into DateTime, to avoid promoting AddDays and Sub.
+
+// DateTimeOf returns the DateTime in which a time occurs in that time's location.
+func DateTimeOf(t time.Time) DateTime {
+	return DateTime{
+		Date: DateOf(t),
+		Time: TimeOf(t),
+	}
+}
+
+// ParseDateTime parses a string and returns the DateTime it represents.
+// ParseDateTime accepts a variant of the RFC3339 date-time format that omits
+// the time offset but includes an optional fractional time, as described in
+// ParseTime. Informally, the accepted format is
+//     YYYY-MM-DDTHH:MM:SS[.FFFFFFFFF]
+// where the 'T' may be a lower-case 't'.
+func ParseDateTime(s string) (DateTime, error) {
+	t, err := time.Parse("2006-01-02T15:04:05.999999999", s)
+	if err != nil {
+		t, err = time.Parse("2006-01-02t15:04:05.999999999", s)
+		if err != nil {
+			return DateTime{}, err
+		}
+	}
+	return DateTimeOf(t), nil
+}
+
+// String returns the date in the format described in ParseDate.
+func (dt DateTime) String() string {
+	return dt.Date.String() + "T" + dt.Time.String()
+}
+
+// IsValid reports whether the datetime is valid.
+func (dt DateTime) IsValid() bool {
+	return dt.Date.IsValid() && dt.Time.IsValid()
+}
+
+// In returns the time corresponding to the DateTime in the given location.
+//
+// If the time is missing or ambigous at the location, In returns the same
+// result as time.Date. For example, if loc is America/Indiana/Vincennes, then
+// both
+//     time.Date(1955, time.May, 1, 0, 30, 0, 0, loc)
+// and
+//     civil.DateTime{
+//         civil.Date{Year: 1955, Month: time.May, Day: 1}},
+//         civil.Time{Minute: 30}}.In(loc)
+// return 23:30:00 on April 30, 1955.
+//
+// In panics if loc is nil.
+func (dt DateTime) In(loc *time.Location) time.Time {
+	return time.Date(dt.Date.Year, dt.Date.Month, dt.Date.Day, dt.Time.Hour, dt.Time.Minute, dt.Time.Second, dt.Time.Nanosecond, loc)
+}
+
+// Before reports whether dt1 occurs before dt2.
+func (dt1 DateTime) Before(dt2 DateTime) bool {
+	return dt1.In(time.UTC).Before(dt2.In(time.UTC))
+}
+
+// After reports whether dt1 occurs after dt2.
+func (dt1 DateTime) After(dt2 DateTime) bool {
+	return dt2.Before(dt1)
+}
+
+// MarshalText implements the encoding.TextMarshaler interface.
+// The output is the result of dt.String().
+func (dt DateTime) MarshalText() ([]byte, error) {
+	return []byte(dt.String()), nil
+}
+
+// UnmarshalText implements the encoding.TextUnmarshaler interface.
+// The datetime is expected to be a string in a format accepted by ParseDateTime
+func (dt *DateTime) UnmarshalText(data []byte) error {
+	var err error
+	*dt, err = ParseDateTime(string(data))
+	return err
+}
@@ -0,0 +1,3 @@
+/examples/blog/blog
+/examples/orders/orders
+/examples/basic/basic
@@ -0,0 +1,25 @@
+language: go
+
+go_import_path: github.com/DATA-DOG/go-sqlmock
+
+go:
+  - 1.2.x
+  - 1.3.x
+  - 1.4 # has no cover tool for latest releases
+  - 1.5.x
+  - 1.6.x
+  - 1.7.x
+  - 1.8.x
+  - 1.9.x
+  - 1.10.x
+  - 1.11.x
+
+sudo: false
+
+script:
+  - go vet
+  - test -z "$(go fmt ./...)" # fail if not formatted properly
+  - go test -race -coverprofile=coverage.txt -covermode=atomic
+
+after_success:
+  - bash <(curl -s https://codecov.io/bash)
@@ -0,0 +1,28 @@
+The three clause BSD license (http://en.wikipedia.org/wiki/BSD_licenses)
+
+Copyright (c) 2013-2019, DATA-DOG team
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+* The name DataDog.lt may not be used to endorse or promote products
+  derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL MICHAEL BOSTOCK BE LIABLE FOR ANY DIRECT,
+INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@@ -0,0 +1,259 @@
+[![Build Status](https://travis-ci.org/DATA-DOG/go-sqlmock.svg)](https://travis-ci.org/DATA-DOG/go-sqlmock)
+[![GoDoc](https://godoc.org/github.com/DATA-DOG/go-sqlmock?status.svg)](https://godoc.org/github.com/DATA-DOG/go-sqlmock)
+[![Go Report Card](https://goreportcard.com/badge/github.com/DATA-DOG/go-sqlmock)](https://goreportcard.com/report/github.com/DATA-DOG/go-sqlmock)
+[![codecov.io](https://codecov.io/github/DATA-DOG/go-sqlmock/branch/master/graph/badge.svg)](https://codecov.io/github/DATA-DOG/go-sqlmock)
+
+# Sql driver mock for Golang
+
+**sqlmock** is a mock library implementing [sql/driver](https://godoc.org/database/sql/driver). Which has one and only
+purpose - to simulate any **sql** driver behavior in tests, without needing a real database connection. It helps to
+maintain correct **TDD** workflow.
+
+- this library is now complete and stable. (you may not find new changes for this reason)
+- supports concurrency and multiple connections.
+- supports **go1.8** Context related feature mocking and Named sql parameters.
+- does not require any modifications to your source code.
+- the driver allows to mock any sql driver method behavior.
+- has strict by default expectation order matching.
+- has no third party dependencies.
+
+**NOTE:** in **v1.2.0** **sqlmock.Rows** has changed to struct from interface, if you were using any type references to that
+interface, you will need to switch it to a pointer struct type. Also, **sqlmock.Rows** were used to implement **driver.Rows**
+interface, which was not required or useful for mocking and was removed. Hope it will not cause issues.
+
+## Install
+
+    go get github.com/DATA-DOG/go-sqlmock
+
+## Documentation and Examples
+
+Visit [godoc](http://godoc.org/github.com/DATA-DOG/go-sqlmock) for general examples and public api reference.
+See **.travis.yml** for supported **go** versions.
+Different use case, is to functionally test with a real database - [go-txdb](https://github.com/DATA-DOG/go-txdb)
+all database related actions are isolated within a single transaction so the database can remain in the same state.
+
+See implementation examples:
+
+- [blog API server](https://github.com/DATA-DOG/go-sqlmock/tree/master/examples/blog)
+- [the same orders example](https://github.com/DATA-DOG/go-sqlmock/tree/master/examples/orders)
+
+### Something you may want to test, assuming you use the [go-mysql-driver](https://github.com/go-sql-driver/mysql)
+
+``` go
+package main
+
+import (
+	"database/sql"
+
+	_ "github.com/go-sql-driver/mysql"
+)
+
+func recordStats(db *sql.DB, userID, productID int64) (err error) {
+	tx, err := db.Begin()
+	if err != nil {
+		return
+	}
+
+	defer func() {
+		switch err {
+		case nil:
+			err = tx.Commit()
+		default:
+			tx.Rollback()
+		}
+	}()
+
+	if _, err = tx.Exec("UPDATE products SET views = views + 1"); err != nil {
+		return
+	}
+	if _, err = tx.Exec("INSERT INTO product_viewers (user_id, product_id) VALUES (?, ?)", userID, productID); err != nil {
+		return
+	}
+	return
+}
+
+func main() {
+	// @NOTE: the real connection is not required for tests
+	db, err := sql.Open("mysql", "root@/blog")
+	if err != nil {
+		panic(err)
+	}
+	defer db.Close()
+
+	if err = recordStats(db, 1 /*some user id*/, 5 /*some product id*/); err != nil {
+		panic(err)
+	}
+}
+```
+
+### Tests with sqlmock
+
+``` go
+package main
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+)
+
+// a successful case
+func TestShouldUpdateStats(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("an error '%s' was not expected when opening a stub database connection", err)
+	}
+	defer db.Close()
+
+	mock.ExpectBegin()
+	mock.ExpectExec("UPDATE products").WillReturnResult(sqlmock.NewResult(1, 1))
+	mock.ExpectExec("INSERT INTO product_viewers").WithArgs(2, 3).WillReturnResult(sqlmock.NewResult(1, 1))
+	mock.ExpectCommit()
+
+	// now we execute our method
+	if err = recordStats(db, 2, 3); err != nil {
+		t.Errorf("error was not expected while updating stats: %s", err)
+	}
+
+	// we make sure that all expectations were met
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("there were unfulfilled expectations: %s", err)
+	}
+}
+
+// a failing test case
+func TestShouldRollbackStatUpdatesOnFailure(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("an error '%s' was not expected when opening a stub database connection", err)
+	}
+	defer db.Close()
+
+	mock.ExpectBegin()
+	mock.ExpectExec("UPDATE products").WillReturnResult(sqlmock.NewResult(1, 1))
+	mock.ExpectExec("INSERT INTO product_viewers").
+		WithArgs(2, 3).
+		WillReturnError(fmt.Errorf("some error"))
+	mock.ExpectRollback()
+
+	// now we execute our method
+	if err = recordStats(db, 2, 3); err == nil {
+		t.Errorf("was expecting an error, but there was none")
+	}
+
+	// we make sure that all expectations were met
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("there were unfulfilled expectations: %s", err)
+	}
+}
+```
+
+## Customize SQL query matching
+
+There were plenty of requests from users regarding SQL query string validation or different matching option.
+We have now implemented the `QueryMatcher` interface, which can be passed through an option when calling
+`sqlmock.New` or `sqlmock.NewWithDSN`.
+
+This now allows to include some library, which would allow for example to parse and validate `mysql` SQL AST.
+And create a custom QueryMatcher in order to validate SQL in sophisticated ways.
+
+By default, **sqlmock** is preserving backward compatibility and default query matcher is `sqlmock.QueryMatcherRegexp`
+which uses expected SQL string as a regular expression to match incoming query string. There is an equality matcher:
+`QueryMatcherEqual` which will do a full case sensitive match.
+
+In order to customize the QueryMatcher, use the following:
+
+``` go
+	db, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
+```
+
+The query matcher can be fully customized based on user needs. **sqlmock** will not
+provide a standard sql parsing matchers, since various drivers may not follow the same SQL standard.
+
+## Matching arguments like time.Time
+
+There may be arguments which are of `struct` type and cannot be compared easily by value like `time.Time`. In this case
+**sqlmock** provides an [Argument](https://godoc.org/github.com/DATA-DOG/go-sqlmock#Argument) interface which
+can be used in more sophisticated matching. Here is a simple example of time argument matching:
+
+``` go
+type AnyTime struct{}
+
+// Match satisfies sqlmock.Argument interface
+func (a AnyTime) Match(v driver.Value) bool {
+	_, ok := v.(time.Time)
+	return ok
+}
+
+func TestAnyTimeArgument(t *testing.T) {
+	t.Parallel()
+	db, mock, err := New()
+	if err != nil {
+		t.Errorf("an error '%s' was not expected when opening a stub database connection", err)
+	}
+	defer db.Close()
+
+	mock.ExpectExec("INSERT INTO users").
+		WithArgs("john", AnyTime{}).
+		WillReturnResult(NewResult(1, 1))
+
+	_, err = db.Exec("INSERT INTO users(name, created_at) VALUES (?, ?)", "john", time.Now())
+	if err != nil {
+		t.Errorf("error '%s' was not expected, while inserting a row", err)
+	}
+
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("there were unfulfilled expectations: %s", err)
+	}
+}
+```
+
+It only asserts that argument is of `time.Time` type.
+
+## Run tests
+
+    go test -race
+
+## Change Log
+
+- **2019-02-13** - added `go.mod` removed the references and suggestions using `gopkg.in`.
+- **2018-12-11** - added expectation of Rows to be closed, while mocking expected query.
+- **2018-12-11** - introduced an option to provide **QueryMatcher** in order to customize SQL query matching.
+- **2017-09-01** - it is now possible to expect that prepared statement will be closed,
+  using **ExpectedPrepare.WillBeClosed**.
+- **2017-02-09** - implemented support for **go1.8** features. **Rows** interface was changed to struct
+  but contains all methods as before and should maintain backwards compatibility. **ExpectedQuery.WillReturnRows** may now
+  accept multiple row sets.
+- **2016-11-02** - `db.Prepare()` was not validating expected prepare SQL
+  query. It should still be validated even if Exec or Query is not
+  executed on that prepared statement.
+- **2016-02-23** - added **sqlmock.AnyArg()** function to provide any kind
+  of argument matcher.
+- **2016-02-23** - convert expected arguments to driver.Value as natural
+  driver does, the change may affect time.Time comparison and will be
+  stricter. See [issue](https://github.com/DATA-DOG/go-sqlmock/issues/31).
+- **2015-08-27** - **v1** api change, concurrency support, all known issues fixed.
+- **2014-08-16** instead of **panic** during reflect type mismatch when comparing query arguments - now return error
+- **2014-08-14** added **sqlmock.NewErrorResult** which gives an option to return driver.Result with errors for
+interface methods, see [issue](https://github.com/DATA-DOG/go-sqlmock/issues/5)
+- **2014-05-29** allow to match arguments in more sophisticated ways, by providing an **sqlmock.Argument** interface
+- **2014-04-21** introduce **sqlmock.New()** to open a mock database connection for tests. This method
+calls sql.DB.Ping to ensure that connection is open, see [issue](https://github.com/DATA-DOG/go-sqlmock/issues/4).
+This way on Close it will surely assert if all expectations are met, even if database was not triggered at all.
+The old way is still available, but it is advisable to call db.Ping manually before asserting with db.Close.
+- **2014-02-14** RowsFromCSVString is now a part of Rows interface named as FromCSVString.
+It has changed to allow more ways to construct rows and to easily extend this API in future.
+See [issue 1](https://github.com/DATA-DOG/go-sqlmock/issues/1)
+**RowsFromCSVString** is deprecated and will be removed in future
+
+## Contributions
+
+Feel free to open a pull request. Note, if you wish to contribute an extension to public (exported methods or types) -
+please open an issue before, to discuss whether these changes can be accepted. All backward incompatible changes are
+and will be treated cautiously
+
+## License
+
+The [three clause BSD license](http://en.wikipedia.org/wiki/BSD_licenses)
+
@@ -0,0 +1,24 @@
+package sqlmock
+
+import "database/sql/driver"
+
+// Argument interface allows to match
+// any argument in specific way when used with
+// ExpectedQuery and ExpectedExec expectations.
+type Argument interface {
+	Match(driver.Value) bool
+}
+
+// AnyArg will return an Argument which can
+// match any kind of arguments.
+//
+// Useful for time.Time or similar kinds of arguments.
+func AnyArg() Argument {
+	return anyArgument{}
+}
+
+type anyArgument struct{}
+
+func (a anyArgument) Match(_ driver.Value) bool {
+	return true
+}
@@ -0,0 +1,81 @@
+package sqlmock
+
+import (
+	"database/sql"
+	"database/sql/driver"
+	"fmt"
+	"sync"
+)
+
+var pool *mockDriver
+
+func init() {
+	pool = &mockDriver{
+		conns: make(map[string]*sqlmock),
+	}
+	sql.Register("sqlmock", pool)
+}
+
+type mockDriver struct {
+	sync.Mutex
+	counter int
+	conns   map[string]*sqlmock
+}
+
+func (d *mockDriver) Open(dsn string) (driver.Conn, error) {
+	d.Lock()
+	defer d.Unlock()
+
+	c, ok := d.conns[dsn]
+	if !ok {
+		return c, fmt.Errorf("expected a connection to be available, but it is not")
+	}
+
+	c.opened++
+	return c, nil
+}
+
+// New creates sqlmock database connection and a mock to manage expectations.
+// Accepts options, like ValueConverterOption, to use a ValueConverter from
+// a specific driver.
+// Pings db so that all expectations could be
+// asserted.
+func New(options ...func(*sqlmock) error) (*sql.DB, Sqlmock, error) {
+	pool.Lock()
+	dsn := fmt.Sprintf("sqlmock_db_%d", pool.counter)
+	pool.counter++
+
+	smock := &sqlmock{dsn: dsn, drv: pool, ordered: true}
+	pool.conns[dsn] = smock
+	pool.Unlock()
+
+	return smock.open(options)
+}
+
+// NewWithDSN creates sqlmock database connection with a specific DSN
+// and a mock to manage expectations.
+// Accepts options, like ValueConverterOption, to use a ValueConverter from
+// a specific driver.
+// Pings db so that all expectations could be asserted.
+//
+// This method is introduced because of sql abstraction
+// libraries, which do not provide a way to initialize
+// with sql.DB instance. For example GORM library.
+//
+// Note, it will error if attempted to create with an
+// already used dsn
+//
+// It is not recommended to use this method, unless you
+// really need it and there is no other way around.
+func NewWithDSN(dsn string, options ...func(*sqlmock) error) (*sql.DB, Sqlmock, error) {
+	pool.Lock()
+	if _, ok := pool.conns[dsn]; ok {
+		pool.Unlock()
+		return nil, nil, fmt.Errorf("cannot create a new mock database with the same dsn: %s", dsn)
+	}
+	smock := &sqlmock{dsn: dsn, drv: pool, ordered: true}
+	pool.conns[dsn] = smock
+	pool.Unlock()
+
+	return smock.open(options)
+}
@@ -0,0 +1,355 @@
+package sqlmock
+
+import (
+	"database/sql/driver"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+)
+
+// an expectation interface
+type expectation interface {
+	fulfilled() bool
+	Lock()
+	Unlock()
+	String() string
+}
+
+// common expectation struct
+// satisfies the expectation interface
+type commonExpectation struct {
+	sync.Mutex
+	triggered bool
+	err       error
+}
+
+func (e *commonExpectation) fulfilled() bool {
+	return e.triggered
+}
+
+// ExpectedClose is used to manage *sql.DB.Close expectation
+// returned by *Sqlmock.ExpectClose.
+type ExpectedClose struct {
+	commonExpectation
+}
+
+// WillReturnError allows to set an error for *sql.DB.Close action
+func (e *ExpectedClose) WillReturnError(err error) *ExpectedClose {
+	e.err = err
+	return e
+}
+
+// String returns string representation
+func (e *ExpectedClose) String() string {
+	msg := "ExpectedClose => expecting database Close"
+	if e.err != nil {
+		msg += fmt.Sprintf(", which should return error: %s", e.err)
+	}
+	return msg
+}
+
+// ExpectedBegin is used to manage *sql.DB.Begin expectation
+// returned by *Sqlmock.ExpectBegin.
+type ExpectedBegin struct {
+	commonExpectation
+	delay time.Duration
+}
+
+// WillReturnError allows to set an error for *sql.DB.Begin action
+func (e *ExpectedBegin) WillReturnError(err error) *ExpectedBegin {
+	e.err = err
+	return e
+}
+
+// String returns string representation
+func (e *ExpectedBegin) String() string {
+	msg := "ExpectedBegin => expecting database transaction Begin"
+	if e.err != nil {
+		msg += fmt.Sprintf(", which should return error: %s", e.err)
+	}
+	return msg
+}
+
+// WillDelayFor allows to specify duration for which it will delay
+// result. May be used together with Context
+func (e *ExpectedBegin) WillDelayFor(duration time.Duration) *ExpectedBegin {
+	e.delay = duration
+	return e
+}
+
+// ExpectedCommit is used to manage *sql.Tx.Commit expectation
+// returned by *Sqlmock.ExpectCommit.
+type ExpectedCommit struct {
+	commonExpectation
+}
+
+// WillReturnError allows to set an error for *sql.Tx.Close action
+func (e *ExpectedCommit) WillReturnError(err error) *ExpectedCommit {
+	e.err = err
+	return e
+}
+
+// String returns string representation
+func (e *ExpectedCommit) String() string {
+	msg := "ExpectedCommit => expecting transaction Commit"
+	if e.err != nil {
+		msg += fmt.Sprintf(", which should return error: %s", e.err)
+	}
+	return msg
+}
+
+// ExpectedRollback is used to manage *sql.Tx.Rollback expectation
+// returned by *Sqlmock.ExpectRollback.
+type ExpectedRollback struct {
+	commonExpectation
+}
+
+// WillReturnError allows to set an error for *sql.Tx.Rollback action
+func (e *ExpectedRollback) WillReturnError(err error) *ExpectedRollback {
+	e.err = err
+	return e
+}
+
+// String returns string representation
+func (e *ExpectedRollback) String() string {
+	msg := "ExpectedRollback => expecting transaction Rollback"
+	if e.err != nil {
+		msg += fmt.Sprintf(", which should return error: %s", e.err)
+	}
+	return msg
+}
+
+// ExpectedQuery is used to manage *sql.DB.Query, *dql.DB.QueryRow, *sql.Tx.Query,
+// *sql.Tx.QueryRow, *sql.Stmt.Query or *sql.Stmt.QueryRow expectations.
+// Returned by *Sqlmock.ExpectQuery.
+type ExpectedQuery struct {
+	queryBasedExpectation
+	rows             driver.Rows
+	delay            time.Duration
+	rowsMustBeClosed bool
+	rowsWereClosed   bool
+}
+
+// WithArgs will match given expected args to actual database query arguments.
+// if at least one argument does not match, it will return an error. For specific
+// arguments an sqlmock.Argument interface can be used to match an argument.
+func (e *ExpectedQuery) WithArgs(args ...driver.Value) *ExpectedQuery {
+	e.args = args
+	return e
+}
+
+// RowsWillBeClosed expects this query rows to be closed.
+func (e *ExpectedQuery) RowsWillBeClosed() *ExpectedQuery {
+	e.rowsMustBeClosed = true
+	return e
+}
+
+// WillReturnError allows to set an error for expected database query
+func (e *ExpectedQuery) WillReturnError(err error) *ExpectedQuery {
+	e.err = err
+	return e
+}
+
+// WillDelayFor allows to specify duration for which it will delay
+// result. May be used together with Context
+func (e *ExpectedQuery) WillDelayFor(duration time.Duration) *ExpectedQuery {
+	e.delay = duration
+	return e
+}
+
+// String returns string representation
+func (e *ExpectedQuery) String() string {
+	msg := "ExpectedQuery => expecting Query, QueryContext or QueryRow which:"
+	msg += "\n  - matches sql: '" + e.expectSQL + "'"
+
+	if len(e.args) == 0 {
+		msg += "\n  - is without arguments"
+	} else {
+		msg += "\n  - is with arguments:\n"
+		for i, arg := range e.args {
+			msg += fmt.Sprintf("    %d - %+v\n", i, arg)
+		}
+		msg = strings.TrimSpace(msg)
+	}
+
+	if e.rows != nil {
+		msg += fmt.Sprintf("\n  - %s", e.rows)
+	}
+
+	if e.err != nil {
+		msg += fmt.Sprintf("\n  - should return error: %s", e.err)
+	}
+
+	return msg
+}
+
+// ExpectedExec is used to manage *sql.DB.Exec, *sql.Tx.Exec or *sql.Stmt.Exec expectations.
+// Returned by *Sqlmock.ExpectExec.
+type ExpectedExec struct {
+	queryBasedExpectation
+	result driver.Result
+	delay  time.Duration
+}
+
+// WithArgs will match given expected args to actual database exec operation arguments.
+// if at least one argument does not match, it will return an error. For specific
+// arguments an sqlmock.Argument interface can be used to match an argument.
+func (e *ExpectedExec) WithArgs(args ...driver.Value) *ExpectedExec {
+	e.args = args
+	return e
+}
+
+// WillReturnError allows to set an error for expected database exec action
+func (e *ExpectedExec) WillReturnError(err error) *ExpectedExec {
+	e.err = err
+	return e
+}
+
+// WillDelayFor allows to specify duration for which it will delay
+// result. May be used together with Context
+func (e *ExpectedExec) WillDelayFor(duration time.Duration) *ExpectedExec {
+	e.delay = duration
+	return e
+}
+
+// String returns string representation
+func (e *ExpectedExec) String() string {
+	msg := "ExpectedExec => expecting Exec or ExecContext which:"
+	msg += "\n  - matches sql: '" + e.expectSQL + "'"
+
+	if len(e.args) == 0 {
+		msg += "\n  - is without arguments"
+	} else {
+		msg += "\n  - is with arguments:\n"
+		var margs []string
+		for i, arg := range e.args {
+			margs = append(margs, fmt.Sprintf("    %d - %+v", i, arg))
+		}
+		msg += strings.Join(margs, "\n")
+	}
+
+	if e.result != nil {
+		res, _ := e.result.(*result)
+		msg += "\n  - should return Result having:"
+		msg += fmt.Sprintf("\n      LastInsertId: %d", res.insertID)
+		msg += fmt.Sprintf("\n      RowsAffected: %d", res.rowsAffected)
+		if res.err != nil {
+			msg += fmt.Sprintf("\n      Error: %s", res.err)
+		}
+	}
+
+	if e.err != nil {
+		msg += fmt.Sprintf("\n  - should return error: %s", e.err)
+	}
+
+	return msg
+}
+
+// WillReturnResult arranges for an expected Exec() to return a particular
+// result, there is sqlmock.NewResult(lastInsertID int64, affectedRows int64) method
+// to build a corresponding result. Or if actions needs to be tested against errors
+// sqlmock.NewErrorResult(err error) to return a given error.
+func (e *ExpectedExec) WillReturnResult(result driver.Result) *ExpectedExec {
+	e.result = result
+	return e
+}
+
+// ExpectedPrepare is used to manage *sql.DB.Prepare or *sql.Tx.Prepare expectations.
+// Returned by *Sqlmock.ExpectPrepare.
+type ExpectedPrepare struct {
+	commonExpectation
+	mock         *sqlmock
+	expectSQL    string
+	statement    driver.Stmt
+	closeErr     error
+	mustBeClosed bool
+	wasClosed    bool
+	delay        time.Duration
+}
+
+// WillReturnError allows to set an error for the expected *sql.DB.Prepare or *sql.Tx.Prepare action.
+func (e *ExpectedPrepare) WillReturnError(err error) *ExpectedPrepare {
+	e.err = err
+	return e
+}
+
+// WillReturnCloseError allows to set an error for this prepared statement Close action
+func (e *ExpectedPrepare) WillReturnCloseError(err error) *ExpectedPrepare {
+	e.closeErr = err
+	return e
+}
+
+// WillDelayFor allows to specify duration for which it will delay
+// result. May be used together with Context
+func (e *ExpectedPrepare) WillDelayFor(duration time.Duration) *ExpectedPrepare {
+	e.delay = duration
+	return e
+}
+
+// WillBeClosed expects this prepared statement to
+// be closed.
+func (e *ExpectedPrepare) WillBeClosed() *ExpectedPrepare {
+	e.mustBeClosed = true
+	return e
+}
+
+// ExpectQuery allows to expect Query() or QueryRow() on this prepared statement.
+// This method is convenient in order to prevent duplicating sql query string matching.
+func (e *ExpectedPrepare) ExpectQuery() *ExpectedQuery {
+	eq := &ExpectedQuery{}
+	eq.expectSQL = e.expectSQL
+	eq.converter = e.mock.converter
+	e.mock.expected = append(e.mock.expected, eq)
+	return eq
+}
+
+// ExpectExec allows to expect Exec() on this prepared statement.
+// This method is convenient in order to prevent duplicating sql query string matching.
+func (e *ExpectedPrepare) ExpectExec() *ExpectedExec {
+	eq := &ExpectedExec{}
+	eq.expectSQL = e.expectSQL
+	eq.converter = e.mock.converter
+	e.mock.expected = append(e.mock.expected, eq)
+	return eq
+}
+
+// String returns string representation
+func (e *ExpectedPrepare) String() string {
+	msg := "ExpectedPrepare => expecting Prepare statement which:"
+	msg += "\n  - matches sql: '" + e.expectSQL + "'"
+
+	if e.err != nil {
+		msg += fmt.Sprintf("\n  - should return error: %s", e.err)
+	}
+
+	if e.closeErr != nil {
+		msg += fmt.Sprintf("\n  - should return error on Close: %s", e.closeErr)
+	}
+
+	return msg
+}
+
+// query based expectation
+// adds a query matching logic
+type queryBasedExpectation struct {
+	commonExpectation
+	expectSQL string
+	converter driver.ValueConverter
+	args      []driver.Value
+}
+
+func (e *queryBasedExpectation) attemptArgMatch(args []namedValue) (err error) {
+	// catch panic
+	defer func() {
+		if e := recover(); e != nil {
+			_, ok := e.(error)
+			if !ok {
+				err = fmt.Errorf(e.(string))
+			}
+		}
+	}()
+
+	err = e.argsMatches(args)
+	return
+}
@@ -0,0 +1,52 @@
+// +build !go1.8
+
+package sqlmock
+
+import (
+	"database/sql/driver"
+	"fmt"
+	"reflect"
+)
+
+// WillReturnRows specifies the set of resulting rows that will be returned
+// by the triggered query
+func (e *ExpectedQuery) WillReturnRows(rows *Rows) *ExpectedQuery {
+	e.rows = &rowSets{sets: []*Rows{rows}, ex: e}
+	return e
+}
+
+func (e *queryBasedExpectation) argsMatches(args []namedValue) error {
+	if nil == e.args {
+		return nil
+	}
+	if len(args) != len(e.args) {
+		return fmt.Errorf("expected %d, but got %d arguments", len(e.args), len(args))
+	}
+	for k, v := range args {
+		// custom argument matcher
+		matcher, ok := e.args[k].(Argument)
+		if ok {
+			// @TODO: does it make sense to pass value instead of named value?
+			if !matcher.Match(v.Value) {
+				return fmt.Errorf("matcher %T could not match %d argument %T - %+v", matcher, k, args[k], args[k])
+			}
+			continue
+		}
+
+		dval := e.args[k]
+		// convert to driver converter
+		darg, err := e.converter.ConvertValue(dval)
+		if err != nil {
+			return fmt.Errorf("could not convert %d argument %T - %+v to driver value: %s", k, e.args[k], e.args[k], err)
+		}
+
+		if !driver.IsValue(darg) {
+			return fmt.Errorf("argument %d: non-subset type %T returned from Value", k, darg)
+		}
+
+		if !reflect.DeepEqual(darg, v.Value) {
+			return fmt.Errorf("argument %d expected [%T - %+v] does not match actual [%T - %+v]", k, darg, darg, v.Value, v.Value)
+		}
+	}
+	return nil
+}
@@ -0,0 +1,66 @@
+// +build go1.8
+
+package sqlmock
+
+import (
+	"database/sql"
+	"database/sql/driver"
+	"fmt"
+	"reflect"
+)
+
+// WillReturnRows specifies the set of resulting rows that will be returned
+// by the triggered query
+func (e *ExpectedQuery) WillReturnRows(rows ...*Rows) *ExpectedQuery {
+	sets := make([]*Rows, len(rows))
+	for i, r := range rows {
+		sets[i] = r
+	}
+	e.rows = &rowSets{sets: sets, ex: e}
+	return e
+}
+
+func (e *queryBasedExpectation) argsMatches(args []namedValue) error {
+	if nil == e.args {
+		return nil
+	}
+	if len(args) != len(e.args) {
+		return fmt.Errorf("expected %d, but got %d arguments", len(e.args), len(args))
+	}
+	// @TODO should we assert either all args are named or ordinal?
+	for k, v := range args {
+		// custom argument matcher
+		matcher, ok := e.args[k].(Argument)
+		if ok {
+			if !matcher.Match(v.Value) {
+				return fmt.Errorf("matcher %T could not match %d argument %T - %+v", matcher, k, args[k], args[k])
+			}
+			continue
+		}
+
+		dval := e.args[k]
+		if named, isNamed := dval.(sql.NamedArg); isNamed {
+			dval = named.Value
+			if v.Name != named.Name {
+				return fmt.Errorf("named argument %d: name: \"%s\" does not match expected: \"%s\"", k, v.Name, named.Name)
+			}
+		} else if k+1 != v.Ordinal {
+			return fmt.Errorf("argument %d: ordinal position: %d does not match expected: %d", k, k+1, v.Ordinal)
+		}
+
+		// convert to driver converter
+		darg, err := e.converter.ConvertValue(dval)
+		if err != nil {
+			return fmt.Errorf("could not convert %d argument %T - %+v to driver value: %s", k, e.args[k], e.args[k], err)
+		}
+
+		if !driver.IsValue(darg) {
+			return fmt.Errorf("argument %d: non-subset type %T returned from Value", k, darg)
+		}
+
+		if !reflect.DeepEqual(darg, v.Value) {
+			return fmt.Errorf("argument %d expected [%T - %+v] does not match actual [%T - %+v]", k, darg, darg, v.Value, v.Value)
+		}
+	}
+	return nil
+}
@@ -0,0 +1 @@
+module github.com/DATA-DOG/go-sqlmock
@@ -0,0 +1,22 @@
+package sqlmock
+
+import "database/sql/driver"
+
+// ValueConverterOption allows to create a sqlmock connection
+// with a custom ValueConverter to support drivers with special data types.
+func ValueConverterOption(converter driver.ValueConverter) func(*sqlmock) error {
+	return func(s *sqlmock) error {
+		s.converter = converter
+		return nil
+	}
+}
+
+// QueryMatcherOption allows to customize SQL query matcher
+// and match SQL query strings in more sophisticated ways.
+// The default QueryMatcher is QueryMatcherRegexp.
+func QueryMatcherOption(queryMatcher QueryMatcher) func(*sqlmock) error {
+	return func(s *sqlmock) error {
+		s.queryMatcher = queryMatcher
+		return nil
+	}
+}
@@ -0,0 +1,68 @@
+package sqlmock
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+var re = regexp.MustCompile("\\s+")
+
+// strip out new lines and trim spaces
+func stripQuery(q string) (s string) {
+	return strings.TrimSpace(re.ReplaceAllString(q, " "))
+}
+
+// QueryMatcher is an SQL query string matcher interface,
+// which can be used to customize validation of SQL query strings.
+// As an example, external library could be used to build
+// and validate SQL ast, columns selected.
+//
+// sqlmock can be customized to implement a different QueryMatcher
+// configured through an option when sqlmock.New or sqlmock.NewWithDSN
+// is called, default QueryMatcher is QueryMatcherRegexp.
+type QueryMatcher interface {
+
+	// Match expected SQL query string without whitespace to
+	// actual SQL.
+	Match(expectedSQL, actualSQL string) error
+}
+
+// QueryMatcherFunc type is an adapter to allow the use of
+// ordinary functions as QueryMatcher. If f is a function
+// with the appropriate signature, QueryMatcherFunc(f) is a
+// QueryMatcher that calls f.
+type QueryMatcherFunc func(expectedSQL, actualSQL string) error
+
+// Match implements the QueryMatcher
+func (f QueryMatcherFunc) Match(expectedSQL, actualSQL string) error {
+	return f(expectedSQL, actualSQL)
+}
+
+// QueryMatcherRegexp is the default SQL query matcher
+// used by sqlmock. It parses expectedSQL to a regular
+// expression and attempts to match actualSQL.
+var QueryMatcherRegexp QueryMatcher = QueryMatcherFunc(func(expectedSQL, actualSQL string) error {
+	expect := stripQuery(expectedSQL)
+	actual := stripQuery(actualSQL)
+	re, err := regexp.Compile(expect)
+	if err != nil {
+		return err
+	}
+	if !re.MatchString(actual) {
+		return fmt.Errorf(`could not match actual sql: "%s" with expected regexp "%s"`, actual, re.String())
+	}
+	return nil
+})
+
+// QueryMatcherEqual is the SQL query matcher
+// which simply tries a case sensitive match of
+// expected and actual SQL strings without whitespace.
+var QueryMatcherEqual QueryMatcher = QueryMatcherFunc(func(expectedSQL, actualSQL string) error {
+	expect := stripQuery(expectedSQL)
+	actual := stripQuery(actualSQL)
+	if actual != expect {
+		return fmt.Errorf(`actual sql: "%s" does not equal to expected "%s"`, actual, expect)
+	}
+	return nil
+})
@@ -0,0 +1,39 @@
+package sqlmock
+
+import (
+	"database/sql/driver"
+)
+
+// Result satisfies sql driver Result, which
+// holds last insert id and rows affected
+// by Exec queries
+type result struct {
+	insertID     int64
+	rowsAffected int64
+	err          error
+}
+
+// NewResult creates a new sql driver Result
+// for Exec based query mocks.
+func NewResult(lastInsertID int64, rowsAffected int64) driver.Result {
+	return &result{
+		insertID:     lastInsertID,
+		rowsAffected: rowsAffected,
+	}
+}
+
+// NewErrorResult creates a new sql driver Result
+// which returns an error given for both interface methods
+func NewErrorResult(err error) driver.Result {
+	return &result{
+		err: err,
+	}
+}
+
+func (r *result) LastInsertId() (int64, error) {
+	return r.insertID, r.err
+}
+
+func (r *result) RowsAffected() (int64, error) {
+	return r.rowsAffected, r.err
+}
@@ -0,0 +1,176 @@
+package sqlmock
+
+import (
+	"database/sql/driver"
+	"encoding/csv"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// CSVColumnParser is a function which converts trimmed csv
+// column string to a []byte representation. Currently
+// transforms NULL to nil
+var CSVColumnParser = func(s string) []byte {
+	switch {
+	case strings.ToLower(s) == "null":
+		return nil
+	}
+	return []byte(s)
+}
+
+type rowSets struct {
+	sets []*Rows
+	pos  int
+	ex   *ExpectedQuery
+}
+
+func (rs *rowSets) Columns() []string {
+	return rs.sets[rs.pos].cols
+}
+
+func (rs *rowSets) Close() error {
+	rs.ex.rowsWereClosed = true
+	return rs.sets[rs.pos].closeErr
+}
+
+// advances to next row
+func (rs *rowSets) Next(dest []driver.Value) error {
+	r := rs.sets[rs.pos]
+	r.pos++
+	if r.pos > len(r.rows) {
+		return io.EOF // per interface spec
+	}
+
+	for i, col := range r.rows[r.pos-1] {
+		dest[i] = col
+	}
+
+	return r.nextErr[r.pos-1]
+}
+
+// transforms to debuggable printable string
+func (rs *rowSets) String() string {
+	if rs.empty() {
+		return "with empty rows"
+	}
+
+	msg := "should return rows:\n"
+	if len(rs.sets) == 1 {
+		for n, row := range rs.sets[0].rows {
+			msg += fmt.Sprintf("    row %d - %+v\n", n, row)
+		}
+		return strings.TrimSpace(msg)
+	}
+	for i, set := range rs.sets {
+		msg += fmt.Sprintf("    result set: %d\n", i)
+		for n, row := range set.rows {
+			msg += fmt.Sprintf("      row %d - %+v\n", n, row)
+		}
+	}
+	return strings.TrimSpace(msg)
+}
+
+func (rs *rowSets) empty() bool {
+	for _, set := range rs.sets {
+		if len(set.rows) > 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// Rows is a mocked collection of rows to
+// return for Query result
+type Rows struct {
+	converter driver.ValueConverter
+	cols      []string
+	rows      [][]driver.Value
+	pos       int
+	nextErr   map[int]error
+	closeErr  error
+}
+
+// NewRows allows Rows to be created from a
+// sql driver.Value slice or from the CSV string and
+// to be used as sql driver.Rows.
+// Use Sqlmock.NewRows instead if using a custom converter
+func NewRows(columns []string) *Rows {
+	return &Rows{
+		cols:      columns,
+		nextErr:   make(map[int]error),
+		converter: driver.DefaultParameterConverter,
+	}
+}
+
+// CloseError allows to set an error
+// which will be returned by rows.Close
+// function.
+//
+// The close error will be triggered only in cases
+// when rows.Next() EOF was not yet reached, that is
+// a default sql library behavior
+func (r *Rows) CloseError(err error) *Rows {
+	r.closeErr = err
+	return r
+}
+
+// RowError allows to set an error
+// which will be returned when a given
+// row number is read
+func (r *Rows) RowError(row int, err error) *Rows {
+	r.nextErr[row] = err
+	return r
+}
+
+// AddRow composed from database driver.Value slice
+// return the same instance to perform subsequent actions.
+// Note that the number of values must match the number
+// of columns
+func (r *Rows) AddRow(values ...driver.Value) *Rows {
+	if len(values) != len(r.cols) {
+		panic("Expected number of values to match number of columns")
+	}
+
+	row := make([]driver.Value, len(r.cols))
+	for i, v := range values {
+		// Convert user-friendly values (such as int or driver.Valuer)
+		// to database/sql native value (driver.Value such as int64)
+		var err error
+		v, err = r.converter.ConvertValue(v)
+		if err != nil {
+			panic(fmt.Errorf(
+				"row #%d, column #%d (%q) type %T: %s",
+				len(r.rows)+1, i, r.cols[i], values[i], err,
+			))
+		}
+
+		row[i] = v
+	}
+
+	r.rows = append(r.rows, row)
+	return r
+}
+
+// FromCSVString build rows from csv string.
+// return the same instance to perform subsequent actions.
+// Note that the number of values must match the number
+// of columns
+func (r *Rows) FromCSVString(s string) *Rows {
+	res := strings.NewReader(strings.TrimSpace(s))
+	csvReader := csv.NewReader(res)
+
+	for {
+		res, err := csvReader.Read()
+		if err != nil || res == nil {
+			break
+		}
+
+		row := make([]driver.Value, len(r.cols))
+		for i, v := range res {
+			row[i] = CSVColumnParser(strings.TrimSpace(v))
+		}
+		r.rows = append(r.rows, row)
+	}
+	return r
+}
@@ -0,0 +1,20 @@
+// +build go1.8
+
+package sqlmock
+
+import "io"
+
+// Implement the "RowsNextResultSet" interface
+func (rs *rowSets) HasNextResultSet() bool {
+	return rs.pos+1 < len(rs.sets)
+}
+
+// Implement the "RowsNextResultSet" interface
+func (rs *rowSets) NextResultSet() error {
+	if !rs.HasNextResultSet() {
+		return io.EOF
+	}
+
+	rs.pos++
+	return nil
+}
@@ -0,0 +1,589 @@
+/*
+Package sqlmock is a mock library implementing sql driver. Which has one and only
+purpose - to simulate any sql driver behavior in tests, without needing a real
+database connection. It helps to maintain correct **TDD** workflow.
+
+It does not require any modifications to your source code in order to test
+and mock database operations. Supports concurrency and multiple database mocking.
+
+The driver allows to mock any sql driver method behavior.
+*/
+package sqlmock
+
+import (
+	"database/sql"
+	"database/sql/driver"
+	"fmt"
+	"time"
+)
+
+// Sqlmock interface serves to create expectations
+// for any kind of database action in order to mock
+// and test real database behavior.
+type Sqlmock interface {
+
+	// ExpectClose queues an expectation for this database
+	// action to be triggered. the *ExpectedClose allows
+	// to mock database response
+	ExpectClose() *ExpectedClose
+
+	// ExpectationsWereMet checks whether all queued expectations
+	// were met in order. If any of them was not met - an error is returned.
+	ExpectationsWereMet() error
+
+	// ExpectPrepare expects Prepare() to be called with expectedSQL query.
+	// the *ExpectedPrepare allows to mock database response.
+	// Note that you may expect Query() or Exec() on the *ExpectedPrepare
+	// statement to prevent repeating expectedSQL
+	ExpectPrepare(expectedSQL string) *ExpectedPrepare
+
+	// ExpectQuery expects Query() or QueryRow() to be called with expectedSQL query.
+	// the *ExpectedQuery allows to mock database response.
+	ExpectQuery(expectedSQL string) *ExpectedQuery
+
+	// ExpectExec expects Exec() to be called with expectedSQL query.
+	// the *ExpectedExec allows to mock database response
+	ExpectExec(expectedSQL string) *ExpectedExec
+
+	// ExpectBegin expects *sql.DB.Begin to be called.
+	// the *ExpectedBegin allows to mock database response
+	ExpectBegin() *ExpectedBegin
+
+	// ExpectCommit expects *sql.Tx.Commit to be called.
+	// the *ExpectedCommit allows to mock database response
+	ExpectCommit() *ExpectedCommit
+
+	// ExpectRollback expects *sql.Tx.Rollback to be called.
+	// the *ExpectedRollback allows to mock database response
+	ExpectRollback() *ExpectedRollback
+
+	// MatchExpectationsInOrder gives an option whether to match all
+	// expectations in the order they were set or not.
+	//
+	// By default it is set to - true. But if you use goroutines
+	// to parallelize your query executation, that option may
+	// be handy.
+	//
+	// This option may be turned on anytime during tests. As soon
+	// as it is switched to false, expectations will be matched
+	// in any order. Or otherwise if switched to true, any unmatched
+	// expectations will be expected in order
+	MatchExpectationsInOrder(bool)
+
+	// NewRows allows Rows to be created from a
+	// sql driver.Value slice or from the CSV string and
+	// to be used as sql driver.Rows.
+	NewRows(columns []string) *Rows
+}
+
+type sqlmock struct {
+	ordered      bool
+	dsn          string
+	opened       int
+	drv          *mockDriver
+	converter    driver.ValueConverter
+	queryMatcher QueryMatcher
+
+	expected []expectation
+}
+
+func (c *sqlmock) open(options []func(*sqlmock) error) (*sql.DB, Sqlmock, error) {
+	db, err := sql.Open("sqlmock", c.dsn)
+	if err != nil {
+		return db, c, err
+	}
+	for _, option := range options {
+		err := option(c)
+		if err != nil {
+			return db, c, err
+		}
+	}
+	if c.converter == nil {
+		c.converter = driver.DefaultParameterConverter
+	}
+	if c.queryMatcher == nil {
+		c.queryMatcher = QueryMatcherRegexp
+	}
+	return db, c, db.Ping()
+}
+
+func (c *sqlmock) ExpectClose() *ExpectedClose {
+	e := &ExpectedClose{}
+	c.expected = append(c.expected, e)
+	return e
+}
+
+func (c *sqlmock) MatchExpectationsInOrder(b bool) {
+	c.ordered = b
+}
+
+// Close a mock database driver connection. It may or may not
+// be called depending on the circumstances, but if it is called
+// there must be an *ExpectedClose expectation satisfied.
+// meets http://golang.org/pkg/database/sql/driver/#Conn interface
+func (c *sqlmock) Close() error {
+	c.drv.Lock()
+	defer c.drv.Unlock()
+
+	c.opened--
+	if c.opened == 0 {
+		delete(c.drv.conns, c.dsn)
+	}
+
+	var expected *ExpectedClose
+	var fulfilled int
+	var ok bool
+	for _, next := range c.expected {
+		next.Lock()
+		if next.fulfilled() {
+			next.Unlock()
+			fulfilled++
+			continue
+		}
+
+		if expected, ok = next.(*ExpectedClose); ok {
+			break
+		}
+
+		next.Unlock()
+		if c.ordered {
+			return fmt.Errorf("call to database Close, was not expected, next expectation is: %s", next)
+		}
+	}
+
+	if expected == nil {
+		msg := "call to database Close was not expected"
+		if fulfilled == len(c.expected) {
+			msg = "all expectations were already fulfilled, " + msg
+		}
+		return fmt.Errorf(msg)
+	}
+
+	expected.triggered = true
+	expected.Unlock()
+	return expected.err
+}
+
+func (c *sqlmock) ExpectationsWereMet() error {
+	for _, e := range c.expected {
+		e.Lock()
+		fulfilled := e.fulfilled()
+		e.Unlock()
+
+		if !fulfilled {
+			return fmt.Errorf("there is a remaining expectation which was not matched: %s", e)
+		}
+
+		// for expected prepared statement check whether it was closed if expected
+		if prep, ok := e.(*ExpectedPrepare); ok {
+			if prep.mustBeClosed && !prep.wasClosed {
+				return fmt.Errorf("expected prepared statement to be closed, but it was not: %s", prep)
+			}
+		}
+
+		// must check whether all expected queried rows are closed
+		if query, ok := e.(*ExpectedQuery); ok {
+			if query.rowsMustBeClosed && !query.rowsWereClosed {
+				return fmt.Errorf("expected query rows to be closed, but it was not: %s", query)
+			}
+		}
+	}
+	return nil
+}
+
+// Begin meets http://golang.org/pkg/database/sql/driver/#Conn interface
+func (c *sqlmock) Begin() (driver.Tx, error) {
+	ex, err := c.begin()
+	if ex != nil {
+		time.Sleep(ex.delay)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return c, nil
+}
+
+func (c *sqlmock) begin() (*ExpectedBegin, error) {
+	var expected *ExpectedBegin
+	var ok bool
+	var fulfilled int
+	for _, next := range c.expected {
+		next.Lock()
+		if next.fulfilled() {
+			next.Unlock()
+			fulfilled++
+			continue
+		}
+
+		if expected, ok = next.(*ExpectedBegin); ok {
+			break
+		}
+
+		next.Unlock()
+		if c.ordered {
+			return nil, fmt.Errorf("call to database transaction Begin, was not expected, next expectation is: %s", next)
+		}
+	}
+	if expected == nil {
+		msg := "call to database transaction Begin was not expected"
+		if fulfilled == len(c.expected) {
+			msg = "all expectations were already fulfilled, " + msg
+		}
+		return nil, fmt.Errorf(msg)
+	}
+
+	expected.triggered = true
+	expected.Unlock()
+
+	return expected, expected.err
+}
+
+func (c *sqlmock) ExpectBegin() *ExpectedBegin {
+	e := &ExpectedBegin{}
+	c.expected = append(c.expected, e)
+	return e
+}
+
+// Exec meets http://golang.org/pkg/database/sql/driver/#Execer
+func (c *sqlmock) Exec(query string, args []driver.Value) (driver.Result, error) {
+	namedArgs := make([]namedValue, len(args))
+	for i, v := range args {
+		namedArgs[i] = namedValue{
+			Ordinal: i + 1,
+			Value:   v,
+		}
+	}
+
+	ex, err := c.exec(query, namedArgs)
+	if ex != nil {
+		time.Sleep(ex.delay)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return ex.result, nil
+}
+
+func (c *sqlmock) exec(query string, args []namedValue) (*ExpectedExec, error) {
+	var expected *ExpectedExec
+	var fulfilled int
+	var ok bool
+	for _, next := range c.expected {
+		next.Lock()
+		if next.fulfilled() {
+			next.Unlock()
+			fulfilled++
+			continue
+		}
+
+		if c.ordered {
+			if expected, ok = next.(*ExpectedExec); ok {
+				break
+			}
+			next.Unlock()
+			return nil, fmt.Errorf("call to ExecQuery '%s' with args %+v, was not expected, next expectation is: %s", query, args, next)
+		}
+		if exec, ok := next.(*ExpectedExec); ok {
+			if err := c.queryMatcher.Match(exec.expectSQL, query); err != nil {
+				next.Unlock()
+				continue
+			}
+
+			if err := exec.attemptArgMatch(args); err == nil {
+				expected = exec
+				break
+			}
+		}
+		next.Unlock()
+	}
+	if expected == nil {
+		msg := "call to ExecQuery '%s' with args %+v was not expected"
+		if fulfilled == len(c.expected) {
+			msg = "all expectations were already fulfilled, " + msg
+		}
+		return nil, fmt.Errorf(msg, query, args)
+	}
+	defer expected.Unlock()
+
+	if err := c.queryMatcher.Match(expected.expectSQL, query); err != nil {
+		return nil, fmt.Errorf("ExecQuery: %v", err)
+	}
+
+	if err := expected.argsMatches(args); err != nil {
+		return nil, fmt.Errorf("ExecQuery '%s', arguments do not match: %s", query, err)
+	}
+
+	expected.triggered = true
+	if expected.err != nil {
+		return expected, expected.err // mocked to return error
+	}
+
+	if expected.result == nil {
+		return nil, fmt.Errorf("ExecQuery '%s' with args %+v, must return a database/sql/driver.Result, but it was not set for expectation %T as %+v", query, args, expected, expected)
+	}
+
+	return expected, nil
+}
+
+func (c *sqlmock) ExpectExec(expectedSQL string) *ExpectedExec {
+	e := &ExpectedExec{}
+	e.expectSQL = expectedSQL
+	e.converter = c.converter
+	c.expected = append(c.expected, e)
+	return e
+}
+
+// Prepare meets http://golang.org/pkg/database/sql/driver/#Conn interface
+func (c *sqlmock) Prepare(query string) (driver.Stmt, error) {
+	ex, err := c.prepare(query)
+	if ex != nil {
+		time.Sleep(ex.delay)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return &statement{c, ex, query}, nil
+}
+
+func (c *sqlmock) prepare(query string) (*ExpectedPrepare, error) {
+	var expected *ExpectedPrepare
+	var fulfilled int
+	var ok bool
+
+	for _, next := range c.expected {
+		next.Lock()
+		if next.fulfilled() {
+			next.Unlock()
+			fulfilled++
+			continue
+		}
+
+		if c.ordered {
+			if expected, ok = next.(*ExpectedPrepare); ok {
+				break
+			}
+
+			next.Unlock()
+			return nil, fmt.Errorf("call to Prepare statement with query '%s', was not expected, next expectation is: %s", query, next)
+		}
+
+		if pr, ok := next.(*ExpectedPrepare); ok {
+			if err := c.queryMatcher.Match(pr.expectSQL, query); err == nil {
+				expected = pr
+				break
+			}
+		}
+		next.Unlock()
+	}
+
+	if expected == nil {
+		msg := "call to Prepare '%s' query was not expected"
+		if fulfilled == len(c.expected) {
+			msg = "all expectations were already fulfilled, " + msg
+		}
+		return nil, fmt.Errorf(msg, query)
+	}
+	defer expected.Unlock()
+	if err := c.queryMatcher.Match(expected.expectSQL, query); err != nil {
+		return nil, fmt.Errorf("Prepare: %v", err)
+	}
+
+	expected.triggered = true
+	return expected, expected.err
+}
+
+func (c *sqlmock) ExpectPrepare(expectedSQL string) *ExpectedPrepare {
+	e := &ExpectedPrepare{expectSQL: expectedSQL, mock: c}
+	c.expected = append(c.expected, e)
+	return e
+}
+
+type namedValue struct {
+	Name    string
+	Ordinal int
+	Value   driver.Value
+}
+
+// Query meets http://golang.org/pkg/database/sql/driver/#Queryer
+func (c *sqlmock) Query(query string, args []driver.Value) (driver.Rows, error) {
+	namedArgs := make([]namedValue, len(args))
+	for i, v := range args {
+		namedArgs[i] = namedValue{
+			Ordinal: i + 1,
+			Value:   v,
+		}
+	}
+
+	ex, err := c.query(query, namedArgs)
+	if ex != nil {
+		time.Sleep(ex.delay)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return ex.rows, nil
+}
+
+func (c *sqlmock) query(query string, args []namedValue) (*ExpectedQuery, error) {
+	var expected *ExpectedQuery
+	var fulfilled int
+	var ok bool
+	for _, next := range c.expected {
+		next.Lock()
+		if next.fulfilled() {
+			next.Unlock()
+			fulfilled++
+			continue
+		}
+
+		if c.ordered {
+			if expected, ok = next.(*ExpectedQuery); ok {
+				break
+			}
+			next.Unlock()
+			return nil, fmt.Errorf("call to Query '%s' with args %+v, was not expected, next expectation is: %s", query, args, next)
+		}
+		if qr, ok := next.(*ExpectedQuery); ok {
+			if err := c.queryMatcher.Match(qr.expectSQL, query); err != nil {
+				next.Unlock()
+				continue
+			}
+			if err := qr.attemptArgMatch(args); err == nil {
+				expected = qr
+				break
+			}
+		}
+		next.Unlock()
+	}
+
+	if expected == nil {
+		msg := "call to Query '%s' with args %+v was not expected"
+		if fulfilled == len(c.expected) {
+			msg = "all expectations were already fulfilled, " + msg
+		}
+		return nil, fmt.Errorf(msg, query, args)
+	}
+
+	defer expected.Unlock()
+
+	if err := c.queryMatcher.Match(expected.expectSQL, query); err != nil {
+		return nil, fmt.Errorf("Query: %v", err)
+	}
+
+	if err := expected.argsMatches(args); err != nil {
+		return nil, fmt.Errorf("Query '%s', arguments do not match: %s", query, err)
+	}
+
+	expected.triggered = true
+	if expected.err != nil {
+		return expected, expected.err // mocked to return error
+	}
+
+	if expected.rows == nil {
+		return nil, fmt.Errorf("Query '%s' with args %+v, must return a database/sql/driver.Rows, but it was not set for expectation %T as %+v", query, args, expected, expected)
+	}
+	return expected, nil
+}
+
+func (c *sqlmock) ExpectQuery(expectedSQL string) *ExpectedQuery {
+	e := &ExpectedQuery{}
+	e.expectSQL = expectedSQL
+	e.converter = c.converter
+	c.expected = append(c.expected, e)
+	return e
+}
+
+func (c *sqlmock) ExpectCommit() *ExpectedCommit {
+	e := &ExpectedCommit{}
+	c.expected = append(c.expected, e)
+	return e
+}
+
+func (c *sqlmock) ExpectRollback() *ExpectedRollback {
+	e := &ExpectedRollback{}
+	c.expected = append(c.expected, e)
+	return e
+}
+
+// Commit meets http://golang.org/pkg/database/sql/driver/#Tx
+func (c *sqlmock) Commit() error {
+	var expected *ExpectedCommit
+	var fulfilled int
+	var ok bool
+	for _, next := range c.expected {
+		next.Lock()
+		if next.fulfilled() {
+			next.Unlock()
+			fulfilled++
+			continue
+		}
+
+		if expected, ok = next.(*ExpectedCommit); ok {
+			break
+		}
+
+		next.Unlock()
+		if c.ordered {
+			return fmt.Errorf("call to Commit transaction, was not expected, next expectation is: %s", next)
+		}
+	}
+	if expected == nil {
+		msg := "call to Commit transaction was not expected"
+		if fulfilled == len(c.expected) {
+			msg = "all expectations were already fulfilled, " + msg
+		}
+		return fmt.Errorf(msg)
+	}
+
+	expected.triggered = true
+	expected.Unlock()
+	return expected.err
+}
+
+// Rollback meets http://golang.org/pkg/database/sql/driver/#Tx
+func (c *sqlmock) Rollback() error {
+	var expected *ExpectedRollback
+	var fulfilled int
+	var ok bool
+	for _, next := range c.expected {
+		next.Lock()
+		if next.fulfilled() {
+			next.Unlock()
+			fulfilled++
+			continue
+		}
+
+		if expected, ok = next.(*ExpectedRollback); ok {
+			break
+		}
+
+		next.Unlock()
+		if c.ordered {
+			return fmt.Errorf("call to Rollback transaction, was not expected, next expectation is: %s", next)
+		}
+	}
+	if expected == nil {
+		msg := "call to Rollback transaction was not expected"
+		if fulfilled == len(c.expected) {
+			msg = "all expectations were already fulfilled, " + msg
+		}
+		return fmt.Errorf(msg)
+	}
+
+	expected.triggered = true
+	expected.Unlock()
+	return expected.err
+}
+
+// NewRows allows Rows to be created from a
+// sql driver.Value slice or from the CSV string and
+// to be used as sql driver.Rows.
+func (c *sqlmock) NewRows(columns []string) *Rows {
+	r := NewRows(columns)
+	r.converter = c.converter
+	return r
+}
@@ -0,0 +1,121 @@
+// +build go1.8
+
+package sqlmock
+
+import (
+	"context"
+	"database/sql/driver"
+	"errors"
+	"time"
+)
+
+// ErrCancelled defines an error value, which can be expected in case of
+// such cancellation error.
+var ErrCancelled = errors.New("canceling query due to user request")
+
+// Implement the "QueryerContext" interface
+func (c *sqlmock) QueryContext(ctx context.Context, query string, args []driver.NamedValue) (driver.Rows, error) {
+	namedArgs := make([]namedValue, len(args))
+	for i, nv := range args {
+		namedArgs[i] = namedValue(nv)
+	}
+
+	ex, err := c.query(query, namedArgs)
+	if ex != nil {
+		select {
+		case <-time.After(ex.delay):
+			if err != nil {
+				return nil, err
+			}
+			return ex.rows, nil
+		case <-ctx.Done():
+			return nil, ErrCancelled
+		}
+	}
+
+	return nil, err
+}
+
+// Implement the "ExecerContext" interface
+func (c *sqlmock) ExecContext(ctx context.Context, query string, args []driver.NamedValue) (driver.Result, error) {
+	namedArgs := make([]namedValue, len(args))
+	for i, nv := range args {
+		namedArgs[i] = namedValue(nv)
+	}
+
+	ex, err := c.exec(query, namedArgs)
+	if ex != nil {
+		select {
+		case <-time.After(ex.delay):
+			if err != nil {
+				return nil, err
+			}
+			return ex.result, nil
+		case <-ctx.Done():
+			return nil, ErrCancelled
+		}
+	}
+
+	return nil, err
+}
+
+// Implement the "ConnBeginTx" interface
+func (c *sqlmock) BeginTx(ctx context.Context, opts driver.TxOptions) (driver.Tx, error) {
+	ex, err := c.begin()
+	if ex != nil {
+		select {
+		case <-time.After(ex.delay):
+			if err != nil {
+				return nil, err
+			}
+			return c, nil
+		case <-ctx.Done():
+			return nil, ErrCancelled
+		}
+	}
+
+	return nil, err
+}
+
+// Implement the "ConnPrepareContext" interface
+func (c *sqlmock) PrepareContext(ctx context.Context, query string) (driver.Stmt, error) {
+	ex, err := c.prepare(query)
+	if ex != nil {
+		select {
+		case <-time.After(ex.delay):
+			if err != nil {
+				return nil, err
+			}
+			return &statement{c, ex, query}, nil
+		case <-ctx.Done():
+			return nil, ErrCancelled
+		}
+	}
+
+	return nil, err
+}
+
+// Implement the "Pinger" interface
+// for now we do not have a Ping expectation
+// may be something for the future
+func (c *sqlmock) Ping(ctx context.Context) error {
+	return nil
+}
+
+// Implement the "StmtExecContext" interface
+func (stmt *statement) ExecContext(ctx context.Context, args []driver.NamedValue) (driver.Result, error) {
+	return stmt.conn.ExecContext(ctx, stmt.query, args)
+}
+
+// Implement the "StmtQueryContext" interface
+func (stmt *statement) QueryContext(ctx context.Context, args []driver.NamedValue) (driver.Rows, error) {
+	return stmt.conn.QueryContext(ctx, stmt.query, args)
+}
+
+// @TODO maybe add ExpectedBegin.WithOptions(driver.TxOptions)
+
+// CheckNamedValue meets https://golang.org/pkg/database/sql/driver/#NamedValueChecker
+func (c *sqlmock) CheckNamedValue(nv *driver.NamedValue) (err error) {
+	nv.Value, err = c.converter.ConvertValue(nv.Value)
+	return err
+}
@@ -0,0 +1,28 @@
+package sqlmock
+
+import (
+	"database/sql/driver"
+)
+
+type statement struct {
+	conn  *sqlmock
+	ex    *ExpectedPrepare
+	query string
+}
+
+func (stmt *statement) Close() error {
+	stmt.ex.wasClosed = true
+	return stmt.ex.closeErr
+}
+
+func (stmt *statement) NumInput() int {
+	return -1
+}
+
+func (stmt *statement) Exec(args []driver.Value) (driver.Result, error) {
+	return stmt.conn.Exec(stmt.query, args)
+}
+
+func (stmt *statement) Query(args []driver.Value) (driver.Rows, error) {
+	return stmt.conn.Query(stmt.query, args)
+}
@@ -20,6 +20,3 @@ _cgo_export.*
 _testmain.go

 *.exe
-*.test
-
-*.swp
@@ -0,0 +1,27 @@
+Copyright (c) 2013 CloudFlare, Inc.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this
+  list of conditions and the following disclaimer in the documentation and/or
+  other materials provided with the distribution.
+
+* Neither the name of the CloudFlare, Inc. nor the names of its
+  contributors may be used to endorse or promote products derived from
+  this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@@ -0,0 +1,14 @@
+GCFLAGS := 
+LDFLAGS :=
+
+.PHONY: install
+install:
+	@go install -v .
+
+.PHONY: test
+test:
+	@go test -gcflags='$(GCFLAGS)' -ldflags='$(LDFLAGS)' .
+
+.PHONY: bench
+bench:
+	@go test -gcflags='$(GCFLAGS)' -ldflags='$(LDFLAGS)' -bench .
@@ -0,0 +1,4 @@
+golz4
+=====
+
+Golang interface to LZ4 compression
@@ -0,0 +1,4 @@
+// Package lz4 implements compression using lz4.c and lz4hc.c
+//
+// Copyright (c) 2013 CloudFlare, Inc.
+package lz4
@@ -0,0 +1,55 @@
+package lz4
+
+// #cgo CFLAGS: -O3
+// #include "src/lz4.h"
+// #include "src/lz4.c"
+import "C"
+
+import (
+	"errors"
+	"fmt"
+	"unsafe"
+)
+
+// p gets a char pointer to the first byte of a []byte slice
+func p(in []byte) *C.char {
+	if len(in) == 0 {
+		return (*C.char)(unsafe.Pointer(nil))
+	}
+	return (*C.char)(unsafe.Pointer(&in[0]))
+}
+
+// clen gets the length of a []byte slice as a char *
+func clen(s []byte) C.int {
+	return C.int(len(s))
+}
+
+// Uncompress with a known output size. len(out) should be equal to
+// the length of the uncompressed out.
+func Uncompress(in, out []byte) (error) {
+	if int(C.LZ4_decompress_safe(p(in), p(out), clen(in), clen(out))) < 0 {
+		return errors.New("Malformed compression stream")
+	}
+
+	return nil
+}
+
+// CompressBound calculates the size of the output buffer needed by
+// Compress. This is based on the following macro:
+//
+// #define LZ4_COMPRESSBOUND(isize)
+//      ((unsigned int)(isize) > (unsigned int)LZ4_MAX_INPUT_SIZE ? 0 : (isize) + ((isize)/255) + 16)
+func CompressBound(in []byte) int {
+	return len(in) + ((len(in) / 255) + 16)
+}
+
+// Compress compresses in and puts the content in out. len(out)
+// should have enough space for the compressed data (use CompressBound
+// to calculate). Returns the number of bytes in the out slice.
+func Compress(in, out []byte) (outSize int, err error) {
+	outSize = int(C.LZ4_compress_limitedOutput(p(in), p(out), clen(in), clen(out)))
+	if outSize == 0 {
+		err = fmt.Errorf("insufficient space for compression")
+	}
+	return
+}
@@ -0,0 +1,38 @@
+package lz4
+
+// #cgo CFLAGS: -O3
+// #include "src/lz4hc.h"
+// #include "src/lz4hc.c"
+import "C"
+
+import (
+	"fmt"
+)
+
+// CompressHC compresses in and puts the content in out. len(out)
+// should have enough space for the compressed data (use CompressBound
+// to calculate). Returns the number of bytes in the out slice. Determines
+// the compression level automatically.
+func CompressHC(in, out []byte) (int, error) {
+	// 0 automatically sets the compression level.
+	return CompressHCLevel(in, out, 0)
+}
+
+// CompressHCLevel compresses in at the given compression level and puts the
+// content in out. len(out) should have enough space for the compressed data
+// (use CompressBound to calculate). Returns the number of bytes in the out
+// slice. To automatically choose the compression level, use 0. Otherwise, use
+// any value in the inclusive range 1 (worst) through 16 (best). Most
+// applications will prefer CompressHC.
+func CompressHCLevel(in, out []byte, level int) (outSize int, err error) {
+	// LZ4HC does not handle empty buffers. Pass through to Compress.
+	if len(in) == 0 || len(out) == 0 {
+		return Compress(in, out)
+	}
+
+	outSize = int(C.LZ4_compressHC2_limitedOutput(p(in), p(out), clen(in), clen(out), C.int(level)))
+	if outSize == 0 {
+		err = fmt.Errorf("insufficient space for compression")
+	}
+	return
+}
@@ -0,0 +1,143 @@
+CANTO I
+
+
+IN the midway of this our mortal life,
+I found me in a gloomy wood, astray
+Gone from the path direct: and e'en to tell
+It were no easy task, how savage wild
+That forest, how robust and rough its growth,
+Which to remember only, my dismay
+Renews, in bitterness not far from death.
+Yet to discourse of what there good befell,
+All else will I relate discover'd there.
+How first I enter'd it I scarce can say,
+Such sleepy dullness in that instant weigh'd
+My senses down, when the true path I left,
+But when a mountain's foot I reach'd, where clos'd
+The valley, that had pierc'd my heart with dread,
+I look'd aloft, and saw his shoulders broad
+Already vested with that planet's beam,
+Who leads all wanderers safe through every way.
+
+Then was a little respite to the fear,
+That in my heart's recesses deep had lain,
+All of that night, so pitifully pass'd:
+And as a man, with difficult short breath,
+Forespent with toiling, 'scap'd from sea to shore,
+Turns to the perilous wide waste, and stands
+At gaze; e'en so my spirit, that yet fail'd
+Struggling with terror, turn'd to view the straits,
+That none hath pass'd and liv'd.  My weary frame
+After short pause recomforted, again
+I journey'd on over that lonely steep,
+
+The hinder foot still firmer.  Scarce the ascent
+Began, when, lo! a panther, nimble, light,
+And cover'd with a speckled skin, appear'd,
+Nor, when it saw me, vanish'd, rather strove
+To check my onward going; that ofttimes
+With purpose to retrace my steps I turn'd.
+
+The hour was morning's prime, and on his way
+Aloft the sun ascended with those stars,
+That with him rose, when Love divine first mov'd
+Those its fair works: so that with joyous hope
+All things conspir'd to fill me, the gay skin
+Of that swift animal, the matin dawn
+And the sweet season.  Soon that joy was chas'd,
+And by new dread succeeded, when in view
+A lion came, 'gainst me, as it appear'd,
+
+With his head held aloft and hunger-mad,
+That e'en the air was fear-struck.  A she-wolf
+Was at his heels, who in her leanness seem'd
+Full of all wants, and many a land hath made
+Disconsolate ere now.  She with such fear
+O'erwhelmed me, at the sight of her appall'd,
+That of the height all hope I lost.  As one,
+Who with his gain elated, sees the time
+When all unwares is gone, he inwardly
+Mourns with heart-griping anguish; such was I,
+Haunted by that fell beast, never at peace,
+Who coming o'er against me, by degrees
+Impell'd me where the sun in silence rests.
+
+While to the lower space with backward step
+I fell, my ken discern'd the form one of one,
+Whose voice seem'd faint through long disuse of speech.
+When him in that great desert I espied,
+"Have mercy on me!" cried I out aloud,
+"Spirit! or living man! what e'er thou be!"
+
+He answer'd: "Now not man, man once I was,
+And born of Lombard parents, Mantuana both
+By country, when the power of Julius yet
+Was scarcely firm.  At Rome my life was past
+Beneath the mild Augustus, in the time
+Of fabled deities and false.  A bard
+Was I, and made Anchises' upright son
+The subject of my song, who came from Troy,
+When the flames prey'd on Ilium's haughty towers.
+But thou, say wherefore to such perils past
+Return'st thou?  wherefore not this pleasant mount
+Ascendest, cause and source of all delight?"
+"And art thou then that Virgil, that well-spring,
+From which such copious floods of eloquence
+Have issued?"  I with front abash'd replied.
+"Glory and light of all the tuneful train!
+May it avail me that I long with zeal
+Have sought thy volume, and with love immense
+Have conn'd it o'er.  My master thou and guide!
+Thou he from whom alone I have deriv'd
+That style, which for its beauty into fame
+Exalts me.  See the beast, from whom I fled.
+O save me from her, thou illustrious sage!"
+
+"For every vein and pulse throughout my frame
+She hath made tremble."  He, soon as he saw
+That I was weeping, answer'd, "Thou must needs
+Another way pursue, if thou wouldst 'scape
+From out that savage wilderness.  This beast,
+At whom thou criest, her way will suffer none
+To pass, and no less hindrance makes than death:
+So bad and so accursed in her kind,
+That never sated is her ravenous will,
+Still after food more craving than before.
+To many an animal in wedlock vile
+She fastens, and shall yet to many more,
+Until that greyhound come, who shall destroy
+Her with sharp pain.  He will not life support
+By earth nor its base metals, but by love,
+Wisdom, and virtue, and his land shall be
+The land 'twixt either Feltro.  In his might
+Shall safety to Italia's plains arise,
+For whose fair realm, Camilla, virgin pure,
+Nisus, Euryalus, and Turnus fell.
+He with incessant chase through every town
+Shall worry, until he to hell at length
+Restore her, thence by envy first let loose.
+I for thy profit pond'ring now devise,
+That thou mayst follow me, and I thy guide
+Will lead thee hence through an eternal space,
+Where thou shalt hear despairing shrieks, and see
+Spirits of old tormented, who invoke
+A second death; and those next view, who dwell
+Content in fire, for that they hope to come,
+Whene'er the time may be, among the blest,
+Into whose regions if thou then desire
+T' ascend, a spirit worthier then I
+Must lead thee, in whose charge, when I depart,
+Thou shalt be left: for that Almighty King,
+Who reigns above, a rebel to his law,
+Adjudges me, and therefore hath decreed,
+That to his city none through me should come.
+He in all parts hath sway; there rules, there holds
+His citadel and throne.  O happy those,
+Whom there he chooses!"  I to him in few:
+"Bard! by that God, whom thou didst not adore,
+I do beseech thee (that this ill and worse
+I may escape) to lead me, where thou saidst,
+That I Saint Peter's gate may view, and those
+Who as thou tell'st, are in such dismal plight."
+
+Onward he mov'd, I close his steps pursu'd.
@@ -0,0 +1,2 @@
+/bin
+/gopath
@@ -0,0 +1,16 @@
+language: go
+
+go:
+  - "1.9"
+  - "1.10"
+
+install:
+ - go get -v -t github.com/coreos/go-oidc/...
+ - go get golang.org/x/tools/cmd/cover
+ - go get github.com/golang/lint/golint
+
+script:
+ - ./test
+
+notifications:
+  email: false
@@ -0,0 +1,71 @@
+# How to Contribute
+
+CoreOS projects are [Apache 2.0 licensed](LICENSE) and accept contributions via
+GitHub pull requests.  This document outlines some of the conventions on
+development workflow, commit message formatting, contact points and other
+resources to make it easier to get your contribution accepted.
+
+# Certificate of Origin
+
+By contributing to this project you agree to the Developer Certificate of
+Origin (DCO). This document was created by the Linux Kernel community and is a
+simple statement that you, as a contributor, have the legal right to make the
+contribution. See the [DCO](DCO) file for details.
+
+# Email and Chat
+
+The project currently uses the general CoreOS email list and IRC channel:
+- Email: [coreos-dev](https://groups.google.com/forum/#!forum/coreos-dev)
+- IRC: #[coreos](irc://irc.freenode.org:6667/#coreos) IRC channel on freenode.org
+
+Please avoid emailing maintainers found in the MAINTAINERS file directly. They
+are very busy and read the mailing lists.
+
+## Getting Started
+
+- Fork the repository on GitHub
+- Read the [README](README.md) for build and test instructions
+- Play with the project, submit bugs, submit patches!
+
+## Contribution Flow
+
+This is a rough outline of what a contributor's workflow looks like:
+
+- Create a topic branch from where you want to base your work (usually master).
+- Make commits of logical units.
+- Make sure your commit messages are in the proper format (see below).
+- Push your changes to a topic branch in your fork of the repository.
+- Make sure the tests pass, and add any new tests as appropriate.
+- Submit a pull request to the original repository.
+
+Thanks for your contributions!
+
+### Format of the Commit Message
+
+We follow a rough convention for commit messages that is designed to answer two
+questions: what changed and why. The subject line should feature the what and
+the body of the commit should describe the why.
+
+```
+scripts: add the test-cluster command
+
+this uses tmux to setup a test cluster that you can easily kill and
+start for debugging.
+
+Fixes #38
+```
+
+The format can be described more formally as follows:
+
+```
+<subsystem>: <what changed>
+<BLANK LINE>
+<why this change was made>
+<BLANK LINE>
+<footer>
+```
+
+The first line is the subject and should be no longer than 70 characters, the
+second line is always blank, and other lines should be wrapped at 80 characters.
+This allows the message to be easier to read on GitHub as well as in various
+git tools.
@@ -0,0 +1,36 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+660 York Street, Suite 102,
+San Francisco, CA 94110 USA
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.
@@ -0,0 +1,3 @@
+Eric Chiang <ericchiang@google.com> (@ericchiang)
+Mike Danese <mikedanese@google.com> (@mikedanese)
+Rithu Leena John <rjohn@redhat.com> (@rithujohn191)
@@ -0,0 +1,72 @@
+# go-oidc
+
+[![GoDoc](https://godoc.org/github.com/coreos/go-oidc?status.svg)](https://godoc.org/github.com/coreos/go-oidc)
+[![Build Status](https://travis-ci.org/coreos/go-oidc.png?branch=master)](https://travis-ci.org/coreos/go-oidc)
+
+## OpenID Connect support for Go
+
+This package enables OpenID Connect support for the [golang.org/x/oauth2](https://godoc.org/golang.org/x/oauth2) package.
+
+```go
+provider, err := oidc.NewProvider(ctx, "https://accounts.google.com")
+if err != nil {
+    // handle error
+}
+
+// Configure an OpenID Connect aware OAuth2 client.
+oauth2Config := oauth2.Config{
+    ClientID:     clientID,
+    ClientSecret: clientSecret,
+    RedirectURL:  redirectURL,
+
+    // Discovery returns the OAuth2 endpoints.
+    Endpoint: provider.Endpoint(),
+
+    // "openid" is a required scope for OpenID Connect flows.
+    Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
+}
+```
+
+OAuth2 redirects are unchanged.
+
+```go
+func handleRedirect(w http.ResponseWriter, r *http.Request) {
+    http.Redirect(w, r, oauth2Config.AuthCodeURL(state), http.StatusFound)
+}
+```
+
+The on responses, the provider can be used to verify ID Tokens.
+
+```go
+var verifier = provider.Verifier(&oidc.Config{ClientID: clientID})
+
+func handleOAuth2Callback(w http.ResponseWriter, r *http.Request) {
+    // Verify state and errors.
+
+    oauth2Token, err := oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
+    if err != nil {
+        // handle error
+    }
+
+    // Extract the ID Token from OAuth2 token.
+    rawIDToken, ok := oauth2Token.Extra("id_token").(string)
+    if !ok {
+        // handle missing token
+    }
+
+    // Parse and verify ID Token payload.
+    idToken, err := verifier.Verify(ctx, rawIDToken)
+    if err != nil {
+        // handle error
+    }
+
+    // Extract custom claims
+    var claims struct {
+        Email    string `json:"email"`
+        Verified bool   `json:"email_verified"`
+    }
+    if err := idToken.Claims(&claims); err != nil {
+        // handle error
+    }
+}
+```
@@ -0,0 +1,61 @@
+## CoreOS Community Code of Conduct
+
+### Contributor Code of Conduct
+
+As contributors and maintainers of this project, and in the interest of
+fostering an open and welcoming community, we pledge to respect all people who
+contribute through reporting issues, posting feature requests, updating
+documentation, submitting pull requests or patches, and other activities.
+
+We are committed to making participation in this project a harassment-free
+experience for everyone, regardless of level of experience, gender, gender
+identity and expression, sexual orientation, disability, personal appearance,
+body size, race, ethnicity, age, religion, or nationality.
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery
+* Personal attacks
+* Trolling or insulting/derogatory comments
+* Public or private harassment
+* Publishing others' private information, such as physical or electronic addresses, without explicit permission
+* Other unethical or unprofessional conduct.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct. By adopting this Code of Conduct,
+project maintainers commit themselves to fairly and consistently applying these
+principles to every aspect of managing this project. Project maintainers who do
+not follow or enforce the Code of Conduct may be permanently removed from the
+project team.
+
+This code of conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community.
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting a project maintainer, Brandon Philips
+<brandon.philips@coreos.com>, and/or Rithu John <rithu.john@coreos.com>.
+
+This Code of Conduct is adapted from the Contributor Covenant
+(http://contributor-covenant.org), version 1.2.0, available at
+http://contributor-covenant.org/version/1/2/0/
+
+### CoreOS Events Code of Conduct
+
+CoreOS events are working conferences intended for professional networking and
+collaboration in the CoreOS community. Attendees are expected to behave
+according to professional standards and in accordance with their employer’s
+policies on appropriate workplace behavior.
+
+While at CoreOS events or related social networking opportunities, attendees
+should not engage in discriminatory or offensive speech or actions including
+but not limited to gender, sexuality, race, age, disability, or religion.
+Speakers should be especially aware of these concerns.
+
+CoreOS does not condone any statements by speakers contrary to these standards.
+CoreOS reserves the right to deny entrance and/or eject from an event (without
+refund) any individual found to be engaging in discriminatory or offensive
+speech or actions.
+
+Please bring any concerns to the immediate attention of designated on-site
+staff, Brandon Philips <brandon.philips@coreos.com>, and/or Rithu John <rithu.john@coreos.com>.
@@ -1,7 +0,0 @@
-package http
-
-import "net/http"
-
-type Client interface {
-	Do(*http.Request) (*http.Response, error)
-}
@@ -1,2 +0,0 @@
-// Package http is DEPRECATED. Use net/http instead.
-package http
@@ -1,161 +0,0 @@
-package http
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"log"
-	"net/http"
-	"net/url"
-	"path"
-	"strconv"
-	"strings"
-	"time"
-)
-
-func WriteError(w http.ResponseWriter, code int, msg string) {
-	e := struct {
-		Error string `json:"error"`
-	}{
-		Error: msg,
-	}
-	b, err := json.Marshal(e)
-	if err != nil {
-		log.Printf("go-oidc: failed to marshal %#v: %v", e, err)
-		code = http.StatusInternalServerError
-		b = []byte(`{"error":"server_error"}`)
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(code)
-	w.Write(b)
-}
-
-// BasicAuth parses a username and password from the request's
-// Authorization header. This was pulled from golang master:
-// https://codereview.appspot.com/76540043
-func BasicAuth(r *http.Request) (username, password string, ok bool) {
-	auth := r.Header.Get("Authorization")
-	if auth == "" {
-		return
-	}
-
-	if !strings.HasPrefix(auth, "Basic ") {
-		return
-	}
-	c, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(auth, "Basic "))
-	if err != nil {
-		return
-	}
-	cs := string(c)
-	s := strings.IndexByte(cs, ':')
-	if s < 0 {
-		return
-	}
-	return cs[:s], cs[s+1:], true
-}
-
-func cacheControlMaxAge(hdr string) (time.Duration, bool, error) {
-	for _, field := range strings.Split(hdr, ",") {
-		parts := strings.SplitN(strings.TrimSpace(field), "=", 2)
-		k := strings.ToLower(strings.TrimSpace(parts[0]))
-		if k != "max-age" {
-			continue
-		}
-
-		if len(parts) == 1 {
-			return 0, false, errors.New("max-age has no value")
-		}
-
-		v := strings.TrimSpace(parts[1])
-		if v == "" {
-			return 0, false, errors.New("max-age has empty value")
-		}
-
-		age, err := strconv.Atoi(v)
-		if err != nil {
-			return 0, false, err
-		}
-
-		if age <= 0 {
-			return 0, false, nil
-		}
-
-		return time.Duration(age) * time.Second, true, nil
-	}
-
-	return 0, false, nil
-}
-
-func expires(date, expires string) (time.Duration, bool, error) {
-	if date == "" || expires == "" {
-		return 0, false, nil
-	}
-
-	var te time.Time
-	var err error
-	if expires == "0" {
-		return 0, false, nil
-	}
-	te, err = time.Parse(time.RFC1123, expires)
-	if err != nil {
-		return 0, false, err
-	}
-
-	td, err := time.Parse(time.RFC1123, date)
-	if err != nil {
-		return 0, false, err
-	}
-
-	ttl := te.Sub(td)
-
-	// headers indicate data already expired, caller should not
-	// have to care about this case
-	if ttl <= 0 {
-		return 0, false, nil
-	}
-
-	return ttl, true, nil
-}
-
-func Cacheable(hdr http.Header) (time.Duration, bool, error) {
-	ttl, ok, err := cacheControlMaxAge(hdr.Get("Cache-Control"))
-	if err != nil || ok {
-		return ttl, ok, err
-	}
-
-	return expires(hdr.Get("Date"), hdr.Get("Expires"))
-}
-
-// MergeQuery appends additional query values to an existing URL.
-func MergeQuery(u url.URL, q url.Values) url.URL {
-	uv := u.Query()
-	for k, vs := range q {
-		for _, v := range vs {
-			uv.Add(k, v)
-		}
-	}
-	u.RawQuery = uv.Encode()
-	return u
-}
-
-// NewResourceLocation appends a resource id to the end of the requested URL path.
-func NewResourceLocation(reqURL *url.URL, id string) string {
-	var u url.URL
-	u = *reqURL
-	u.Path = path.Join(u.Path, id)
-	u.RawQuery = ""
-	u.Fragment = ""
-	return u.String()
-}
-
-// CopyRequest returns a clone of the provided *http.Request.
-// The returned object is a shallow copy of the struct and a
-// deep copy of its Header field.
-func CopyRequest(r *http.Request) *http.Request {
-	r2 := *r
-	r2.Header = make(http.Header)
-	for k, s := range r.Header {
-		r2.Header[k] = s
-	}
-	return &r2
-}
@@ -1,29 +0,0 @@
-package http
-
-import (
-	"errors"
-	"net/url"
-)
-
-// ParseNonEmptyURL checks that a string is a parsable URL which is also not empty
-// since `url.Parse("")` does not return an error. Must contian a scheme and a host.
-func ParseNonEmptyURL(u string) (*url.URL, error) {
-	if u == "" {
-		return nil, errors.New("url is empty")
-	}
-
-	ur, err := url.Parse(u)
-	if err != nil {
-		return nil, err
-	}
-
-	if ur.Scheme == "" {
-		return nil, errors.New("url scheme is empty")
-	}
-
-	if ur.Host == "" {
-		return nil, errors.New("url host is empty")
-	}
-
-	return ur, nil
-}
@@ -0,0 +1,20 @@
+// +build !golint
+
+// Don't lint this file. We don't want to have to add a comment to each constant.
+
+package oidc
+
+const (
+	// JOSE asymmetric signing algorithm values as defined by RFC 7518
+	//
+	// see: https://tools.ietf.org/html/rfc7518#section-3.1
+	RS256 = "RS256" // RSASSA-PKCS-v1.5 using SHA-256
+	RS384 = "RS384" // RSASSA-PKCS-v1.5 using SHA-384
+	RS512 = "RS512" // RSASSA-PKCS-v1.5 using SHA-512
+	ES256 = "ES256" // ECDSA using P-256 and SHA-256
+	ES384 = "ES384" // ECDSA using P-384 and SHA-384
+	ES512 = "ES512" // ECDSA using P-521 and SHA-512
+	PS256 = "PS256" // RSASSA-PSS using SHA256 and MGF1-SHA256
+	PS384 = "PS384" // RSASSA-PSS using SHA384 and MGF1-SHA384
+	PS512 = "PS512" // RSASSA-PSS using SHA512 and MGF1-SHA512
+)
@@ -0,0 +1,228 @@
+package oidc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/pquerna/cachecontrol"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+// keysExpiryDelta is the allowed clock skew between a client and the OpenID Connect
+// server.
+//
+// When keys expire, they are valid for this amount of time after.
+//
+// If the keys have not expired, and an ID Token claims it was signed by a key not in
+// the cache, if and only if the keys expire in this amount of time, the keys will be
+// updated.
+const keysExpiryDelta = 30 * time.Second
+
+// NewRemoteKeySet returns a KeySet that can validate JSON web tokens by using HTTP
+// GETs to fetch JSON web token sets hosted at a remote URL. This is automatically
+// used by NewProvider using the URLs returned by OpenID Connect discovery, but is
+// exposed for providers that don't support discovery or to prevent round trips to the
+// discovery URL.
+//
+// The returned KeySet is a long lived verifier that caches keys based on cache-control
+// headers. Reuse a common remote key set instead of creating new ones as needed.
+//
+// The behavior of the returned KeySet is undefined once the context is canceled.
+func NewRemoteKeySet(ctx context.Context, jwksURL string) KeySet {
+	return newRemoteKeySet(ctx, jwksURL, time.Now)
+}
+
+func newRemoteKeySet(ctx context.Context, jwksURL string, now func() time.Time) *remoteKeySet {
+	if now == nil {
+		now = time.Now
+	}
+	return &remoteKeySet{jwksURL: jwksURL, ctx: ctx, now: now}
+}
+
+type remoteKeySet struct {
+	jwksURL string
+	ctx     context.Context
+	now     func() time.Time
+
+	// guard all other fields
+	mu sync.Mutex
+
+	// inflight suppresses parallel execution of updateKeys and allows
+	// multiple goroutines to wait for its result.
+	inflight *inflight
+
+	// A set of cached keys and their expiry.
+	cachedKeys []jose.JSONWebKey
+	expiry     time.Time
+}
+
+// inflight is used to wait on some in-flight request from multiple goroutines.
+type inflight struct {
+	doneCh chan struct{}
+
+	keys []jose.JSONWebKey
+	err  error
+}
+
+func newInflight() *inflight {
+	return &inflight{doneCh: make(chan struct{})}
+}
+
+// wait returns a channel that multiple goroutines can receive on. Once it returns
+// a value, the inflight request is done and result() can be inspected.
+func (i *inflight) wait() <-chan struct{} {
+	return i.doneCh
+}
+
+// done can only be called by a single goroutine. It records the result of the
+// inflight request and signals other goroutines that the result is safe to
+// inspect.
+func (i *inflight) done(keys []jose.JSONWebKey, err error) {
+	i.keys = keys
+	i.err = err
+	close(i.doneCh)
+}
+
+// result cannot be called until the wait() channel has returned a value.
+func (i *inflight) result() ([]jose.JSONWebKey, error) {
+	return i.keys, i.err
+}
+
+func (r *remoteKeySet) VerifySignature(ctx context.Context, jwt string) ([]byte, error) {
+	jws, err := jose.ParseSigned(jwt)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt: %v", err)
+	}
+	return r.verify(ctx, jws)
+}
+
+func (r *remoteKeySet) verify(ctx context.Context, jws *jose.JSONWebSignature) ([]byte, error) {
+	// We don't support JWTs signed with multiple signatures.
+	keyID := ""
+	for _, sig := range jws.Signatures {
+		keyID = sig.Header.KeyID
+		break
+	}
+
+	keys, expiry := r.keysFromCache()
+
+	// Don't check expiry yet. This optimizes for when the provider is unavailable.
+	for _, key := range keys {
+		if keyID == "" || key.KeyID == keyID {
+			if payload, err := jws.Verify(&key); err == nil {
+				return payload, nil
+			}
+		}
+	}
+
+	if !r.now().Add(keysExpiryDelta).After(expiry) {
+		// Keys haven't expired, don't refresh.
+		return nil, errors.New("failed to verify id token signature")
+	}
+
+	keys, err := r.keysFromRemote(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("fetching keys %v", err)
+	}
+
+	for _, key := range keys {
+		if keyID == "" || key.KeyID == keyID {
+			if payload, err := jws.Verify(&key); err == nil {
+				return payload, nil
+			}
+		}
+	}
+	return nil, errors.New("failed to verify id token signature")
+}
+
+func (r *remoteKeySet) keysFromCache() (keys []jose.JSONWebKey, expiry time.Time) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.cachedKeys, r.expiry
+}
+
+// keysFromRemote syncs the key set from the remote set, records the values in the
+// cache, and returns the key set.
+func (r *remoteKeySet) keysFromRemote(ctx context.Context) ([]jose.JSONWebKey, error) {
+	// Need to lock to inspect the inflight request field.
+	r.mu.Lock()
+	// If there's not a current inflight request, create one.
+	if r.inflight == nil {
+		r.inflight = newInflight()
+
+		// This goroutine has exclusive ownership over the current inflight
+		// request. It releases the resource by nil'ing the inflight field
+		// once the goroutine is done.
+		go func() {
+			// Sync keys and finish inflight when that's done.
+			keys, expiry, err := r.updateKeys()
+
+			r.inflight.done(keys, err)
+
+			// Lock to update the keys and indicate that there is no longer an
+			// inflight request.
+			r.mu.Lock()
+			defer r.mu.Unlock()
+
+			if err == nil {
+				r.cachedKeys = keys
+				r.expiry = expiry
+			}
+
+			// Free inflight so a different request can run.
+			r.inflight = nil
+		}()
+	}
+	inflight := r.inflight
+	r.mu.Unlock()
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case <-inflight.wait():
+		return inflight.result()
+	}
+}
+
+func (r *remoteKeySet) updateKeys() ([]jose.JSONWebKey, time.Time, error) {
+	req, err := http.NewRequest("GET", r.jwksURL, nil)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("oidc: can't create request: %v", err)
+	}
+
+	resp, err := doRequest(r.ctx, req)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("oidc: get keys failed %v", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("unable to read response body: %v", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, time.Time{}, fmt.Errorf("oidc: get keys failed: %s %s", resp.Status, body)
+	}
+
+	var keySet jose.JSONWebKeySet
+	err = unmarshalResp(resp, body, &keySet)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("oidc: failed to decode keys: %v %s", err, body)
+	}
+
+	// If the server doesn't provide cache control headers, assume the
+	// keys expire immediately.
+	expiry := r.now()
+
+	_, e, err := cachecontrol.CachableResponse(req, resp, cachecontrol.Options{})
+	if err == nil && e.After(expiry) {
+		expiry = e
+	}
+	return keySet.Keys, expiry, nil
+}
@@ -1,2 +0,0 @@
-// Package key is DEPRECATED. Use github.com/coreos/go-oidc instead.
-package key
@@ -1,153 +0,0 @@
-package key
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-	"encoding/hex"
-	"encoding/json"
-	"io"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-)
-
-func NewPublicKey(jwk jose.JWK) *PublicKey {
-	return &PublicKey{jwk: jwk}
-}
-
-type PublicKey struct {
-	jwk jose.JWK
-}
-
-func (k *PublicKey) MarshalJSON() ([]byte, error) {
-	return json.Marshal(&k.jwk)
-}
-
-func (k *PublicKey) UnmarshalJSON(data []byte) error {
-	var jwk jose.JWK
-	if err := json.Unmarshal(data, &jwk); err != nil {
-		return err
-	}
-	k.jwk = jwk
-	return nil
-}
-
-func (k *PublicKey) ID() string {
-	return k.jwk.ID
-}
-
-func (k *PublicKey) Verifier() (jose.Verifier, error) {
-	return jose.NewVerifierRSA(k.jwk)
-}
-
-type PrivateKey struct {
-	KeyID      string
-	PrivateKey *rsa.PrivateKey
-}
-
-func (k *PrivateKey) ID() string {
-	return k.KeyID
-}
-
-func (k *PrivateKey) Signer() jose.Signer {
-	return jose.NewSignerRSA(k.ID(), *k.PrivateKey)
-}
-
-func (k *PrivateKey) JWK() jose.JWK {
-	return jose.JWK{
-		ID:       k.KeyID,
-		Type:     "RSA",
-		Alg:      "RS256",
-		Use:      "sig",
-		Exponent: k.PrivateKey.PublicKey.E,
-		Modulus:  k.PrivateKey.PublicKey.N,
-	}
-}
-
-type KeySet interface {
-	ExpiresAt() time.Time
-}
-
-type PublicKeySet struct {
-	keys      []PublicKey
-	index     map[string]*PublicKey
-	expiresAt time.Time
-}
-
-func NewPublicKeySet(jwks []jose.JWK, exp time.Time) *PublicKeySet {
-	keys := make([]PublicKey, len(jwks))
-	index := make(map[string]*PublicKey)
-	for i, jwk := range jwks {
-		keys[i] = *NewPublicKey(jwk)
-		index[keys[i].ID()] = &keys[i]
-	}
-	return &PublicKeySet{
-		keys:      keys,
-		index:     index,
-		expiresAt: exp,
-	}
-}
-
-func (s *PublicKeySet) ExpiresAt() time.Time {
-	return s.expiresAt
-}
-
-func (s *PublicKeySet) Keys() []PublicKey {
-	return s.keys
-}
-
-func (s *PublicKeySet) Key(id string) *PublicKey {
-	return s.index[id]
-}
-
-type PrivateKeySet struct {
-	keys        []*PrivateKey
-	ActiveKeyID string
-	expiresAt   time.Time
-}
-
-func NewPrivateKeySet(keys []*PrivateKey, exp time.Time) *PrivateKeySet {
-	return &PrivateKeySet{
-		keys:        keys,
-		ActiveKeyID: keys[0].ID(),
-		expiresAt:   exp.UTC(),
-	}
-}
-
-func (s *PrivateKeySet) Keys() []*PrivateKey {
-	return s.keys
-}
-
-func (s *PrivateKeySet) ExpiresAt() time.Time {
-	return s.expiresAt
-}
-
-func (s *PrivateKeySet) Active() *PrivateKey {
-	for i, k := range s.keys {
-		if k.ID() == s.ActiveKeyID {
-			return s.keys[i]
-		}
-	}
-
-	return nil
-}
-
-type GeneratePrivateKeyFunc func() (*PrivateKey, error)
-
-func GeneratePrivateKey() (*PrivateKey, error) {
-	pk, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return nil, err
-	}
-	keyID := make([]byte, 20)
-	if _, err := io.ReadFull(rand.Reader, keyID); err != nil {
-		return nil, err
-	}
-
-	k := PrivateKey{
-		KeyID:      hex.EncodeToString(keyID),
-		PrivateKey: pk,
-	}
-
-	return &k, nil
-}
@@ -1,99 +0,0 @@
-package key
-
-import (
-	"errors"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/pkg/health"
-)
-
-type PrivateKeyManager interface {
-	ExpiresAt() time.Time
-	Signer() (jose.Signer, error)
-	JWKs() ([]jose.JWK, error)
-	PublicKeys() ([]PublicKey, error)
-
-	WritableKeySetRepo
-	health.Checkable
-}
-
-func NewPrivateKeyManager() PrivateKeyManager {
-	return &privateKeyManager{
-		clock: clockwork.NewRealClock(),
-	}
-}
-
-type privateKeyManager struct {
-	keySet *PrivateKeySet
-	clock  clockwork.Clock
-}
-
-func (m *privateKeyManager) ExpiresAt() time.Time {
-	if m.keySet == nil {
-		return m.clock.Now().UTC()
-	}
-
-	return m.keySet.ExpiresAt()
-}
-
-func (m *privateKeyManager) Signer() (jose.Signer, error) {
-	if err := m.Healthy(); err != nil {
-		return nil, err
-	}
-
-	return m.keySet.Active().Signer(), nil
-}
-
-func (m *privateKeyManager) JWKs() ([]jose.JWK, error) {
-	if err := m.Healthy(); err != nil {
-		return nil, err
-	}
-
-	keys := m.keySet.Keys()
-	jwks := make([]jose.JWK, len(keys))
-	for i, k := range keys {
-		jwks[i] = k.JWK()
-	}
-	return jwks, nil
-}
-
-func (m *privateKeyManager) PublicKeys() ([]PublicKey, error) {
-	jwks, err := m.JWKs()
-	if err != nil {
-		return nil, err
-	}
-	keys := make([]PublicKey, len(jwks))
-	for i, jwk := range jwks {
-		keys[i] = *NewPublicKey(jwk)
-	}
-	return keys, nil
-}
-
-func (m *privateKeyManager) Healthy() error {
-	if m.keySet == nil {
-		return errors.New("private key manager uninitialized")
-	}
-
-	if len(m.keySet.Keys()) == 0 {
-		return errors.New("private key manager zero keys")
-	}
-
-	if m.keySet.ExpiresAt().Before(m.clock.Now().UTC()) {
-		return errors.New("private key manager keys expired")
-	}
-
-	return nil
-}
-
-func (m *privateKeyManager) Set(keySet KeySet) error {
-	privKeySet, ok := keySet.(*PrivateKeySet)
-	if !ok {
-		return errors.New("unable to cast to PrivateKeySet")
-	}
-
-	m.keySet = privKeySet
-	return nil
-}
@@ -1,55 +0,0 @@
-package key
-
-import (
-	"errors"
-	"sync"
-)
-
-var ErrorNoKeys = errors.New("no keys found")
-
-type WritableKeySetRepo interface {
-	Set(KeySet) error
-}
-
-type ReadableKeySetRepo interface {
-	Get() (KeySet, error)
-}
-
-type PrivateKeySetRepo interface {
-	WritableKeySetRepo
-	ReadableKeySetRepo
-}
-
-func NewPrivateKeySetRepo() PrivateKeySetRepo {
-	return &memPrivateKeySetRepo{}
-}
-
-type memPrivateKeySetRepo struct {
-	mu  sync.RWMutex
-	pks PrivateKeySet
-}
-
-func (r *memPrivateKeySetRepo) Set(ks KeySet) error {
-	pks, ok := ks.(*PrivateKeySet)
-	if !ok {
-		return errors.New("unable to cast to PrivateKeySet")
-	} else if pks == nil {
-		return errors.New("nil KeySet")
-	}
-
-	r.mu.Lock()
-	defer r.mu.Unlock()
-
-	r.pks = *pks
-	return nil
-}
-
-func (r *memPrivateKeySetRepo) Get() (KeySet, error) {
-	r.mu.RLock()
-	defer r.mu.RUnlock()
-
-	if r.pks.keys == nil {
-		return nil, ErrorNoKeys
-	}
-	return KeySet(&r.pks), nil
-}
@@ -1,159 +0,0 @@
-package key
-
-import (
-	"errors"
-	"log"
-	"time"
-
-	ptime "github.com/coreos/pkg/timeutil"
-	"github.com/jonboulle/clockwork"
-)
-
-var (
-	ErrorPrivateKeysExpired = errors.New("private keys have expired")
-)
-
-func NewPrivateKeyRotator(repo PrivateKeySetRepo, ttl time.Duration) *PrivateKeyRotator {
-	return &PrivateKeyRotator{
-		repo: repo,
-		ttl:  ttl,
-
-		keep:        2,
-		generateKey: GeneratePrivateKey,
-		clock:       clockwork.NewRealClock(),
-	}
-}
-
-type PrivateKeyRotator struct {
-	repo        PrivateKeySetRepo
-	generateKey GeneratePrivateKeyFunc
-	clock       clockwork.Clock
-	keep        int
-	ttl         time.Duration
-}
-
-func (r *PrivateKeyRotator) expiresAt() time.Time {
-	return r.clock.Now().UTC().Add(r.ttl)
-}
-
-func (r *PrivateKeyRotator) Healthy() error {
-	pks, err := r.privateKeySet()
-	if err != nil {
-		return err
-	}
-
-	if r.clock.Now().After(pks.ExpiresAt()) {
-		return ErrorPrivateKeysExpired
-	}
-
-	return nil
-}
-
-func (r *PrivateKeyRotator) privateKeySet() (*PrivateKeySet, error) {
-	ks, err := r.repo.Get()
-	if err != nil {
-		return nil, err
-	}
-
-	pks, ok := ks.(*PrivateKeySet)
-	if !ok {
-		return nil, errors.New("unable to cast to PrivateKeySet")
-	}
-	return pks, nil
-}
-
-func (r *PrivateKeyRotator) nextRotation() (time.Duration, error) {
-	pks, err := r.privateKeySet()
-	if err == ErrorNoKeys {
-		return 0, nil
-	}
-	if err != nil {
-		return 0, err
-	}
-
-	now := r.clock.Now()
-
-	// Ideally, we want to rotate after half the TTL has elapsed.
-	idealRotationTime := pks.ExpiresAt().Add(-r.ttl / 2)
-
-	// If we are past the ideal rotation time, rotate immediatly.
-	return max(0, idealRotationTime.Sub(now)), nil
-}
-
-func max(a, b time.Duration) time.Duration {
-	if a > b {
-		return a
-	}
-	return b
-}
-
-func (r *PrivateKeyRotator) Run() chan struct{} {
-	attempt := func() {
-		k, err := r.generateKey()
-		if err != nil {
-			log.Printf("go-oidc: failed generating signing key: %v", err)
-			return
-		}
-
-		exp := r.expiresAt()
-		if err := rotatePrivateKeys(r.repo, k, r.keep, exp); err != nil {
-			log.Printf("go-oidc: key rotation failed: %v", err)
-			return
-		}
-	}
-
-	stop := make(chan struct{})
-	go func() {
-		for {
-			var nextRotation time.Duration
-			var sleep time.Duration
-			var err error
-			for {
-				if nextRotation, err = r.nextRotation(); err == nil {
-					break
-				}
-				sleep = ptime.ExpBackoff(sleep, time.Minute)
-				log.Printf("go-oidc: error getting nextRotation, retrying in %v: %v", sleep, err)
-				time.Sleep(sleep)
-			}
-
-			select {
-			case <-r.clock.After(nextRotation):
-				attempt()
-			case <-stop:
-				return
-			}
-		}
-	}()
-
-	return stop
-}
-
-func rotatePrivateKeys(repo PrivateKeySetRepo, k *PrivateKey, keep int, exp time.Time) error {
-	ks, err := repo.Get()
-	if err != nil && err != ErrorNoKeys {
-		return err
-	}
-
-	var keys []*PrivateKey
-	if ks != nil {
-		pks, ok := ks.(*PrivateKeySet)
-		if !ok {
-			return errors.New("unable to cast to PrivateKeySet")
-		}
-		keys = pks.Keys()
-	}
-
-	keys = append([]*PrivateKey{k}, keys...)
-	if l := len(keys); l > keep {
-		keys = keys[0:keep]
-	}
-
-	nks := PrivateKeySet{
-		keys:        keys,
-		ActiveKeyID: k.ID(),
-		expiresAt:   exp,
-	}
-
-	return repo.Set(KeySet(&nks))
-}
@@ -1,91 +0,0 @@
-package key
-
-import (
-	"errors"
-	"log"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-
-	"github.com/coreos/pkg/timeutil"
-)
-
-func NewKeySetSyncer(r ReadableKeySetRepo, w WritableKeySetRepo) *KeySetSyncer {
-	return &KeySetSyncer{
-		readable: r,
-		writable: w,
-		clock:    clockwork.NewRealClock(),
-	}
-}
-
-type KeySetSyncer struct {
-	readable ReadableKeySetRepo
-	writable WritableKeySetRepo
-	clock    clockwork.Clock
-}
-
-func (s *KeySetSyncer) Run() chan struct{} {
-	stop := make(chan struct{})
-	go func() {
-		var failing bool
-		var next time.Duration
-		for {
-			exp, err := syncKeySet(s.readable, s.writable, s.clock)
-			if err != nil || exp == 0 {
-				if !failing {
-					failing = true
-					next = time.Second
-				} else {
-					next = timeutil.ExpBackoff(next, time.Minute)
-				}
-				if exp == 0 {
-					log.Printf("Synced to already expired key set, retrying in %v: %v", next, err)
-
-				} else {
-					log.Printf("Failed syncing key set, retrying in %v: %v", next, err)
-				}
-			} else {
-				failing = false
-				next = exp / 2
-			}
-
-			select {
-			case <-s.clock.After(next):
-				continue
-			case <-stop:
-				return
-			}
-		}
-	}()
-
-	return stop
-}
-
-func Sync(r ReadableKeySetRepo, w WritableKeySetRepo) (time.Duration, error) {
-	return syncKeySet(r, w, clockwork.NewRealClock())
-}
-
-// syncKeySet copies the keyset from r to the KeySet at w and returns the duration in which the KeySet will expire.
-// If keyset has already expired, returns a zero duration.
-func syncKeySet(r ReadableKeySetRepo, w WritableKeySetRepo, clock clockwork.Clock) (exp time.Duration, err error) {
-	var ks KeySet
-	ks, err = r.Get()
-	if err != nil {
-		return
-	}
-
-	if ks == nil {
-		err = errors.New("no source KeySet")
-		return
-	}
-
-	if err = w.Set(ks); err != nil {
-		return
-	}
-
-	now := clock.Now()
-	if ks.ExpiresAt().After(now) {
-		exp = ks.ExpiresAt().Sub(now)
-	}
-	return
-}
@@ -1,2 +0,0 @@
-// Package oauth2 is DEPRECATED. Use golang.org/x/oauth instead.
-package oauth2
@@ -1,29 +0,0 @@
-package oauth2
-
-const (
-	ErrorAccessDenied            = "access_denied"
-	ErrorInvalidClient           = "invalid_client"
-	ErrorInvalidGrant            = "invalid_grant"
-	ErrorInvalidRequest          = "invalid_request"
-	ErrorServerError             = "server_error"
-	ErrorUnauthorizedClient      = "unauthorized_client"
-	ErrorUnsupportedGrantType    = "unsupported_grant_type"
-	ErrorUnsupportedResponseType = "unsupported_response_type"
-)
-
-type Error struct {
-	Type        string `json:"error"`
-	Description string `json:"error_description,omitempty"`
-	State       string `json:"state,omitempty"`
-}
-
-func (e *Error) Error() string {
-	if e.Description != "" {
-		return e.Type + ": " + e.Description
-	}
-	return e.Type
-}
-
-func NewError(typ string) *Error {
-	return &Error{Type: typ}
-}
@@ -1,416 +0,0 @@
-package oauth2
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"mime"
-	"net/http"
-	"net/url"
-	"sort"
-	"strconv"
-	"strings"
-
-	phttp "github.com/coreos/go-oidc/http"
-)
-
-// ResponseTypesEqual compares two response_type values. If either
-// contains a space, it is treated as an unordered list. For example,
-// comparing "code id_token" and "id_token code" would evaluate to true.
-func ResponseTypesEqual(r1, r2 string) bool {
-	if !strings.Contains(r1, " ") || !strings.Contains(r2, " ") {
-		// fast route, no split needed
-		return r1 == r2
-	}
-
-	// split, sort, and compare
-	r1Fields := strings.Fields(r1)
-	r2Fields := strings.Fields(r2)
-	if len(r1Fields) != len(r2Fields) {
-		return false
-	}
-	sort.Strings(r1Fields)
-	sort.Strings(r2Fields)
-	for i, r1Field := range r1Fields {
-		if r1Field != r2Fields[i] {
-			return false
-		}
-	}
-	return true
-}
-
-const (
-	// OAuth2.0 response types registered by OIDC.
-	//
-	// See: https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#RegistryContents
-	ResponseTypeCode             = "code"
-	ResponseTypeCodeIDToken      = "code id_token"
-	ResponseTypeCodeIDTokenToken = "code id_token token"
-	ResponseTypeIDToken          = "id_token"
-	ResponseTypeIDTokenToken     = "id_token token"
-	ResponseTypeToken            = "token"
-	ResponseTypeNone             = "none"
-)
-
-const (
-	GrantTypeAuthCode     = "authorization_code"
-	GrantTypeClientCreds  = "client_credentials"
-	GrantTypeUserCreds    = "password"
-	GrantTypeImplicit     = "implicit"
-	GrantTypeRefreshToken = "refresh_token"
-
-	AuthMethodClientSecretPost  = "client_secret_post"
-	AuthMethodClientSecretBasic = "client_secret_basic"
-	AuthMethodClientSecretJWT   = "client_secret_jwt"
-	AuthMethodPrivateKeyJWT     = "private_key_jwt"
-)
-
-type Config struct {
-	Credentials ClientCredentials
-	Scope       []string
-	RedirectURL string
-	AuthURL     string
-	TokenURL    string
-
-	// Must be one of the AuthMethodXXX methods above. Right now, only
-	// AuthMethodClientSecretPost and AuthMethodClientSecretBasic are supported.
-	AuthMethod string
-}
-
-type Client struct {
-	hc          phttp.Client
-	creds       ClientCredentials
-	scope       []string
-	authURL     *url.URL
-	redirectURL *url.URL
-	tokenURL    *url.URL
-	authMethod  string
-}
-
-type ClientCredentials struct {
-	ID     string
-	Secret string
-}
-
-func NewClient(hc phttp.Client, cfg Config) (c *Client, err error) {
-	if len(cfg.Credentials.ID) == 0 {
-		err = errors.New("missing client id")
-		return
-	}
-
-	if len(cfg.Credentials.Secret) == 0 {
-		err = errors.New("missing client secret")
-		return
-	}
-
-	if cfg.AuthMethod == "" {
-		cfg.AuthMethod = AuthMethodClientSecretBasic
-	} else if cfg.AuthMethod != AuthMethodClientSecretPost && cfg.AuthMethod != AuthMethodClientSecretBasic {
-		err = fmt.Errorf("auth method %q is not supported", cfg.AuthMethod)
-		return
-	}
-
-	au, err := phttp.ParseNonEmptyURL(cfg.AuthURL)
-	if err != nil {
-		return
-	}
-
-	tu, err := phttp.ParseNonEmptyURL(cfg.TokenURL)
-	if err != nil {
-		return
-	}
-
-	// Allow empty redirect URL in the case where the client
-	// only needs to verify a given token.
-	ru, err := url.Parse(cfg.RedirectURL)
-	if err != nil {
-		return
-	}
-
-	c = &Client{
-		creds:       cfg.Credentials,
-		scope:       cfg.Scope,
-		redirectURL: ru,
-		authURL:     au,
-		tokenURL:    tu,
-		hc:          hc,
-		authMethod:  cfg.AuthMethod,
-	}
-
-	return
-}
-
-// Return the embedded HTTP client
-func (c *Client) HttpClient() phttp.Client {
-	return c.hc
-}
-
-// Generate the url for initial redirect to oauth provider.
-func (c *Client) AuthCodeURL(state, accessType, prompt string) string {
-	v := c.commonURLValues()
-	v.Set("state", state)
-	if strings.ToLower(accessType) == "offline" {
-		v.Set("access_type", "offline")
-	}
-
-	if prompt != "" {
-		v.Set("prompt", prompt)
-	}
-	v.Set("response_type", "code")
-
-	q := v.Encode()
-	u := *c.authURL
-	if u.RawQuery == "" {
-		u.RawQuery = q
-	} else {
-		u.RawQuery += "&" + q
-	}
-	return u.String()
-}
-
-func (c *Client) commonURLValues() url.Values {
-	return url.Values{
-		"redirect_uri": {c.redirectURL.String()},
-		"scope":        {strings.Join(c.scope, " ")},
-		"client_id":    {c.creds.ID},
-	}
-}
-
-func (c *Client) newAuthenticatedRequest(urlToken string, values url.Values) (*http.Request, error) {
-	var req *http.Request
-	var err error
-	switch c.authMethod {
-	case AuthMethodClientSecretPost:
-		values.Set("client_secret", c.creds.Secret)
-		req, err = http.NewRequest("POST", urlToken, strings.NewReader(values.Encode()))
-		if err != nil {
-			return nil, err
-		}
-	case AuthMethodClientSecretBasic:
-		req, err = http.NewRequest("POST", urlToken, strings.NewReader(values.Encode()))
-		if err != nil {
-			return nil, err
-		}
-		encodedID := url.QueryEscape(c.creds.ID)
-		encodedSecret := url.QueryEscape(c.creds.Secret)
-		req.SetBasicAuth(encodedID, encodedSecret)
-	default:
-		panic("misconfigured client: auth method not supported")
-	}
-
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	return req, nil
-
-}
-
-// ClientCredsToken posts the client id and secret to obtain a token scoped to the OAuth2 client via the "client_credentials" grant type.
-// May not be supported by all OAuth2 servers.
-func (c *Client) ClientCredsToken(scope []string) (result TokenResponse, err error) {
-	v := url.Values{
-		"scope":      {strings.Join(scope, " ")},
-		"grant_type": {GrantTypeClientCreds},
-	}
-
-	req, err := c.newAuthenticatedRequest(c.tokenURL.String(), v)
-	if err != nil {
-		return
-	}
-
-	resp, err := c.hc.Do(req)
-	if err != nil {
-		return
-	}
-	defer resp.Body.Close()
-
-	return parseTokenResponse(resp)
-}
-
-// UserCredsToken posts the username and password to obtain a token scoped to the OAuth2 client via the "password" grant_type
-// May not be supported by all OAuth2 servers.
-func (c *Client) UserCredsToken(username, password string) (result TokenResponse, err error) {
-	v := url.Values{
-		"scope":      {strings.Join(c.scope, " ")},
-		"grant_type": {GrantTypeUserCreds},
-		"username":   {username},
-		"password":   {password},
-	}
-
-	req, err := c.newAuthenticatedRequest(c.tokenURL.String(), v)
-	if err != nil {
-		return
-	}
-
-	resp, err := c.hc.Do(req)
-	if err != nil {
-		return
-	}
-	defer resp.Body.Close()
-
-	return parseTokenResponse(resp)
-}
-
-// RequestToken requests a token from the Token Endpoint with the specified grantType.
-// If 'grantType' == GrantTypeAuthCode, then 'value' should be the authorization code.
-// If 'grantType' == GrantTypeRefreshToken, then 'value' should be the refresh token.
-func (c *Client) RequestToken(grantType, value string) (result TokenResponse, err error) {
-	v := c.commonURLValues()
-
-	v.Set("grant_type", grantType)
-	v.Set("client_secret", c.creds.Secret)
-	switch grantType {
-	case GrantTypeAuthCode:
-		v.Set("code", value)
-	case GrantTypeRefreshToken:
-		v.Set("refresh_token", value)
-	default:
-		err = fmt.Errorf("unsupported grant_type: %v", grantType)
-		return
-	}
-
-	req, err := c.newAuthenticatedRequest(c.tokenURL.String(), v)
-	if err != nil {
-		return
-	}
-
-	resp, err := c.hc.Do(req)
-	if err != nil {
-		return
-	}
-	defer resp.Body.Close()
-
-	return parseTokenResponse(resp)
-}
-
-func parseTokenResponse(resp *http.Response) (result TokenResponse, err error) {
-	body, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return
-	}
-	badStatusCode := resp.StatusCode < 200 || resp.StatusCode > 299
-
-	contentType, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
-	if err != nil {
-		return
-	}
-
-	result = TokenResponse{
-		RawBody: body,
-	}
-
-	newError := func(typ, desc, state string) error {
-		if typ == "" {
-			return fmt.Errorf("unrecognized error %s", body)
-		}
-		return &Error{typ, desc, state}
-	}
-
-	if contentType == "application/x-www-form-urlencoded" || contentType == "text/plain" {
-		var vals url.Values
-		vals, err = url.ParseQuery(string(body))
-		if err != nil {
-			return
-		}
-		if error := vals.Get("error"); error != "" || badStatusCode {
-			err = newError(error, vals.Get("error_description"), vals.Get("state"))
-			return
-		}
-		e := vals.Get("expires_in")
-		if e == "" {
-			e = vals.Get("expires")
-		}
-		if e != "" {
-			result.Expires, err = strconv.Atoi(e)
-			if err != nil {
-				return
-			}
-		}
-		result.AccessToken = vals.Get("access_token")
-		result.TokenType = vals.Get("token_type")
-		result.IDToken = vals.Get("id_token")
-		result.RefreshToken = vals.Get("refresh_token")
-		result.Scope = vals.Get("scope")
-	} else {
-		var r struct {
-			AccessToken  string      `json:"access_token"`
-			TokenType    string      `json:"token_type"`
-			IDToken      string      `json:"id_token"`
-			RefreshToken string      `json:"refresh_token"`
-			Scope        string      `json:"scope"`
-			State        string      `json:"state"`
-			ExpiresIn    json.Number `json:"expires_in"` // Azure AD returns string
-			Expires      int         `json:"expires"`
-			Error        string      `json:"error"`
-			Desc         string      `json:"error_description"`
-		}
-		if err = json.Unmarshal(body, &r); err != nil {
-			return
-		}
-		if r.Error != "" || badStatusCode {
-			err = newError(r.Error, r.Desc, r.State)
-			return
-		}
-		result.AccessToken = r.AccessToken
-		result.TokenType = r.TokenType
-		result.IDToken = r.IDToken
-		result.RefreshToken = r.RefreshToken
-		result.Scope = r.Scope
-		if expiresIn, err := r.ExpiresIn.Int64(); err != nil {
-			result.Expires = r.Expires
-		} else {
-			result.Expires = int(expiresIn)
-		}
-	}
-	return
-}
-
-type TokenResponse struct {
-	AccessToken  string
-	TokenType    string
-	Expires      int
-	IDToken      string
-	RefreshToken string // OPTIONAL.
-	Scope        string // OPTIONAL, if identical to the scope requested by the client, otherwise, REQUIRED.
-	RawBody      []byte // In case callers need some other non-standard info from the token response
-}
-
-type AuthCodeRequest struct {
-	ResponseType string
-	ClientID     string
-	RedirectURL  *url.URL
-	Scope        []string
-	State        string
-}
-
-func ParseAuthCodeRequest(q url.Values) (AuthCodeRequest, error) {
-	acr := AuthCodeRequest{
-		ResponseType: q.Get("response_type"),
-		ClientID:     q.Get("client_id"),
-		State:        q.Get("state"),
-		Scope:        make([]string, 0),
-	}
-
-	qs := strings.TrimSpace(q.Get("scope"))
-	if qs != "" {
-		acr.Scope = strings.Split(qs, " ")
-	}
-
-	err := func() error {
-		if acr.ClientID == "" {
-			return NewError(ErrorInvalidRequest)
-		}
-
-		redirectURL := q.Get("redirect_uri")
-		if redirectURL != "" {
-			ru, err := url.Parse(redirectURL)
-			if err != nil {
-				return NewError(ErrorInvalidRequest)
-			}
-			acr.RedirectURL = ru
-		}
-
-		return nil
-	}()
-
-	return acr, err
-}
@@ -0,0 +1,384 @@
+// Package oidc implements OpenID Connect client logic for the golang.org/x/oauth2 package.
+package oidc
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/sha512"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"hash"
+	"io/ioutil"
+	"mime"
+	"net/http"
+	"strings"
+	"time"
+
+	"golang.org/x/oauth2"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+const (
+	// ScopeOpenID is the mandatory scope for all OpenID Connect OAuth2 requests.
+	ScopeOpenID = "openid"
+
+	// ScopeOfflineAccess is an optional scope defined by OpenID Connect for requesting
+	// OAuth2 refresh tokens.
+	//
+	// Support for this scope differs between OpenID Connect providers. For instance
+	// Google rejects it, favoring appending "access_type=offline" as part of the
+	// authorization request instead.
+	//
+	// See: https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
+	ScopeOfflineAccess = "offline_access"
+)
+
+var (
+	errNoAtHash      = errors.New("id token did not have an access token hash")
+	errInvalidAtHash = errors.New("access token hash does not match value in ID token")
+)
+
+// ClientContext returns a new Context that carries the provided HTTP client.
+//
+// This method sets the same context key used by the golang.org/x/oauth2 package,
+// so the returned context works for that package too.
+//
+//    myClient := &http.Client{}
+//    ctx := oidc.ClientContext(parentContext, myClient)
+//
+//    // This will use the custom client
+//    provider, err := oidc.NewProvider(ctx, "https://accounts.example.com")
+//
+func ClientContext(ctx context.Context, client *http.Client) context.Context {
+	return context.WithValue(ctx, oauth2.HTTPClient, client)
+}
+
+func doRequest(ctx context.Context, req *http.Request) (*http.Response, error) {
+	client := http.DefaultClient
+	if c, ok := ctx.Value(oauth2.HTTPClient).(*http.Client); ok {
+		client = c
+	}
+	return client.Do(req.WithContext(ctx))
+}
+
+// Provider represents an OpenID Connect server's configuration.
+type Provider struct {
+	issuer      string
+	authURL     string
+	tokenURL    string
+	userInfoURL string
+
+	// Raw claims returned by the server.
+	rawClaims []byte
+
+	remoteKeySet KeySet
+}
+
+type cachedKeys struct {
+	keys   []jose.JSONWebKey
+	expiry time.Time
+}
+
+type providerJSON struct {
+	Issuer      string `json:"issuer"`
+	AuthURL     string `json:"authorization_endpoint"`
+	TokenURL    string `json:"token_endpoint"`
+	JWKSURL     string `json:"jwks_uri"`
+	UserInfoURL string `json:"userinfo_endpoint"`
+}
+
+// NewProvider uses the OpenID Connect discovery mechanism to construct a Provider.
+//
+// The issuer is the URL identifier for the service. For example: "https://accounts.google.com"
+// or "https://login.salesforce.com".
+func NewProvider(ctx context.Context, issuer string) (*Provider, error) {
+	wellKnown := strings.TrimSuffix(issuer, "/") + "/.well-known/openid-configuration"
+	req, err := http.NewRequest("GET", wellKnown, nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := doRequest(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read response body: %v", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("%s: %s", resp.Status, body)
+	}
+
+	var p providerJSON
+	err = unmarshalResp(resp, body, &p)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: failed to decode provider discovery object: %v", err)
+	}
+
+	if p.Issuer != issuer {
+		return nil, fmt.Errorf("oidc: issuer did not match the issuer returned by provider, expected %q got %q", issuer, p.Issuer)
+	}
+	return &Provider{
+		issuer:       p.Issuer,
+		authURL:      p.AuthURL,
+		tokenURL:     p.TokenURL,
+		userInfoURL:  p.UserInfoURL,
+		rawClaims:    body,
+		remoteKeySet: NewRemoteKeySet(ctx, p.JWKSURL),
+	}, nil
+}
+
+// Claims unmarshals raw fields returned by the server during discovery.
+//
+//    var claims struct {
+//        ScopesSupported []string `json:"scopes_supported"`
+//        ClaimsSupported []string `json:"claims_supported"`
+//    }
+//
+//    if err := provider.Claims(&claims); err != nil {
+//        // handle unmarshaling error
+//    }
+//
+// For a list of fields defined by the OpenID Connect spec see:
+// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+func (p *Provider) Claims(v interface{}) error {
+	if p.rawClaims == nil {
+		return errors.New("oidc: claims not set")
+	}
+	return json.Unmarshal(p.rawClaims, v)
+}
+
+// Endpoint returns the OAuth2 auth and token endpoints for the given provider.
+func (p *Provider) Endpoint() oauth2.Endpoint {
+	return oauth2.Endpoint{AuthURL: p.authURL, TokenURL: p.tokenURL}
+}
+
+// UserInfo represents the OpenID Connect userinfo claims.
+type UserInfo struct {
+	Subject       string `json:"sub"`
+	Profile       string `json:"profile"`
+	Email         string `json:"email"`
+	EmailVerified bool   `json:"email_verified"`
+
+	claims []byte
+}
+
+// Claims unmarshals the raw JSON object claims into the provided object.
+func (u *UserInfo) Claims(v interface{}) error {
+	if u.claims == nil {
+		return errors.New("oidc: claims not set")
+	}
+	return json.Unmarshal(u.claims, v)
+}
+
+// UserInfo uses the token source to query the provider's user info endpoint.
+func (p *Provider) UserInfo(ctx context.Context, tokenSource oauth2.TokenSource) (*UserInfo, error) {
+	if p.userInfoURL == "" {
+		return nil, errors.New("oidc: user info endpoint is not supported by this provider")
+	}
+
+	req, err := http.NewRequest("GET", p.userInfoURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: create GET request: %v", err)
+	}
+
+	token, err := tokenSource.Token()
+	if err != nil {
+		return nil, fmt.Errorf("oidc: get access token: %v", err)
+	}
+	token.SetAuthHeader(req)
+
+	resp, err := doRequest(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("%s: %s", resp.Status, body)
+	}
+
+	var userInfo UserInfo
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		return nil, fmt.Errorf("oidc: failed to decode userinfo: %v", err)
+	}
+	userInfo.claims = body
+	return &userInfo, nil
+}
+
+// IDToken is an OpenID Connect extension that provides a predictable representation
+// of an authorization event.
+//
+// The ID Token only holds fields OpenID Connect requires. To access additional
+// claims returned by the server, use the Claims method.
+type IDToken struct {
+	// The URL of the server which issued this token. OpenID Connect
+	// requires this value always be identical to the URL used for
+	// initial discovery.
+	//
+	// Note: Because of a known issue with Google Accounts' implementation
+	// this value may differ when using Google.
+	//
+	// See: https://developers.google.com/identity/protocols/OpenIDConnect#obtainuserinfo
+	Issuer string
+
+	// The client ID, or set of client IDs, that this token is issued for. For
+	// common uses, this is the client that initialized the auth flow.
+	//
+	// This package ensures the audience contains an expected value.
+	Audience []string
+
+	// A unique string which identifies the end user.
+	Subject string
+
+	// Expiry of the token. Ths package will not process tokens that have
+	// expired unless that validation is explicitly turned off.
+	Expiry time.Time
+	// When the token was issued by the provider.
+	IssuedAt time.Time
+
+	// Initial nonce provided during the authentication redirect.
+	//
+	// This package does NOT provided verification on the value of this field
+	// and it's the user's responsibility to ensure it contains a valid value.
+	Nonce string
+
+	// at_hash claim, if set in the ID token. Callers can verify an access token
+	// that corresponds to the ID token using the VerifyAccessToken method.
+	AccessTokenHash string
+
+	// signature algorithm used for ID token, needed to compute a verification hash of an
+	// access token
+	sigAlgorithm string
+
+	// Raw payload of the id_token.
+	claims []byte
+
+	// Map of distributed claim names to claim sources
+	distributedClaims map[string]claimSource
+}
+
+// Claims unmarshals the raw JSON payload of the ID Token into a provided struct.
+//
+//		idToken, err := idTokenVerifier.Verify(rawIDToken)
+//		if err != nil {
+//			// handle error
+//		}
+//		var claims struct {
+//			Email         string `json:"email"`
+//			EmailVerified bool   `json:"email_verified"`
+//		}
+//		if err := idToken.Claims(&claims); err != nil {
+//			// handle error
+//		}
+//
+func (i *IDToken) Claims(v interface{}) error {
+	if i.claims == nil {
+		return errors.New("oidc: claims not set")
+	}
+	return json.Unmarshal(i.claims, v)
+}
+
+// VerifyAccessToken verifies that the hash of the access token that corresponds to the iD token
+// matches the hash in the id token. It returns an error if the hashes  don't match.
+// It is the caller's responsibility to ensure that the optional access token hash is present for the ID token
+// before calling this method. See https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken
+func (i *IDToken) VerifyAccessToken(accessToken string) error {
+	if i.AccessTokenHash == "" {
+		return errNoAtHash
+	}
+	var h hash.Hash
+	switch i.sigAlgorithm {
+	case RS256, ES256, PS256:
+		h = sha256.New()
+	case RS384, ES384, PS384:
+		h = sha512.New384()
+	case RS512, ES512, PS512:
+		h = sha512.New()
+	default:
+		return fmt.Errorf("oidc: unsupported signing algorithm %q", i.sigAlgorithm)
+	}
+	h.Write([]byte(accessToken)) // hash documents that Write will never return an error
+	sum := h.Sum(nil)[:h.Size()/2]
+	actual := base64.RawURLEncoding.EncodeToString(sum)
+	if actual != i.AccessTokenHash {
+		return errInvalidAtHash
+	}
+	return nil
+}
+
+type idToken struct {
+	Issuer       string                 `json:"iss"`
+	Subject      string                 `json:"sub"`
+	Audience     audience               `json:"aud"`
+	Expiry       jsonTime               `json:"exp"`
+	IssuedAt     jsonTime               `json:"iat"`
+	Nonce        string                 `json:"nonce"`
+	AtHash       string                 `json:"at_hash"`
+	ClaimNames   map[string]string      `json:"_claim_names"`
+	ClaimSources map[string]claimSource `json:"_claim_sources"`
+}
+
+type claimSource struct {
+	Endpoint    string `json:"endpoint"`
+	AccessToken string `json:"access_token"`
+}
+
+type audience []string
+
+func (a *audience) UnmarshalJSON(b []byte) error {
+	var s string
+	if json.Unmarshal(b, &s) == nil {
+		*a = audience{s}
+		return nil
+	}
+	var auds []string
+	if err := json.Unmarshal(b, &auds); err != nil {
+		return err
+	}
+	*a = audience(auds)
+	return nil
+}
+
+type jsonTime time.Time
+
+func (j *jsonTime) UnmarshalJSON(b []byte) error {
+	var n json.Number
+	if err := json.Unmarshal(b, &n); err != nil {
+		return err
+	}
+	var unix int64
+
+	if t, err := n.Int64(); err == nil {
+		unix = t
+	} else {
+		f, err := n.Float64()
+		if err != nil {
+			return err
+		}
+		unix = int64(f)
+	}
+	*j = jsonTime(time.Unix(unix, 0))
+	return nil
+}
+
+func unmarshalResp(r *http.Response, body []byte, v interface{}) error {
+	err := json.Unmarshal(body, &v)
+	if err == nil {
+		return nil
+	}
+	ct := r.Header.Get("Content-Type")
+	mediaType, _, parseErr := mime.ParseMediaType(ct)
+	if parseErr == nil && mediaType == "application/json" {
+		return fmt.Errorf("got Content-Type = application/json, but could not unmarshal as JSON: %v", err)
+	}
+	return fmt.Errorf("expected Content-Type = application/json, got %q: %v", ct, err)
+}
@@ -1,846 +0,0 @@
-package oidc
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"net/mail"
-	"net/url"
-	"sync"
-	"time"
-
-	phttp "github.com/coreos/go-oidc/http"
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/go-oidc/key"
-	"github.com/coreos/go-oidc/oauth2"
-)
-
-const (
-	// amount of time that must pass after the last key sync
-	// completes before another attempt may begin
-	keySyncWindow = 5 * time.Second
-)
-
-var (
-	DefaultScope = []string{"openid", "email", "profile"}
-
-	supportedAuthMethods = map[string]struct{}{
-		oauth2.AuthMethodClientSecretBasic: struct{}{},
-		oauth2.AuthMethodClientSecretPost:  struct{}{},
-	}
-)
-
-type ClientCredentials oauth2.ClientCredentials
-
-type ClientIdentity struct {
-	Credentials ClientCredentials
-	Metadata    ClientMetadata
-}
-
-type JWAOptions struct {
-	// SigningAlg specifies an JWA alg for signing JWTs.
-	//
-	// Specifying this field implies different actions depending on the context. It may
-	// require objects be serialized and signed as a JWT instead of plain JSON, or
-	// require an existing JWT object use the specified alg.
-	//
-	// See: http://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata
-	SigningAlg string
-	// EncryptionAlg, if provided, specifies that the returned or sent object be stored
-	// (or nested) within a JWT object and encrypted with the provided JWA alg.
-	EncryptionAlg string
-	// EncryptionEnc specifies the JWA enc algorithm to use with EncryptionAlg. If
-	// EncryptionAlg is provided and EncryptionEnc is omitted, this field defaults
-	// to A128CBC-HS256.
-	//
-	// If EncryptionEnc is provided EncryptionAlg must also be specified.
-	EncryptionEnc string
-}
-
-func (opt JWAOptions) valid() error {
-	if opt.EncryptionEnc != "" && opt.EncryptionAlg == "" {
-		return errors.New("encryption encoding provided with no encryption algorithm")
-	}
-	return nil
-}
-
-func (opt JWAOptions) defaults() JWAOptions {
-	if opt.EncryptionAlg != "" && opt.EncryptionEnc == "" {
-		opt.EncryptionEnc = jose.EncA128CBCHS256
-	}
-	return opt
-}
-
-var (
-	// Ensure ClientMetadata satisfies these interfaces.
-	_ json.Marshaler   = &ClientMetadata{}
-	_ json.Unmarshaler = &ClientMetadata{}
-)
-
-// ClientMetadata holds metadata that the authorization server associates
-// with a client identifier. The fields range from human-facing display
-// strings such as client name, to items that impact the security of the
-// protocol, such as the list of valid redirect URIs.
-//
-// See http://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata
-//
-// TODO: support language specific claim representations
-// http://openid.net/specs/openid-connect-registration-1_0.html#LanguagesAndScripts
-type ClientMetadata struct {
-	RedirectURIs []url.URL // Required
-
-	// A list of OAuth 2.0 "response_type" values that the client wishes to restrict
-	// itself to. Either "code", "token", or another registered extension.
-	//
-	// If omitted, only "code" will be used.
-	ResponseTypes []string
-	// A list of OAuth 2.0 grant types the client wishes to restrict itself to.
-	// The grant type values used by OIDC are "authorization_code", "implicit",
-	// and "refresh_token".
-	//
-	// If ommitted, only "authorization_code" will be used.
-	GrantTypes []string
-	// "native" or "web". If omitted, "web".
-	ApplicationType string
-
-	// List of email addresses.
-	Contacts []mail.Address
-	// Name of client to be presented to the end-user.
-	ClientName string
-	// URL that references a logo for the Client application.
-	LogoURI *url.URL
-	// URL of the home page of the Client.
-	ClientURI *url.URL
-	// Profile data policies and terms of use to be provided to the end user.
-	PolicyURI         *url.URL
-	TermsOfServiceURI *url.URL
-
-	// URL to or the value of the client's JSON Web Key Set document.
-	JWKSURI *url.URL
-	JWKS    *jose.JWKSet
-
-	// URL referencing a flie with a single JSON array of redirect URIs.
-	SectorIdentifierURI *url.URL
-
-	SubjectType string
-
-	// Options to restrict the JWS alg and enc values used for server responses and requests.
-	IDTokenResponseOptions  JWAOptions
-	UserInfoResponseOptions JWAOptions
-	RequestObjectOptions    JWAOptions
-
-	// Client requested authorization method and signing options for the token endpoint.
-	//
-	// Defaults to "client_secret_basic"
-	TokenEndpointAuthMethod     string
-	TokenEndpointAuthSigningAlg string
-
-	// DefaultMaxAge specifies the maximum amount of time in seconds before an authorized
-	// user must reauthroize.
-	//
-	// If 0, no limitation is placed on the maximum.
-	DefaultMaxAge int64
-	// RequireAuthTime specifies if the auth_time claim in the ID token is required.
-	RequireAuthTime bool
-
-	// Default Authentication Context Class Reference values for authentication requests.
-	DefaultACRValues []string
-
-	// URI that a third party can use to initiate a login by the relaying party.
-	//
-	// See: http://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin
-	InitiateLoginURI *url.URL
-	// Pre-registered request_uri values that may be cached by the server.
-	RequestURIs []url.URL
-}
-
-// Defaults returns a shallow copy of ClientMetadata with default
-// values replacing omitted fields.
-func (m ClientMetadata) Defaults() ClientMetadata {
-	if len(m.ResponseTypes) == 0 {
-		m.ResponseTypes = []string{oauth2.ResponseTypeCode}
-	}
-	if len(m.GrantTypes) == 0 {
-		m.GrantTypes = []string{oauth2.GrantTypeAuthCode}
-	}
-	if m.ApplicationType == "" {
-		m.ApplicationType = "web"
-	}
-	if m.TokenEndpointAuthMethod == "" {
-		m.TokenEndpointAuthMethod = oauth2.AuthMethodClientSecretBasic
-	}
-	m.IDTokenResponseOptions = m.IDTokenResponseOptions.defaults()
-	m.UserInfoResponseOptions = m.UserInfoResponseOptions.defaults()
-	m.RequestObjectOptions = m.RequestObjectOptions.defaults()
-	return m
-}
-
-func (m *ClientMetadata) MarshalJSON() ([]byte, error) {
-	e := m.toEncodableStruct()
-	return json.Marshal(&e)
-}
-
-func (m *ClientMetadata) UnmarshalJSON(data []byte) error {
-	var e encodableClientMetadata
-	if err := json.Unmarshal(data, &e); err != nil {
-		return err
-	}
-	meta, err := e.toStruct()
-	if err != nil {
-		return err
-	}
-	if err := meta.Valid(); err != nil {
-		return err
-	}
-	*m = meta
-	return nil
-}
-
-type encodableClientMetadata struct {
-	RedirectURIs                 []string     `json:"redirect_uris"` // Required
-	ResponseTypes                []string     `json:"response_types,omitempty"`
-	GrantTypes                   []string     `json:"grant_types,omitempty"`
-	ApplicationType              string       `json:"application_type,omitempty"`
-	Contacts                     []string     `json:"contacts,omitempty"`
-	ClientName                   string       `json:"client_name,omitempty"`
-	LogoURI                      string       `json:"logo_uri,omitempty"`
-	ClientURI                    string       `json:"client_uri,omitempty"`
-	PolicyURI                    string       `json:"policy_uri,omitempty"`
-	TermsOfServiceURI            string       `json:"tos_uri,omitempty"`
-	JWKSURI                      string       `json:"jwks_uri,omitempty"`
-	JWKS                         *jose.JWKSet `json:"jwks,omitempty"`
-	SectorIdentifierURI          string       `json:"sector_identifier_uri,omitempty"`
-	SubjectType                  string       `json:"subject_type,omitempty"`
-	IDTokenSignedResponseAlg     string       `json:"id_token_signed_response_alg,omitempty"`
-	IDTokenEncryptedResponseAlg  string       `json:"id_token_encrypted_response_alg,omitempty"`
-	IDTokenEncryptedResponseEnc  string       `json:"id_token_encrypted_response_enc,omitempty"`
-	UserInfoSignedResponseAlg    string       `json:"userinfo_signed_response_alg,omitempty"`
-	UserInfoEncryptedResponseAlg string       `json:"userinfo_encrypted_response_alg,omitempty"`
-	UserInfoEncryptedResponseEnc string       `json:"userinfo_encrypted_response_enc,omitempty"`
-	RequestObjectSigningAlg      string       `json:"request_object_signing_alg,omitempty"`
-	RequestObjectEncryptionAlg   string       `json:"request_object_encryption_alg,omitempty"`
-	RequestObjectEncryptionEnc   string       `json:"request_object_encryption_enc,omitempty"`
-	TokenEndpointAuthMethod      string       `json:"token_endpoint_auth_method,omitempty"`
-	TokenEndpointAuthSigningAlg  string       `json:"token_endpoint_auth_signing_alg,omitempty"`
-	DefaultMaxAge                int64        `json:"default_max_age,omitempty"`
-	RequireAuthTime              bool         `json:"require_auth_time,omitempty"`
-	DefaultACRValues             []string     `json:"default_acr_values,omitempty"`
-	InitiateLoginURI             string       `json:"initiate_login_uri,omitempty"`
-	RequestURIs                  []string     `json:"request_uris,omitempty"`
-}
-
-func (c *encodableClientMetadata) toStruct() (ClientMetadata, error) {
-	p := stickyErrParser{}
-	m := ClientMetadata{
-		RedirectURIs:                p.parseURIs(c.RedirectURIs, "redirect_uris"),
-		ResponseTypes:               c.ResponseTypes,
-		GrantTypes:                  c.GrantTypes,
-		ApplicationType:             c.ApplicationType,
-		Contacts:                    p.parseEmails(c.Contacts, "contacts"),
-		ClientName:                  c.ClientName,
-		LogoURI:                     p.parseURI(c.LogoURI, "logo_uri"),
-		ClientURI:                   p.parseURI(c.ClientURI, "client_uri"),
-		PolicyURI:                   p.parseURI(c.PolicyURI, "policy_uri"),
-		TermsOfServiceURI:           p.parseURI(c.TermsOfServiceURI, "tos_uri"),
-		JWKSURI:                     p.parseURI(c.JWKSURI, "jwks_uri"),
-		JWKS:                        c.JWKS,
-		SectorIdentifierURI:         p.parseURI(c.SectorIdentifierURI, "sector_identifier_uri"),
-		SubjectType:                 c.SubjectType,
-		TokenEndpointAuthMethod:     c.TokenEndpointAuthMethod,
-		TokenEndpointAuthSigningAlg: c.TokenEndpointAuthSigningAlg,
-		DefaultMaxAge:               c.DefaultMaxAge,
-		RequireAuthTime:             c.RequireAuthTime,
-		DefaultACRValues:            c.DefaultACRValues,
-		InitiateLoginURI:            p.parseURI(c.InitiateLoginURI, "initiate_login_uri"),
-		RequestURIs:                 p.parseURIs(c.RequestURIs, "request_uris"),
-		IDTokenResponseOptions: JWAOptions{
-			c.IDTokenSignedResponseAlg,
-			c.IDTokenEncryptedResponseAlg,
-			c.IDTokenEncryptedResponseEnc,
-		},
-		UserInfoResponseOptions: JWAOptions{
-			c.UserInfoSignedResponseAlg,
-			c.UserInfoEncryptedResponseAlg,
-			c.UserInfoEncryptedResponseEnc,
-		},
-		RequestObjectOptions: JWAOptions{
-			c.RequestObjectSigningAlg,
-			c.RequestObjectEncryptionAlg,
-			c.RequestObjectEncryptionEnc,
-		},
-	}
-	if p.firstErr != nil {
-		return ClientMetadata{}, p.firstErr
-	}
-	return m, nil
-}
-
-// stickyErrParser parses URIs and email addresses. Once it encounters
-// a parse error, subsequent calls become no-op.
-type stickyErrParser struct {
-	firstErr error
-}
-
-func (p *stickyErrParser) parseURI(s, field string) *url.URL {
-	if p.firstErr != nil || s == "" {
-		return nil
-	}
-	u, err := url.Parse(s)
-	if err == nil {
-		if u.Host == "" {
-			err = errors.New("no host in URI")
-		} else if u.Scheme != "http" && u.Scheme != "https" {
-			err = errors.New("invalid URI scheme")
-		}
-	}
-	if err != nil {
-		p.firstErr = fmt.Errorf("failed to parse %s: %v", field, err)
-		return nil
-	}
-	return u
-}
-
-func (p *stickyErrParser) parseURIs(s []string, field string) []url.URL {
-	if p.firstErr != nil || len(s) == 0 {
-		return nil
-	}
-	uris := make([]url.URL, len(s))
-	for i, val := range s {
-		if val == "" {
-			p.firstErr = fmt.Errorf("invalid URI in field %s", field)
-			return nil
-		}
-		if u := p.parseURI(val, field); u != nil {
-			uris[i] = *u
-		}
-	}
-	return uris
-}
-
-func (p *stickyErrParser) parseEmails(s []string, field string) []mail.Address {
-	if p.firstErr != nil || len(s) == 0 {
-		return nil
-	}
-	addrs := make([]mail.Address, len(s))
-	for i, addr := range s {
-		if addr == "" {
-			p.firstErr = fmt.Errorf("invalid email in field %s", field)
-			return nil
-		}
-		a, err := mail.ParseAddress(addr)
-		if err != nil {
-			p.firstErr = fmt.Errorf("invalid email in field %s: %v", field, err)
-			return nil
-		}
-		addrs[i] = *a
-	}
-	return addrs
-}
-
-func (m *ClientMetadata) toEncodableStruct() encodableClientMetadata {
-	return encodableClientMetadata{
-		RedirectURIs:                 urisToStrings(m.RedirectURIs),
-		ResponseTypes:                m.ResponseTypes,
-		GrantTypes:                   m.GrantTypes,
-		ApplicationType:              m.ApplicationType,
-		Contacts:                     emailsToStrings(m.Contacts),
-		ClientName:                   m.ClientName,
-		LogoURI:                      uriToString(m.LogoURI),
-		ClientURI:                    uriToString(m.ClientURI),
-		PolicyURI:                    uriToString(m.PolicyURI),
-		TermsOfServiceURI:            uriToString(m.TermsOfServiceURI),
-		JWKSURI:                      uriToString(m.JWKSURI),
-		JWKS:                         m.JWKS,
-		SectorIdentifierURI:          uriToString(m.SectorIdentifierURI),
-		SubjectType:                  m.SubjectType,
-		IDTokenSignedResponseAlg:     m.IDTokenResponseOptions.SigningAlg,
-		IDTokenEncryptedResponseAlg:  m.IDTokenResponseOptions.EncryptionAlg,
-		IDTokenEncryptedResponseEnc:  m.IDTokenResponseOptions.EncryptionEnc,
-		UserInfoSignedResponseAlg:    m.UserInfoResponseOptions.SigningAlg,
-		UserInfoEncryptedResponseAlg: m.UserInfoResponseOptions.EncryptionAlg,
-		UserInfoEncryptedResponseEnc: m.UserInfoResponseOptions.EncryptionEnc,
-		RequestObjectSigningAlg:      m.RequestObjectOptions.SigningAlg,
-		RequestObjectEncryptionAlg:   m.RequestObjectOptions.EncryptionAlg,
-		RequestObjectEncryptionEnc:   m.RequestObjectOptions.EncryptionEnc,
-		TokenEndpointAuthMethod:      m.TokenEndpointAuthMethod,
-		TokenEndpointAuthSigningAlg:  m.TokenEndpointAuthSigningAlg,
-		DefaultMaxAge:                m.DefaultMaxAge,
-		RequireAuthTime:              m.RequireAuthTime,
-		DefaultACRValues:             m.DefaultACRValues,
-		InitiateLoginURI:             uriToString(m.InitiateLoginURI),
-		RequestURIs:                  urisToStrings(m.RequestURIs),
-	}
-}
-
-func uriToString(u *url.URL) string {
-	if u == nil {
-		return ""
-	}
-	return u.String()
-}
-
-func urisToStrings(urls []url.URL) []string {
-	if len(urls) == 0 {
-		return nil
-	}
-	sli := make([]string, len(urls))
-	for i, u := range urls {
-		sli[i] = u.String()
-	}
-	return sli
-}
-
-func emailsToStrings(addrs []mail.Address) []string {
-	if len(addrs) == 0 {
-		return nil
-	}
-	sli := make([]string, len(addrs))
-	for i, addr := range addrs {
-		sli[i] = addr.String()
-	}
-	return sli
-}
-
-// Valid determines if a ClientMetadata conforms with the OIDC specification.
-//
-// Valid is called by UnmarshalJSON.
-//
-// NOTE(ericchiang): For development purposes Valid does not mandate 'https' for
-// URLs fields where the OIDC spec requires it. This may change in future releases
-// of this package. See: https://github.com/coreos/go-oidc/issues/34
-func (m *ClientMetadata) Valid() error {
-	if len(m.RedirectURIs) == 0 {
-		return errors.New("zero redirect URLs")
-	}
-
-	validURI := func(u *url.URL, fieldName string) error {
-		if u.Host == "" {
-			return fmt.Errorf("no host for uri field %s", fieldName)
-		}
-		if u.Scheme != "http" && u.Scheme != "https" {
-			return fmt.Errorf("uri field %s scheme is not http or https", fieldName)
-		}
-		return nil
-	}
-
-	uris := []struct {
-		val  *url.URL
-		name string
-	}{
-		{m.LogoURI, "logo_uri"},
-		{m.ClientURI, "client_uri"},
-		{m.PolicyURI, "policy_uri"},
-		{m.TermsOfServiceURI, "tos_uri"},
-		{m.JWKSURI, "jwks_uri"},
-		{m.SectorIdentifierURI, "sector_identifier_uri"},
-		{m.InitiateLoginURI, "initiate_login_uri"},
-	}
-
-	for _, uri := range uris {
-		if uri.val == nil {
-			continue
-		}
-		if err := validURI(uri.val, uri.name); err != nil {
-			return err
-		}
-	}
-
-	uriLists := []struct {
-		vals []url.URL
-		name string
-	}{
-		{m.RedirectURIs, "redirect_uris"},
-		{m.RequestURIs, "request_uris"},
-	}
-	for _, list := range uriLists {
-		for _, uri := range list.vals {
-			if err := validURI(&uri, list.name); err != nil {
-				return err
-			}
-		}
-	}
-
-	options := []struct {
-		option JWAOptions
-		name   string
-	}{
-		{m.IDTokenResponseOptions, "id_token response"},
-		{m.UserInfoResponseOptions, "userinfo response"},
-		{m.RequestObjectOptions, "request_object"},
-	}
-	for _, option := range options {
-		if err := option.option.valid(); err != nil {
-			return fmt.Errorf("invalid JWA values for %s: %v", option.name, err)
-		}
-	}
-	return nil
-}
-
-type ClientRegistrationResponse struct {
-	ClientID                string // Required
-	ClientSecret            string
-	RegistrationAccessToken string
-	RegistrationClientURI   string
-	// If IsZero is true, unspecified.
-	ClientIDIssuedAt time.Time
-	// Time at which the client_secret will expire.
-	// If IsZero is true, it will not expire.
-	ClientSecretExpiresAt time.Time
-
-	ClientMetadata
-}
-
-type encodableClientRegistrationResponse struct {
-	ClientID                string `json:"client_id"` // Required
-	ClientSecret            string `json:"client_secret,omitempty"`
-	RegistrationAccessToken string `json:"registration_access_token,omitempty"`
-	RegistrationClientURI   string `json:"registration_client_uri,omitempty"`
-	ClientIDIssuedAt        int64  `json:"client_id_issued_at,omitempty"`
-	// Time at which the client_secret will expire, in seconds since the epoch.
-	// If 0 it will not expire.
-	ClientSecretExpiresAt int64 `json:"client_secret_expires_at"` // Required
-
-	encodableClientMetadata
-}
-
-func unixToSec(t time.Time) int64 {
-	if t.IsZero() {
-		return 0
-	}
-	return t.Unix()
-}
-
-func (c *ClientRegistrationResponse) MarshalJSON() ([]byte, error) {
-	e := encodableClientRegistrationResponse{
-		ClientID:                c.ClientID,
-		ClientSecret:            c.ClientSecret,
-		RegistrationAccessToken: c.RegistrationAccessToken,
-		RegistrationClientURI:   c.RegistrationClientURI,
-		ClientIDIssuedAt:        unixToSec(c.ClientIDIssuedAt),
-		ClientSecretExpiresAt:   unixToSec(c.ClientSecretExpiresAt),
-		encodableClientMetadata: c.ClientMetadata.toEncodableStruct(),
-	}
-	return json.Marshal(&e)
-}
-
-func secToUnix(sec int64) time.Time {
-	if sec == 0 {
-		return time.Time{}
-	}
-	return time.Unix(sec, 0)
-}
-
-func (c *ClientRegistrationResponse) UnmarshalJSON(data []byte) error {
-	var e encodableClientRegistrationResponse
-	if err := json.Unmarshal(data, &e); err != nil {
-		return err
-	}
-	if e.ClientID == "" {
-		return errors.New("no client_id in client registration response")
-	}
-	metadata, err := e.encodableClientMetadata.toStruct()
-	if err != nil {
-		return err
-	}
-	*c = ClientRegistrationResponse{
-		ClientID:                e.ClientID,
-		ClientSecret:            e.ClientSecret,
-		RegistrationAccessToken: e.RegistrationAccessToken,
-		RegistrationClientURI:   e.RegistrationClientURI,
-		ClientIDIssuedAt:        secToUnix(e.ClientIDIssuedAt),
-		ClientSecretExpiresAt:   secToUnix(e.ClientSecretExpiresAt),
-		ClientMetadata:          metadata,
-	}
-	return nil
-}
-
-type ClientConfig struct {
-	HTTPClient     phttp.Client
-	Credentials    ClientCredentials
-	Scope          []string
-	RedirectURL    string
-	ProviderConfig ProviderConfig
-	KeySet         key.PublicKeySet
-}
-
-func NewClient(cfg ClientConfig) (*Client, error) {
-	// Allow empty redirect URL in the case where the client
-	// only needs to verify a given token.
-	ru, err := url.Parse(cfg.RedirectURL)
-	if err != nil {
-		return nil, fmt.Errorf("invalid redirect URL: %v", err)
-	}
-
-	c := Client{
-		credentials:    cfg.Credentials,
-		httpClient:     cfg.HTTPClient,
-		scope:          cfg.Scope,
-		redirectURL:    ru.String(),
-		providerConfig: newProviderConfigRepo(cfg.ProviderConfig),
-		keySet:         cfg.KeySet,
-	}
-
-	if c.httpClient == nil {
-		c.httpClient = http.DefaultClient
-	}
-
-	if c.scope == nil {
-		c.scope = make([]string, len(DefaultScope))
-		copy(c.scope, DefaultScope)
-	}
-
-	return &c, nil
-}
-
-type Client struct {
-	httpClient     phttp.Client
-	providerConfig *providerConfigRepo
-	credentials    ClientCredentials
-	redirectURL    string
-	scope          []string
-	keySet         key.PublicKeySet
-	providerSyncer *ProviderConfigSyncer
-
-	keySetSyncMutex sync.RWMutex
-	lastKeySetSync  time.Time
-}
-
-func (c *Client) Healthy() error {
-	now := time.Now().UTC()
-
-	cfg := c.providerConfig.Get()
-
-	if cfg.Empty() {
-		return errors.New("oidc client provider config empty")
-	}
-
-	if !cfg.ExpiresAt.IsZero() && cfg.ExpiresAt.Before(now) {
-		return errors.New("oidc client provider config expired")
-	}
-
-	return nil
-}
-
-func (c *Client) OAuthClient() (*oauth2.Client, error) {
-	cfg := c.providerConfig.Get()
-	authMethod, err := chooseAuthMethod(cfg)
-	if err != nil {
-		return nil, err
-	}
-
-	ocfg := oauth2.Config{
-		Credentials: oauth2.ClientCredentials(c.credentials),
-		RedirectURL: c.redirectURL,
-		AuthURL:     cfg.AuthEndpoint.String(),
-		TokenURL:    cfg.TokenEndpoint.String(),
-		Scope:       c.scope,
-		AuthMethod:  authMethod,
-	}
-
-	return oauth2.NewClient(c.httpClient, ocfg)
-}
-
-func chooseAuthMethod(cfg ProviderConfig) (string, error) {
-	if len(cfg.TokenEndpointAuthMethodsSupported) == 0 {
-		return oauth2.AuthMethodClientSecretBasic, nil
-	}
-
-	for _, authMethod := range cfg.TokenEndpointAuthMethodsSupported {
-		if _, ok := supportedAuthMethods[authMethod]; ok {
-			return authMethod, nil
-		}
-	}
-
-	return "", errors.New("no supported auth methods")
-}
-
-// SyncProviderConfig starts the provider config syncer
-func (c *Client) SyncProviderConfig(discoveryURL string) chan struct{} {
-	r := NewHTTPProviderConfigGetter(c.httpClient, discoveryURL)
-	s := NewProviderConfigSyncer(r, c.providerConfig)
-	stop := s.Run()
-	s.WaitUntilInitialSync()
-	return stop
-}
-
-func (c *Client) maybeSyncKeys() error {
-	tooSoon := func() bool {
-		return time.Now().UTC().Before(c.lastKeySetSync.Add(keySyncWindow))
-	}
-
-	// ignore request to sync keys if a sync operation has been
-	// attempted too recently
-	if tooSoon() {
-		return nil
-	}
-
-	c.keySetSyncMutex.Lock()
-	defer c.keySetSyncMutex.Unlock()
-
-	// check again, as another goroutine may have been holding
-	// the lock while updating the keys
-	if tooSoon() {
-		return nil
-	}
-
-	cfg := c.providerConfig.Get()
-	r := NewRemotePublicKeyRepo(c.httpClient, cfg.KeysEndpoint.String())
-	w := &clientKeyRepo{client: c}
-	_, err := key.Sync(r, w)
-	c.lastKeySetSync = time.Now().UTC()
-
-	return err
-}
-
-type clientKeyRepo struct {
-	client *Client
-}
-
-func (r *clientKeyRepo) Set(ks key.KeySet) error {
-	pks, ok := ks.(*key.PublicKeySet)
-	if !ok {
-		return errors.New("unable to cast to PublicKey")
-	}
-	r.client.keySet = *pks
-	return nil
-}
-
-func (c *Client) ClientCredsToken(scope []string) (jose.JWT, error) {
-	cfg := c.providerConfig.Get()
-
-	if !cfg.SupportsGrantType(oauth2.GrantTypeClientCreds) {
-		return jose.JWT{}, fmt.Errorf("%v grant type is not supported", oauth2.GrantTypeClientCreds)
-	}
-
-	oac, err := c.OAuthClient()
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	t, err := oac.ClientCredsToken(scope)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	jwt, err := jose.ParseJWT(t.IDToken)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	return jwt, c.VerifyJWT(jwt)
-}
-
-// ExchangeAuthCode exchanges an OAuth2 auth code for an OIDC JWT ID token.
-func (c *Client) ExchangeAuthCode(code string) (jose.JWT, error) {
-	oac, err := c.OAuthClient()
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	t, err := oac.RequestToken(oauth2.GrantTypeAuthCode, code)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	jwt, err := jose.ParseJWT(t.IDToken)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	return jwt, c.VerifyJWT(jwt)
-}
-
-// RefreshToken uses a refresh token to exchange for a new OIDC JWT ID Token.
-func (c *Client) RefreshToken(refreshToken string) (jose.JWT, error) {
-	oac, err := c.OAuthClient()
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	t, err := oac.RequestToken(oauth2.GrantTypeRefreshToken, refreshToken)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	jwt, err := jose.ParseJWT(t.IDToken)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	return jwt, c.VerifyJWT(jwt)
-}
-
-func (c *Client) VerifyJWT(jwt jose.JWT) error {
-	var keysFunc func() []key.PublicKey
-	if kID, ok := jwt.KeyID(); ok {
-		keysFunc = c.keysFuncWithID(kID)
-	} else {
-		keysFunc = c.keysFuncAll()
-	}
-
-	v := NewJWTVerifier(
-		c.providerConfig.Get().Issuer.String(),
-		c.credentials.ID,
-		c.maybeSyncKeys, keysFunc)
-
-	return v.Verify(jwt)
-}
-
-// keysFuncWithID returns a function that retrieves at most unexpired
-// public key from the Client that matches the provided ID
-func (c *Client) keysFuncWithID(kID string) func() []key.PublicKey {
-	return func() []key.PublicKey {
-		c.keySetSyncMutex.RLock()
-		defer c.keySetSyncMutex.RUnlock()
-
-		if c.keySet.ExpiresAt().Before(time.Now()) {
-			return []key.PublicKey{}
-		}
-
-		k := c.keySet.Key(kID)
-		if k == nil {
-			return []key.PublicKey{}
-		}
-
-		return []key.PublicKey{*k}
-	}
-}
-
-// keysFuncAll returns a function that retrieves all unexpired public
-// keys from the Client
-func (c *Client) keysFuncAll() func() []key.PublicKey {
-	return func() []key.PublicKey {
-		c.keySetSyncMutex.RLock()
-		defer c.keySetSyncMutex.RUnlock()
-
-		if c.keySet.ExpiresAt().Before(time.Now()) {
-			return []key.PublicKey{}
-		}
-
-		return c.keySet.Keys()
-	}
-}
-
-type providerConfigRepo struct {
-	mu     sync.RWMutex
-	config ProviderConfig // do not access directly, use Get()
-}
-
-func newProviderConfigRepo(pc ProviderConfig) *providerConfigRepo {
-	return &providerConfigRepo{sync.RWMutex{}, pc}
-}
-
-// returns an error to implement ProviderConfigSetter
-func (r *providerConfigRepo) Set(cfg ProviderConfig) error {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.config = cfg
-	return nil
-}
-
-func (r *providerConfigRepo) Get() ProviderConfig {
-	r.mu.RLock()
-	defer r.mu.RUnlock()
-	return r.config
-}
@@ -1,2 +0,0 @@
-// Package oidc is DEPRECATED. Use github.com/coreos/go-oidc instead.
-package oidc
@@ -1,44 +0,0 @@
-package oidc
-
-import (
-	"errors"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-)
-
-type Identity struct {
-	ID        string
-	Name      string
-	Email     string
-	ExpiresAt time.Time
-}
-
-func IdentityFromClaims(claims jose.Claims) (*Identity, error) {
-	if claims == nil {
-		return nil, errors.New("nil claim set")
-	}
-
-	var ident Identity
-	var err error
-	var ok bool
-
-	if ident.ID, ok, err = claims.StringClaim("sub"); err != nil {
-		return nil, err
-	} else if !ok {
-		return nil, errors.New("missing required claim: sub")
-	}
-
-	if ident.Email, _, err = claims.StringClaim("email"); err != nil {
-		return nil, err
-	}
-
-	exp, ok, err := claims.TimeClaim("exp")
-	if err != nil {
-		return nil, err
-	} else if ok {
-		ident.ExpiresAt = exp
-	}
-
-	return &ident, nil
-}
@@ -1,3 +0,0 @@
-package oidc
-
-type LoginFunc func(ident Identity, sessionKey string) (redirectURL string, err error)
@@ -1,67 +0,0 @@
-package oidc
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-	"time"
-
-	phttp "github.com/coreos/go-oidc/http"
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/go-oidc/key"
-)
-
-// DefaultPublicKeySetTTL is the default TTL set on the PublicKeySet if no
-// Cache-Control header is provided by the JWK Set document endpoint.
-const DefaultPublicKeySetTTL = 24 * time.Hour
-
-// NewRemotePublicKeyRepo is responsible for fetching the JWK Set document.
-func NewRemotePublicKeyRepo(hc phttp.Client, ep string) *remotePublicKeyRepo {
-	return &remotePublicKeyRepo{hc: hc, ep: ep}
-}
-
-type remotePublicKeyRepo struct {
-	hc phttp.Client
-	ep string
-}
-
-// Get returns a PublicKeySet fetched from the JWK Set document endpoint. A TTL
-// is set on the Key Set to avoid it having to be re-retrieved for every
-// encryption event. This TTL is typically controlled by the endpoint returning
-// a Cache-Control header, but defaults to 24 hours if no Cache-Control header
-// is found.
-func (r *remotePublicKeyRepo) Get() (key.KeySet, error) {
-	req, err := http.NewRequest("GET", r.ep, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	resp, err := r.hc.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	var d struct {
-		Keys []jose.JWK `json:"keys"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&d); err != nil {
-		return nil, err
-	}
-
-	if len(d.Keys) == 0 {
-		return nil, errors.New("zero keys in response")
-	}
-
-	ttl, ok, err := phttp.Cacheable(resp.Header)
-	if err != nil {
-		return nil, err
-	}
-	if !ok {
-		ttl = DefaultPublicKeySetTTL
-	}
-
-	exp := time.Now().UTC().Add(ttl)
-	ks := key.NewPublicKeySet(d.Keys, exp)
-	return ks, nil
-}
@@ -1,687 +0,0 @@
-package oidc
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"log"
-	"net/http"
-	"net/url"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/coreos/pkg/timeutil"
-	"github.com/jonboulle/clockwork"
-
-	phttp "github.com/coreos/go-oidc/http"
-	"github.com/coreos/go-oidc/oauth2"
-)
-
-const (
-	// Subject Identifier types defined by the OIDC spec. Specifies if the provider
-	// should provide the same sub claim value to all clients (public) or a unique
-	// value for each client (pairwise).
-	//
-	// See: http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes
-	SubjectTypePublic   = "public"
-	SubjectTypePairwise = "pairwise"
-)
-
-var (
-	// Default values for omitted provider config fields.
-	//
-	// Use ProviderConfig's Defaults method to fill a provider config with these values.
-	DefaultGrantTypesSupported               = []string{oauth2.GrantTypeAuthCode, oauth2.GrantTypeImplicit}
-	DefaultResponseModesSupported            = []string{"query", "fragment"}
-	DefaultTokenEndpointAuthMethodsSupported = []string{oauth2.AuthMethodClientSecretBasic}
-	DefaultClaimTypesSupported               = []string{"normal"}
-)
-
-const (
-	MaximumProviderConfigSyncInterval = 24 * time.Hour
-	MinimumProviderConfigSyncInterval = time.Minute
-
-	discoveryConfigPath = "/.well-known/openid-configuration"
-)
-
-// internally configurable for tests
-var minimumProviderConfigSyncInterval = MinimumProviderConfigSyncInterval
-
-var (
-	// Ensure ProviderConfig satisfies these interfaces.
-	_ json.Marshaler   = &ProviderConfig{}
-	_ json.Unmarshaler = &ProviderConfig{}
-)
-
-// ProviderConfig represents the OpenID Provider Metadata specifying what
-// configurations a provider supports.
-//
-// See: http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
-type ProviderConfig struct {
-	Issuer               *url.URL // Required
-	AuthEndpoint         *url.URL // Required
-	TokenEndpoint        *url.URL // Required if grant types other than "implicit" are supported
-	UserInfoEndpoint     *url.URL
-	KeysEndpoint         *url.URL // Required
-	RegistrationEndpoint *url.URL
-	EndSessionEndpoint   *url.URL
-	CheckSessionIFrame   *url.URL
-
-	// Servers MAY choose not to advertise some supported scope values even when this
-	// parameter is used, although those defined in OpenID Core SHOULD be listed, if supported.
-	ScopesSupported []string
-	// OAuth2.0 response types supported.
-	ResponseTypesSupported []string // Required
-	// OAuth2.0 response modes supported.
-	//
-	// If omitted, defaults to DefaultResponseModesSupported.
-	ResponseModesSupported []string
-	// OAuth2.0 grant types supported.
-	//
-	// If omitted, defaults to DefaultGrantTypesSupported.
-	GrantTypesSupported []string
-	ACRValuesSupported  []string
-	// SubjectTypesSupported specifies strategies for providing values for the sub claim.
-	SubjectTypesSupported []string // Required
-
-	// JWA signing and encryption algorith values supported for ID tokens.
-	IDTokenSigningAlgValues    []string // Required
-	IDTokenEncryptionAlgValues []string
-	IDTokenEncryptionEncValues []string
-
-	// JWA signing and encryption algorith values supported for user info responses.
-	UserInfoSigningAlgValues    []string
-	UserInfoEncryptionAlgValues []string
-	UserInfoEncryptionEncValues []string
-
-	// JWA signing and encryption algorith values supported for request objects.
-	ReqObjSigningAlgValues    []string
-	ReqObjEncryptionAlgValues []string
-	ReqObjEncryptionEncValues []string
-
-	TokenEndpointAuthMethodsSupported          []string
-	TokenEndpointAuthSigningAlgValuesSupported []string
-	DisplayValuesSupported                     []string
-	ClaimTypesSupported                        []string
-	ClaimsSupported                            []string
-	ServiceDocs                                *url.URL
-	ClaimsLocalsSupported                      []string
-	UILocalsSupported                          []string
-	ClaimsParameterSupported                   bool
-	RequestParameterSupported                  bool
-	RequestURIParamaterSupported               bool
-	RequireRequestURIRegistration              bool
-
-	Policy         *url.URL
-	TermsOfService *url.URL
-
-	// Not part of the OpenID Provider Metadata
-	ExpiresAt time.Time
-}
-
-// Defaults returns a shallow copy of ProviderConfig with default
-// values replacing omitted fields.
-//
-//     var cfg oidc.ProviderConfig
-//     // Fill provider config with default values for omitted fields.
-//     cfg = cfg.Defaults()
-//
-func (p ProviderConfig) Defaults() ProviderConfig {
-	setDefault := func(val *[]string, defaultVal []string) {
-		if len(*val) == 0 {
-			*val = defaultVal
-		}
-	}
-	setDefault(&p.GrantTypesSupported, DefaultGrantTypesSupported)
-	setDefault(&p.ResponseModesSupported, DefaultResponseModesSupported)
-	setDefault(&p.TokenEndpointAuthMethodsSupported, DefaultTokenEndpointAuthMethodsSupported)
-	setDefault(&p.ClaimTypesSupported, DefaultClaimTypesSupported)
-	return p
-}
-
-func (p *ProviderConfig) MarshalJSON() ([]byte, error) {
-	e := p.toEncodableStruct()
-	return json.Marshal(&e)
-}
-
-func (p *ProviderConfig) UnmarshalJSON(data []byte) error {
-	var e encodableProviderConfig
-	if err := json.Unmarshal(data, &e); err != nil {
-		return err
-	}
-	conf, err := e.toStruct()
-	if err != nil {
-		return err
-	}
-	if err := conf.Valid(); err != nil {
-		return err
-	}
-	*p = conf
-	return nil
-}
-
-type encodableProviderConfig struct {
-	Issuer               string `json:"issuer"`
-	AuthEndpoint         string `json:"authorization_endpoint"`
-	TokenEndpoint        string `json:"token_endpoint"`
-	UserInfoEndpoint     string `json:"userinfo_endpoint,omitempty"`
-	KeysEndpoint         string `json:"jwks_uri"`
-	RegistrationEndpoint string `json:"registration_endpoint,omitempty"`
-	EndSessionEndpoint   string `json:"end_session_endpoint,omitempty"`
-	CheckSessionIFrame   string `json:"check_session_iframe,omitempty"`
-
-	// Use 'omitempty' for all slices as per OIDC spec:
-	// "Claims that return multiple values are represented as JSON arrays.
-	// Claims with zero elements MUST be omitted from the response."
-	// http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
-
-	ScopesSupported        []string `json:"scopes_supported,omitempty"`
-	ResponseTypesSupported []string `json:"response_types_supported,omitempty"`
-	ResponseModesSupported []string `json:"response_modes_supported,omitempty"`
-	GrantTypesSupported    []string `json:"grant_types_supported,omitempty"`
-	ACRValuesSupported     []string `json:"acr_values_supported,omitempty"`
-	SubjectTypesSupported  []string `json:"subject_types_supported,omitempty"`
-
-	IDTokenSigningAlgValues     []string `json:"id_token_signing_alg_values_supported,omitempty"`
-	IDTokenEncryptionAlgValues  []string `json:"id_token_encryption_alg_values_supported,omitempty"`
-	IDTokenEncryptionEncValues  []string `json:"id_token_encryption_enc_values_supported,omitempty"`
-	UserInfoSigningAlgValues    []string `json:"userinfo_signing_alg_values_supported,omitempty"`
-	UserInfoEncryptionAlgValues []string `json:"userinfo_encryption_alg_values_supported,omitempty"`
-	UserInfoEncryptionEncValues []string `json:"userinfo_encryption_enc_values_supported,omitempty"`
-	ReqObjSigningAlgValues      []string `json:"request_object_signing_alg_values_supported,omitempty"`
-	ReqObjEncryptionAlgValues   []string `json:"request_object_encryption_alg_values_supported,omitempty"`
-	ReqObjEncryptionEncValues   []string `json:"request_object_encryption_enc_values_supported,omitempty"`
-
-	TokenEndpointAuthMethodsSupported          []string `json:"token_endpoint_auth_methods_supported,omitempty"`
-	TokenEndpointAuthSigningAlgValuesSupported []string `json:"token_endpoint_auth_signing_alg_values_supported,omitempty"`
-
-	DisplayValuesSupported        []string `json:"display_values_supported,omitempty"`
-	ClaimTypesSupported           []string `json:"claim_types_supported,omitempty"`
-	ClaimsSupported               []string `json:"claims_supported,omitempty"`
-	ServiceDocs                   string   `json:"service_documentation,omitempty"`
-	ClaimsLocalsSupported         []string `json:"claims_locales_supported,omitempty"`
-	UILocalsSupported             []string `json:"ui_locales_supported,omitempty"`
-	ClaimsParameterSupported      bool     `json:"claims_parameter_supported,omitempty"`
-	RequestParameterSupported     bool     `json:"request_parameter_supported,omitempty"`
-	RequestURIParamaterSupported  bool     `json:"request_uri_parameter_supported,omitempty"`
-	RequireRequestURIRegistration bool     `json:"require_request_uri_registration,omitempty"`
-
-	Policy         string `json:"op_policy_uri,omitempty"`
-	TermsOfService string `json:"op_tos_uri,omitempty"`
-}
-
-func (cfg ProviderConfig) toEncodableStruct() encodableProviderConfig {
-	return encodableProviderConfig{
-		Issuer:                                     uriToString(cfg.Issuer),
-		AuthEndpoint:                               uriToString(cfg.AuthEndpoint),
-		TokenEndpoint:                              uriToString(cfg.TokenEndpoint),
-		UserInfoEndpoint:                           uriToString(cfg.UserInfoEndpoint),
-		KeysEndpoint:                               uriToString(cfg.KeysEndpoint),
-		RegistrationEndpoint:                       uriToString(cfg.RegistrationEndpoint),
-		EndSessionEndpoint:                         uriToString(cfg.EndSessionEndpoint),
-		CheckSessionIFrame:                         uriToString(cfg.CheckSessionIFrame),
-		ScopesSupported:                            cfg.ScopesSupported,
-		ResponseTypesSupported:                     cfg.ResponseTypesSupported,
-		ResponseModesSupported:                     cfg.ResponseModesSupported,
-		GrantTypesSupported:                        cfg.GrantTypesSupported,
-		ACRValuesSupported:                         cfg.ACRValuesSupported,
-		SubjectTypesSupported:                      cfg.SubjectTypesSupported,
-		IDTokenSigningAlgValues:                    cfg.IDTokenSigningAlgValues,
-		IDTokenEncryptionAlgValues:                 cfg.IDTokenEncryptionAlgValues,
-		IDTokenEncryptionEncValues:                 cfg.IDTokenEncryptionEncValues,
-		UserInfoSigningAlgValues:                   cfg.UserInfoSigningAlgValues,
-		UserInfoEncryptionAlgValues:                cfg.UserInfoEncryptionAlgValues,
-		UserInfoEncryptionEncValues:                cfg.UserInfoEncryptionEncValues,
-		ReqObjSigningAlgValues:                     cfg.ReqObjSigningAlgValues,
-		ReqObjEncryptionAlgValues:                  cfg.ReqObjEncryptionAlgValues,
-		ReqObjEncryptionEncValues:                  cfg.ReqObjEncryptionEncValues,
-		TokenEndpointAuthMethodsSupported:          cfg.TokenEndpointAuthMethodsSupported,
-		TokenEndpointAuthSigningAlgValuesSupported: cfg.TokenEndpointAuthSigningAlgValuesSupported,
-		DisplayValuesSupported:                     cfg.DisplayValuesSupported,
-		ClaimTypesSupported:                        cfg.ClaimTypesSupported,
-		ClaimsSupported:                            cfg.ClaimsSupported,
-		ServiceDocs:                                uriToString(cfg.ServiceDocs),
-		ClaimsLocalsSupported:                      cfg.ClaimsLocalsSupported,
-		UILocalsSupported:                          cfg.UILocalsSupported,
-		ClaimsParameterSupported:                   cfg.ClaimsParameterSupported,
-		RequestParameterSupported:                  cfg.RequestParameterSupported,
-		RequestURIParamaterSupported:               cfg.RequestURIParamaterSupported,
-		RequireRequestURIRegistration:              cfg.RequireRequestURIRegistration,
-		Policy:         uriToString(cfg.Policy),
-		TermsOfService: uriToString(cfg.TermsOfService),
-	}
-}
-
-func (e encodableProviderConfig) toStruct() (ProviderConfig, error) {
-	p := stickyErrParser{}
-	conf := ProviderConfig{
-		Issuer:                                     p.parseURI(e.Issuer, "issuer"),
-		AuthEndpoint:                               p.parseURI(e.AuthEndpoint, "authorization_endpoint"),
-		TokenEndpoint:                              p.parseURI(e.TokenEndpoint, "token_endpoint"),
-		UserInfoEndpoint:                           p.parseURI(e.UserInfoEndpoint, "userinfo_endpoint"),
-		KeysEndpoint:                               p.parseURI(e.KeysEndpoint, "jwks_uri"),
-		RegistrationEndpoint:                       p.parseURI(e.RegistrationEndpoint, "registration_endpoint"),
-		EndSessionEndpoint:                         p.parseURI(e.EndSessionEndpoint, "end_session_endpoint"),
-		CheckSessionIFrame:                         p.parseURI(e.CheckSessionIFrame, "check_session_iframe"),
-		ScopesSupported:                            e.ScopesSupported,
-		ResponseTypesSupported:                     e.ResponseTypesSupported,
-		ResponseModesSupported:                     e.ResponseModesSupported,
-		GrantTypesSupported:                        e.GrantTypesSupported,
-		ACRValuesSupported:                         e.ACRValuesSupported,
-		SubjectTypesSupported:                      e.SubjectTypesSupported,
-		IDTokenSigningAlgValues:                    e.IDTokenSigningAlgValues,
-		IDTokenEncryptionAlgValues:                 e.IDTokenEncryptionAlgValues,
-		IDTokenEncryptionEncValues:                 e.IDTokenEncryptionEncValues,
-		UserInfoSigningAlgValues:                   e.UserInfoSigningAlgValues,
-		UserInfoEncryptionAlgValues:                e.UserInfoEncryptionAlgValues,
-		UserInfoEncryptionEncValues:                e.UserInfoEncryptionEncValues,
-		ReqObjSigningAlgValues:                     e.ReqObjSigningAlgValues,
-		ReqObjEncryptionAlgValues:                  e.ReqObjEncryptionAlgValues,
-		ReqObjEncryptionEncValues:                  e.ReqObjEncryptionEncValues,
-		TokenEndpointAuthMethodsSupported:          e.TokenEndpointAuthMethodsSupported,
-		TokenEndpointAuthSigningAlgValuesSupported: e.TokenEndpointAuthSigningAlgValuesSupported,
-		DisplayValuesSupported:                     e.DisplayValuesSupported,
-		ClaimTypesSupported:                        e.ClaimTypesSupported,
-		ClaimsSupported:                            e.ClaimsSupported,
-		ServiceDocs:                                p.parseURI(e.ServiceDocs, "service_documentation"),
-		ClaimsLocalsSupported:                      e.ClaimsLocalsSupported,
-		UILocalsSupported:                          e.UILocalsSupported,
-		ClaimsParameterSupported:                   e.ClaimsParameterSupported,
-		RequestParameterSupported:                  e.RequestParameterSupported,
-		RequestURIParamaterSupported:               e.RequestURIParamaterSupported,
-		RequireRequestURIRegistration:              e.RequireRequestURIRegistration,
-		Policy:         p.parseURI(e.Policy, "op_policy-uri"),
-		TermsOfService: p.parseURI(e.TermsOfService, "op_tos_uri"),
-	}
-	if p.firstErr != nil {
-		return ProviderConfig{}, p.firstErr
-	}
-	return conf, nil
-}
-
-// Empty returns if a ProviderConfig holds no information.
-//
-// This case generally indicates a ProviderConfigGetter has experienced an error
-// and has nothing to report.
-func (p ProviderConfig) Empty() bool {
-	return p.Issuer == nil
-}
-
-func contains(sli []string, ele string) bool {
-	for _, s := range sli {
-		if s == ele {
-			return true
-		}
-	}
-	return false
-}
-
-// Valid determines if a ProviderConfig conforms with the OIDC specification.
-// If Valid returns successfully it guarantees required field are non-nil and
-// URLs are well formed.
-//
-// Valid is called by UnmarshalJSON.
-//
-// NOTE(ericchiang): For development purposes Valid does not mandate 'https' for
-// URLs fields where the OIDC spec requires it. This may change in future releases
-// of this package. See: https://github.com/coreos/go-oidc/issues/34
-func (p ProviderConfig) Valid() error {
-	grantTypes := p.GrantTypesSupported
-	if len(grantTypes) == 0 {
-		grantTypes = DefaultGrantTypesSupported
-	}
-	implicitOnly := true
-	for _, grantType := range grantTypes {
-		if grantType != oauth2.GrantTypeImplicit {
-			implicitOnly = false
-			break
-		}
-	}
-
-	if len(p.SubjectTypesSupported) == 0 {
-		return errors.New("missing required field subject_types_supported")
-	}
-	if len(p.IDTokenSigningAlgValues) == 0 {
-		return errors.New("missing required field id_token_signing_alg_values_supported")
-	}
-
-	if len(p.ScopesSupported) != 0 && !contains(p.ScopesSupported, "openid") {
-		return errors.New("scoped_supported must be unspecified or include 'openid'")
-	}
-
-	if !contains(p.IDTokenSigningAlgValues, "RS256") {
-		return errors.New("id_token_signing_alg_values_supported must include 'RS256'")
-	}
-
-	uris := []struct {
-		val      *url.URL
-		name     string
-		required bool
-	}{
-		{p.Issuer, "issuer", true},
-		{p.AuthEndpoint, "authorization_endpoint", true},
-		{p.TokenEndpoint, "token_endpoint", !implicitOnly},
-		{p.UserInfoEndpoint, "userinfo_endpoint", false},
-		{p.KeysEndpoint, "jwks_uri", true},
-		{p.RegistrationEndpoint, "registration_endpoint", false},
-		{p.EndSessionEndpoint, "end_session_endpoint", false},
-		{p.CheckSessionIFrame, "check_session_iframe", false},
-		{p.ServiceDocs, "service_documentation", false},
-		{p.Policy, "op_policy_uri", false},
-		{p.TermsOfService, "op_tos_uri", false},
-	}
-
-	for _, uri := range uris {
-		if uri.val == nil {
-			if !uri.required {
-				continue
-			}
-			return fmt.Errorf("empty value for required uri field %s", uri.name)
-		}
-		if uri.val.Host == "" {
-			return fmt.Errorf("no host for uri field %s", uri.name)
-		}
-		if uri.val.Scheme != "http" && uri.val.Scheme != "https" {
-			return fmt.Errorf("uri field %s schemeis not http or https", uri.name)
-		}
-	}
-	return nil
-}
-
-// Supports determines if provider supports a client given their respective metadata.
-func (p ProviderConfig) Supports(c ClientMetadata) error {
-	if err := p.Valid(); err != nil {
-		return fmt.Errorf("invalid provider config: %v", err)
-	}
-	if err := c.Valid(); err != nil {
-		return fmt.Errorf("invalid client config: %v", err)
-	}
-
-	// Fill default values for omitted fields
-	c = c.Defaults()
-	p = p.Defaults()
-
-	// Do the supported values list the requested one?
-	supports := []struct {
-		supported []string
-		requested string
-		name      string
-	}{
-		{p.IDTokenSigningAlgValues, c.IDTokenResponseOptions.SigningAlg, "id_token_signed_response_alg"},
-		{p.IDTokenEncryptionAlgValues, c.IDTokenResponseOptions.EncryptionAlg, "id_token_encryption_response_alg"},
-		{p.IDTokenEncryptionEncValues, c.IDTokenResponseOptions.EncryptionEnc, "id_token_encryption_response_enc"},
-		{p.UserInfoSigningAlgValues, c.UserInfoResponseOptions.SigningAlg, "userinfo_signed_response_alg"},
-		{p.UserInfoEncryptionAlgValues, c.UserInfoResponseOptions.EncryptionAlg, "userinfo_encryption_response_alg"},
-		{p.UserInfoEncryptionEncValues, c.UserInfoResponseOptions.EncryptionEnc, "userinfo_encryption_response_enc"},
-		{p.ReqObjSigningAlgValues, c.RequestObjectOptions.SigningAlg, "request_object_signing_alg"},
-		{p.ReqObjEncryptionAlgValues, c.RequestObjectOptions.EncryptionAlg, "request_object_encryption_alg"},
-		{p.ReqObjEncryptionEncValues, c.RequestObjectOptions.EncryptionEnc, "request_object_encryption_enc"},
-	}
-	for _, field := range supports {
-		if field.requested == "" {
-			continue
-		}
-		if !contains(field.supported, field.requested) {
-			return fmt.Errorf("provider does not support requested value for field %s", field.name)
-		}
-	}
-
-	stringsEqual := func(s1, s2 string) bool { return s1 == s2 }
-
-	// For lists, are the list of requested values a subset of the supported ones?
-	supportsAll := []struct {
-		supported []string
-		requested []string
-		name      string
-		// OAuth2.0 response_type can be space separated lists where order doesn't matter.
-		// For example "id_token token" is the same as "token id_token"
-		// Support a custom compare method.
-		comp func(s1, s2 string) bool
-	}{
-		{p.GrantTypesSupported, c.GrantTypes, "grant_types", stringsEqual},
-		{p.ResponseTypesSupported, c.ResponseTypes, "response_type", oauth2.ResponseTypesEqual},
-	}
-	for _, field := range supportsAll {
-	requestLoop:
-		for _, req := range field.requested {
-			for _, sup := range field.supported {
-				if field.comp(req, sup) {
-					continue requestLoop
-				}
-			}
-			return fmt.Errorf("provider does not support requested value for field %s", field.name)
-		}
-	}
-
-	// TODO(ericchiang): Are there more checks we feel comfortable with begin strict about?
-
-	return nil
-}
-
-func (p ProviderConfig) SupportsGrantType(grantType string) bool {
-	var supported []string
-	if len(p.GrantTypesSupported) == 0 {
-		supported = DefaultGrantTypesSupported
-	} else {
-		supported = p.GrantTypesSupported
-	}
-
-	for _, t := range supported {
-		if t == grantType {
-			return true
-		}
-	}
-	return false
-}
-
-type ProviderConfigGetter interface {
-	Get() (ProviderConfig, error)
-}
-
-type ProviderConfigSetter interface {
-	Set(ProviderConfig) error
-}
-
-type ProviderConfigSyncer struct {
-	from  ProviderConfigGetter
-	to    ProviderConfigSetter
-	clock clockwork.Clock
-
-	initialSyncDone bool
-	initialSyncWait sync.WaitGroup
-}
-
-func NewProviderConfigSyncer(from ProviderConfigGetter, to ProviderConfigSetter) *ProviderConfigSyncer {
-	return &ProviderConfigSyncer{
-		from:  from,
-		to:    to,
-		clock: clockwork.NewRealClock(),
-	}
-}
-
-func (s *ProviderConfigSyncer) Run() chan struct{} {
-	stop := make(chan struct{})
-
-	var next pcsStepper
-	next = &pcsStepNext{aft: time.Duration(0)}
-
-	s.initialSyncWait.Add(1)
-	go func() {
-		for {
-			select {
-			case <-s.clock.After(next.after()):
-				next = next.step(s.sync)
-			case <-stop:
-				return
-			}
-		}
-	}()
-
-	return stop
-}
-
-func (s *ProviderConfigSyncer) WaitUntilInitialSync() {
-	s.initialSyncWait.Wait()
-}
-
-func (s *ProviderConfigSyncer) sync() (time.Duration, error) {
-	cfg, err := s.from.Get()
-	if err != nil {
-		return 0, err
-	}
-
-	if err = s.to.Set(cfg); err != nil {
-		return 0, fmt.Errorf("error setting provider config: %v", err)
-	}
-
-	if !s.initialSyncDone {
-		s.initialSyncWait.Done()
-		s.initialSyncDone = true
-	}
-
-	return nextSyncAfter(cfg.ExpiresAt, s.clock), nil
-}
-
-type pcsStepFunc func() (time.Duration, error)
-
-type pcsStepper interface {
-	after() time.Duration
-	step(pcsStepFunc) pcsStepper
-}
-
-type pcsStepNext struct {
-	aft time.Duration
-}
-
-func (n *pcsStepNext) after() time.Duration {
-	return n.aft
-}
-
-func (n *pcsStepNext) step(fn pcsStepFunc) (next pcsStepper) {
-	ttl, err := fn()
-	if err == nil {
-		next = &pcsStepNext{aft: ttl}
-	} else {
-		next = &pcsStepRetry{aft: time.Second}
-		log.Printf("go-oidc: provider config sync failed, retrying in %v: %v", next.after(), err)
-	}
-	return
-}
-
-type pcsStepRetry struct {
-	aft time.Duration
-}
-
-func (r *pcsStepRetry) after() time.Duration {
-	return r.aft
-}
-
-func (r *pcsStepRetry) step(fn pcsStepFunc) (next pcsStepper) {
-	ttl, err := fn()
-	if err == nil {
-		next = &pcsStepNext{aft: ttl}
-	} else {
-		next = &pcsStepRetry{aft: timeutil.ExpBackoff(r.aft, time.Minute)}
-		log.Printf("go-oidc: provider config sync failed, retrying in %v: %v", next.after(), err)
-	}
-	return
-}
-
-func nextSyncAfter(exp time.Time, clock clockwork.Clock) time.Duration {
-	if exp.IsZero() {
-		return MaximumProviderConfigSyncInterval
-	}
-
-	t := exp.Sub(clock.Now()) / 2
-	if t > MaximumProviderConfigSyncInterval {
-		t = MaximumProviderConfigSyncInterval
-	} else if t < minimumProviderConfigSyncInterval {
-		t = minimumProviderConfigSyncInterval
-	}
-
-	return t
-}
-
-type httpProviderConfigGetter struct {
-	hc        phttp.Client
-	issuerURL string
-	clock     clockwork.Clock
-}
-
-func NewHTTPProviderConfigGetter(hc phttp.Client, issuerURL string) *httpProviderConfigGetter {
-	return &httpProviderConfigGetter{
-		hc:        hc,
-		issuerURL: issuerURL,
-		clock:     clockwork.NewRealClock(),
-	}
-}
-
-func (r *httpProviderConfigGetter) Get() (cfg ProviderConfig, err error) {
-	// If the Issuer value contains a path component, any terminating / MUST be removed before
-	// appending /.well-known/openid-configuration.
-	// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
-	discoveryURL := strings.TrimSuffix(r.issuerURL, "/") + discoveryConfigPath
-	req, err := http.NewRequest("GET", discoveryURL, nil)
-	if err != nil {
-		return
-	}
-
-	resp, err := r.hc.Do(req)
-	if err != nil {
-		return
-	}
-	defer resp.Body.Close()
-
-	if err = json.NewDecoder(resp.Body).Decode(&cfg); err != nil {
-		return
-	}
-
-	var ttl time.Duration
-	var ok bool
-	ttl, ok, err = phttp.Cacheable(resp.Header)
-	if err != nil {
-		return
-	} else if ok {
-		cfg.ExpiresAt = r.clock.Now().UTC().Add(ttl)
-	}
-
-	// The issuer value returned MUST be identical to the Issuer URL that was directly used to retrieve the configuration information.
-	// http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
-	if !urlEqual(cfg.Issuer.String(), r.issuerURL) {
-		err = fmt.Errorf(`"issuer" in config (%v) does not match provided issuer URL (%v)`, cfg.Issuer, r.issuerURL)
-		return
-	}
-
-	return
-}
-
-func FetchProviderConfig(hc phttp.Client, issuerURL string) (ProviderConfig, error) {
-	if hc == nil {
-		hc = http.DefaultClient
-	}
-
-	g := NewHTTPProviderConfigGetter(hc, issuerURL)
-	return g.Get()
-}
-
-func WaitForProviderConfig(hc phttp.Client, issuerURL string) (pcfg ProviderConfig) {
-	return waitForProviderConfig(hc, issuerURL, clockwork.NewRealClock())
-}
-
-func waitForProviderConfig(hc phttp.Client, issuerURL string, clock clockwork.Clock) (pcfg ProviderConfig) {
-	var sleep time.Duration
-	var err error
-	for {
-		pcfg, err = FetchProviderConfig(hc, issuerURL)
-		if err == nil {
-			break
-		}
-
-		sleep = timeutil.ExpBackoff(sleep, time.Minute)
-		fmt.Printf("Failed fetching provider config, trying again in %v: %v\n", sleep, err)
-		time.Sleep(sleep)
-	}
-
-	return
-}
@@ -1,88 +0,0 @@
-package oidc
-
-import (
-	"fmt"
-	"net/http"
-	"sync"
-
-	phttp "github.com/coreos/go-oidc/http"
-	"github.com/coreos/go-oidc/jose"
-)
-
-type TokenRefresher interface {
-	// Verify checks if the provided token is currently valid or not.
-	Verify(jose.JWT) error
-
-	// Refresh attempts to authenticate and retrieve a new token.
-	Refresh() (jose.JWT, error)
-}
-
-type ClientCredsTokenRefresher struct {
-	Issuer     string
-	OIDCClient *Client
-}
-
-func (c *ClientCredsTokenRefresher) Verify(jwt jose.JWT) (err error) {
-	_, err = VerifyClientClaims(jwt, c.Issuer)
-	return
-}
-
-func (c *ClientCredsTokenRefresher) Refresh() (jwt jose.JWT, err error) {
-	if err = c.OIDCClient.Healthy(); err != nil {
-		err = fmt.Errorf("unable to authenticate, unhealthy OIDC client: %v", err)
-		return
-	}
-
-	jwt, err = c.OIDCClient.ClientCredsToken([]string{"openid"})
-	if err != nil {
-		err = fmt.Errorf("unable to verify auth code with issuer: %v", err)
-		return
-	}
-
-	return
-}
-
-type AuthenticatedTransport struct {
-	TokenRefresher
-	http.RoundTripper
-
-	mu  sync.Mutex
-	jwt jose.JWT
-}
-
-func (t *AuthenticatedTransport) verifiedJWT() (jose.JWT, error) {
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
-	if t.TokenRefresher.Verify(t.jwt) == nil {
-		return t.jwt, nil
-	}
-
-	jwt, err := t.TokenRefresher.Refresh()
-	if err != nil {
-		return jose.JWT{}, fmt.Errorf("unable to acquire valid JWT: %v", err)
-	}
-
-	t.jwt = jwt
-	return t.jwt, nil
-}
-
-// SetJWT sets the JWT held by the Transport.
-// This is useful for cases in which you want to set an initial JWT.
-func (t *AuthenticatedTransport) SetJWT(jwt jose.JWT) {
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
-	t.jwt = jwt
-}
-
-func (t *AuthenticatedTransport) RoundTrip(r *http.Request) (*http.Response, error) {
-	jwt, err := t.verifiedJWT()
-	if err != nil {
-		return nil, err
-	}
-
-	req := phttp.CopyRequest(r)
-	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", jwt.Encode()))
-	return t.RoundTripper.RoundTrip(req)
-}
@@ -1,109 +0,0 @@
-package oidc
-
-import (
-	"crypto/rand"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-)
-
-// RequestTokenExtractor funcs extract a raw encoded token from a request.
-type RequestTokenExtractor func(r *http.Request) (string, error)
-
-// ExtractBearerToken is a RequestTokenExtractor which extracts a bearer token from a request's
-// Authorization header.
-func ExtractBearerToken(r *http.Request) (string, error) {
-	ah := r.Header.Get("Authorization")
-	if ah == "" {
-		return "", errors.New("missing Authorization header")
-	}
-
-	if len(ah) <= 6 || strings.ToUpper(ah[0:6]) != "BEARER" {
-		return "", errors.New("should be a bearer token")
-	}
-
-	val := ah[7:]
-	if len(val) == 0 {
-		return "", errors.New("bearer token is empty")
-	}
-
-	return val, nil
-}
-
-// CookieTokenExtractor returns a RequestTokenExtractor which extracts a token from the named cookie in a request.
-func CookieTokenExtractor(cookieName string) RequestTokenExtractor {
-	return func(r *http.Request) (string, error) {
-		ck, err := r.Cookie(cookieName)
-		if err != nil {
-			return "", fmt.Errorf("token cookie not found in request: %v", err)
-		}
-
-		if ck.Value == "" {
-			return "", errors.New("token cookie found but is empty")
-		}
-
-		return ck.Value, nil
-	}
-}
-
-func NewClaims(iss, sub string, aud interface{}, iat, exp time.Time) jose.Claims {
-	return jose.Claims{
-		// required
-		"iss": iss,
-		"sub": sub,
-		"aud": aud,
-		"iat": iat.Unix(),
-		"exp": exp.Unix(),
-	}
-}
-
-func GenClientID(hostport string) (string, error) {
-	b, err := randBytes(32)
-	if err != nil {
-		return "", err
-	}
-
-	var host string
-	if strings.Contains(hostport, ":") {
-		host, _, err = net.SplitHostPort(hostport)
-		if err != nil {
-			return "", err
-		}
-	} else {
-		host = hostport
-	}
-
-	return fmt.Sprintf("%s@%s", base64.URLEncoding.EncodeToString(b), host), nil
-}
-
-func randBytes(n int) ([]byte, error) {
-	b := make([]byte, n)
-	got, err := rand.Read(b)
-	if err != nil {
-		return nil, err
-	} else if n != got {
-		return nil, errors.New("unable to generate enough random data")
-	}
-	return b, nil
-}
-
-// urlEqual checks two urls for equality using only the host and path portions.
-func urlEqual(url1, url2 string) bool {
-	u1, err := url.Parse(url1)
-	if err != nil {
-		return false
-	}
-	u2, err := url.Parse(url2)
-	if err != nil {
-		return false
-	}
-
-	return strings.ToLower(u1.Host+u1.Path) == strings.ToLower(u2.Host+u2.Path)
-}
@@ -1,190 +0,0 @@
-package oidc
-
-import (
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/go-oidc/key"
-)
-
-func VerifySignature(jwt jose.JWT, keys []key.PublicKey) (bool, error) {
-	jwtBytes := []byte(jwt.Data())
-	for _, k := range keys {
-		v, err := k.Verifier()
-		if err != nil {
-			return false, err
-		}
-		if v.Verify(jwt.Signature, jwtBytes) == nil {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-// containsString returns true if the given string(needle) is found
-// in the string array(haystack).
-func containsString(needle string, haystack []string) bool {
-	for _, v := range haystack {
-		if v == needle {
-			return true
-		}
-	}
-	return false
-}
-
-// Verify claims in accordance with OIDC spec
-// http://openid.net/specs/openid-connect-basic-1_0.html#IDTokenValidation
-func VerifyClaims(jwt jose.JWT, issuer, clientID string) error {
-	now := time.Now().UTC()
-
-	claims, err := jwt.Claims()
-	if err != nil {
-		return err
-	}
-
-	ident, err := IdentityFromClaims(claims)
-	if err != nil {
-		return err
-	}
-
-	if ident.ExpiresAt.Before(now) {
-		return errors.New("token is expired")
-	}
-
-	// iss REQUIRED. Issuer Identifier for the Issuer of the response.
-	// The iss value is a case sensitive URL using the https scheme that contains scheme,
-	// host, and optionally, port number and path components and no query or fragment components.
-	if iss, exists := claims["iss"].(string); exists {
-		if !urlEqual(iss, issuer) {
-			return fmt.Errorf("invalid claim value: 'iss'. expected=%s, found=%s.", issuer, iss)
-		}
-	} else {
-		return errors.New("missing claim: 'iss'")
-	}
-
-	// iat REQUIRED. Time at which the JWT was issued.
-	// Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z
-	// as measured in UTC until the date/time.
-	if _, exists := claims["iat"].(float64); !exists {
-		return errors.New("missing claim: 'iat'")
-	}
-
-	// aud REQUIRED. Audience(s) that this ID Token is intended for.
-	// It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value.
-	// It MAY also contain identifiers for other audiences. In the general case, the aud
-	// value is an array of case sensitive strings. In the common special case when there
-	// is one audience, the aud value MAY be a single case sensitive string.
-	if aud, ok, err := claims.StringClaim("aud"); err == nil && ok {
-		if aud != clientID {
-			return fmt.Errorf("invalid claims, 'aud' claim and 'client_id' do not match, aud=%s, client_id=%s", aud, clientID)
-		}
-	} else if aud, ok, err := claims.StringsClaim("aud"); err == nil && ok {
-		if !containsString(clientID, aud) {
-			return fmt.Errorf("invalid claims, cannot find 'client_id' in 'aud' claim, aud=%v, client_id=%s", aud, clientID)
-		}
-	} else {
-		return errors.New("invalid claim value: 'aud' is required, and should be either string or string array")
-	}
-
-	return nil
-}
-
-// VerifyClientClaims verifies all the required claims are valid for a "client credentials" JWT.
-// Returns the client ID if valid, or an error if invalid.
-func VerifyClientClaims(jwt jose.JWT, issuer string) (string, error) {
-	claims, err := jwt.Claims()
-	if err != nil {
-		return "", fmt.Errorf("failed to parse JWT claims: %v", err)
-	}
-
-	iss, ok, err := claims.StringClaim("iss")
-	if err != nil {
-		return "", fmt.Errorf("failed to parse 'iss' claim: %v", err)
-	} else if !ok {
-		return "", errors.New("missing required 'iss' claim")
-	} else if !urlEqual(iss, issuer) {
-		return "", fmt.Errorf("'iss' claim does not match expected issuer, iss=%s", iss)
-	}
-
-	sub, ok, err := claims.StringClaim("sub")
-	if err != nil {
-		return "", fmt.Errorf("failed to parse 'sub' claim: %v", err)
-	} else if !ok {
-		return "", errors.New("missing required 'sub' claim")
-	}
-
-	if aud, ok, err := claims.StringClaim("aud"); err == nil && ok {
-		if aud != sub {
-			return "", fmt.Errorf("invalid claims, 'aud' claim and 'sub' claim do not match, aud=%s, sub=%s", aud, sub)
-		}
-	} else if aud, ok, err := claims.StringsClaim("aud"); err == nil && ok {
-		if !containsString(sub, aud) {
-			return "", fmt.Errorf("invalid claims, cannot find 'sud' in 'aud' claim, aud=%v, sub=%s", aud, sub)
-		}
-	} else {
-		return "", errors.New("invalid claim value: 'aud' is required, and should be either string or string array")
-	}
-
-	now := time.Now().UTC()
-	exp, ok, err := claims.TimeClaim("exp")
-	if err != nil {
-		return "", fmt.Errorf("failed to parse 'exp' claim: %v", err)
-	} else if !ok {
-		return "", errors.New("missing required 'exp' claim")
-	} else if exp.Before(now) {
-		return "", fmt.Errorf("token already expired at: %v", exp)
-	}
-
-	return sub, nil
-}
-
-type JWTVerifier struct {
-	issuer   string
-	clientID string
-	syncFunc func() error
-	keysFunc func() []key.PublicKey
-	clock    clockwork.Clock
-}
-
-func NewJWTVerifier(issuer, clientID string, syncFunc func() error, keysFunc func() []key.PublicKey) JWTVerifier {
-	return JWTVerifier{
-		issuer:   issuer,
-		clientID: clientID,
-		syncFunc: syncFunc,
-		keysFunc: keysFunc,
-		clock:    clockwork.NewRealClock(),
-	}
-}
-
-func (v *JWTVerifier) Verify(jwt jose.JWT) error {
-	// Verify claims before verifying the signature. This is an optimization to throw out
-	// tokens we know are invalid without undergoing an expensive signature check and
-	// possibly a re-sync event.
-	if err := VerifyClaims(jwt, v.issuer, v.clientID); err != nil {
-		return fmt.Errorf("oidc: JWT claims invalid: %v", err)
-	}
-
-	ok, err := VerifySignature(jwt, v.keysFunc())
-	if err != nil {
-		return fmt.Errorf("oidc: JWT signature verification failed: %v", err)
-	} else if ok {
-		return nil
-	}
-
-	if err = v.syncFunc(); err != nil {
-		return fmt.Errorf("oidc: failed syncing KeySet: %v", err)
-	}
-
-	ok, err = VerifySignature(jwt, v.keysFunc())
-	if err != nil {
-		return fmt.Errorf("oidc: JWT signature verification failed: %v", err)
-	} else if !ok {
-		return errors.New("oidc: unable to verify JWT signature: no matching keys")
-	}
-
-	return nil
-}
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+# Filter out any files with a !golint build tag.
+LINTABLE=$( go list -tags=golint -f '
+  {{- range $i, $file := .GoFiles -}}
+    {{ $file }} {{ end }}
+  {{ range $i, $file := .TestGoFiles -}}
+    {{ $file }} {{ end }}' github.com/coreos/go-oidc )
+
+go test -v -i -race github.com/coreos/go-oidc/...
+go test -v -race github.com/coreos/go-oidc/...
+golint -set_exit_status $LINTABLE
+go vet github.com/coreos/go-oidc/...
+go build -v ./example/...
@@ -0,0 +1,316 @@
+package oidc
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"strings"
+	"time"
+
+	"golang.org/x/oauth2"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+const (
+	issuerGoogleAccounts         = "https://accounts.google.com"
+	issuerGoogleAccountsNoScheme = "accounts.google.com"
+)
+
+// KeySet is a set of publc JSON Web Keys that can be used to validate the signature
+// of JSON web tokens. This is expected to be backed by a remote key set through
+// provider metadata discovery or an in-memory set of keys delivered out-of-band.
+type KeySet interface {
+	// VerifySignature parses the JSON web token, verifies the signature, and returns
+	// the raw payload. Header and claim fields are validated by other parts of the
+	// package. For example, the KeySet does not need to check values such as signature
+	// algorithm, issuer, and audience since the IDTokenVerifier validates these values
+	// independently.
+	//
+	// If VerifySignature makes HTTP requests to verify the token, it's expected to
+	// use any HTTP client associated with the context through ClientContext.
+	VerifySignature(ctx context.Context, jwt string) (payload []byte, err error)
+}
+
+// IDTokenVerifier provides verification for ID Tokens.
+type IDTokenVerifier struct {
+	keySet KeySet
+	config *Config
+	issuer string
+}
+
+// NewVerifier returns a verifier manually constructed from a key set and issuer URL.
+//
+// It's easier to use provider discovery to construct an IDTokenVerifier than creating
+// one directly. This method is intended to be used with provider that don't support
+// metadata discovery, or avoiding round trips when the key set URL is already known.
+//
+// This constructor can be used to create a verifier directly using the issuer URL and
+// JSON Web Key Set URL without using discovery:
+//
+//		keySet := oidc.NewRemoteKeySet(ctx, "https://www.googleapis.com/oauth2/v3/certs")
+//		verifier := oidc.NewVerifier("https://accounts.google.com", keySet, config)
+//
+// Since KeySet is an interface, this constructor can also be used to supply custom
+// public key sources. For example, if a user wanted to supply public keys out-of-band
+// and hold them statically in-memory:
+//
+//		// Custom KeySet implementation.
+//		keySet := newStatisKeySet(publicKeys...)
+//
+//		// Verifier uses the custom KeySet implementation.
+//		verifier := oidc.NewVerifier("https://auth.example.com", keySet, config)
+//
+func NewVerifier(issuerURL string, keySet KeySet, config *Config) *IDTokenVerifier {
+	return &IDTokenVerifier{keySet: keySet, config: config, issuer: issuerURL}
+}
+
+// Config is the configuration for an IDTokenVerifier.
+type Config struct {
+	// Expected audience of the token. For a majority of the cases this is expected to be
+	// the ID of the client that initialized the login flow. It may occasionally differ if
+	// the provider supports the authorizing party (azp) claim.
+	//
+	// If not provided, users must explicitly set SkipClientIDCheck.
+	ClientID string
+	// If specified, only this set of algorithms may be used to sign the JWT.
+	//
+	// Since many providers only support RS256, SupportedSigningAlgs defaults to this value.
+	SupportedSigningAlgs []string
+
+	// If true, no ClientID check performed. Must be true if ClientID field is empty.
+	SkipClientIDCheck bool
+	// If true, token expiry is not checked.
+	SkipExpiryCheck bool
+
+	// SkipIssuerCheck is intended for specialized cases where the the caller wishes to
+	// defer issuer validation. When enabled, callers MUST independently verify the Token's
+	// Issuer is a known good value.
+	//
+	// Mismatched issuers often indicate client mis-configuration. If mismatches are
+	// unexpected, evaluate if the provided issuer URL is incorrect instead of enabling
+	// this option.
+	SkipIssuerCheck bool
+
+	// Time function to check Token expiry. Defaults to time.Now
+	Now func() time.Time
+}
+
+// Verifier returns an IDTokenVerifier that uses the provider's key set to verify JWTs.
+//
+// The returned IDTokenVerifier is tied to the Provider's context and its behavior is
+// undefined once the Provider's context is canceled.
+func (p *Provider) Verifier(config *Config) *IDTokenVerifier {
+	return NewVerifier(p.issuer, p.remoteKeySet, config)
+}
+
+func parseJWT(p string) ([]byte, error) {
+	parts := strings.Split(p, ".")
+	if len(parts) < 2 {
+		return nil, fmt.Errorf("oidc: malformed jwt, expected 3 parts got %d", len(parts))
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt payload: %v", err)
+	}
+	return payload, nil
+}
+
+func contains(sli []string, ele string) bool {
+	for _, s := range sli {
+		if s == ele {
+			return true
+		}
+	}
+	return false
+}
+
+// Returns the Claims from the distributed JWT token
+func resolveDistributedClaim(ctx context.Context, verifier *IDTokenVerifier, src claimSource) ([]byte, error) {
+	req, err := http.NewRequest("GET", src.Endpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("malformed request: %v", err)
+	}
+	if src.AccessToken != "" {
+		req.Header.Set("Authorization", "Bearer "+src.AccessToken)
+	}
+
+	resp, err := doRequest(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: Request to endpoint failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read response body: %v", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("oidc: request failed: %v", resp.StatusCode)
+	}
+
+	token, err := verifier.Verify(ctx, string(body))
+	if err != nil {
+		return nil, fmt.Errorf("malformed response body: %v", err)
+	}
+
+	return token.claims, nil
+}
+
+func parseClaim(raw []byte, name string, v interface{}) error {
+	var parsed map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &parsed); err != nil {
+		return err
+	}
+
+	val, ok := parsed[name]
+	if !ok {
+		return fmt.Errorf("claim doesn't exist: %s", name)
+	}
+
+	return json.Unmarshal([]byte(val), v)
+}
+
+// Verify parses a raw ID Token, verifies it's been signed by the provider, preforms
+// any additional checks depending on the Config, and returns the payload.
+//
+// Verify does NOT do nonce validation, which is the callers responsibility.
+//
+// See: https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
+//
+//    oauth2Token, err := oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
+//    if err != nil {
+//        // handle error
+//    }
+//
+//    // Extract the ID Token from oauth2 token.
+//    rawIDToken, ok := oauth2Token.Extra("id_token").(string)
+//    if !ok {
+//        // handle error
+//    }
+//
+//    token, err := verifier.Verify(ctx, rawIDToken)
+//
+func (v *IDTokenVerifier) Verify(ctx context.Context, rawIDToken string) (*IDToken, error) {
+	jws, err := jose.ParseSigned(rawIDToken)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt: %v", err)
+	}
+
+	// Throw out tokens with invalid claims before trying to verify the token. This lets
+	// us do cheap checks before possibly re-syncing keys.
+	payload, err := parseJWT(rawIDToken)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt: %v", err)
+	}
+	var token idToken
+	if err := json.Unmarshal(payload, &token); err != nil {
+		return nil, fmt.Errorf("oidc: failed to unmarshal claims: %v", err)
+	}
+
+	distributedClaims := make(map[string]claimSource)
+
+	//step through the token to map claim names to claim sources"
+	for cn, src := range token.ClaimNames {
+		if src == "" {
+			return nil, fmt.Errorf("oidc: failed to obtain source from claim name")
+		}
+		s, ok := token.ClaimSources[src]
+		if !ok {
+			return nil, fmt.Errorf("oidc: source does not exist")
+		}
+		distributedClaims[cn] = s
+	}
+
+	t := &IDToken{
+		Issuer:            token.Issuer,
+		Subject:           token.Subject,
+		Audience:          []string(token.Audience),
+		Expiry:            time.Time(token.Expiry),
+		IssuedAt:          time.Time(token.IssuedAt),
+		Nonce:             token.Nonce,
+		AccessTokenHash:   token.AtHash,
+		claims:            payload,
+		distributedClaims: distributedClaims,
+	}
+
+	// Check issuer.
+	if !v.config.SkipIssuerCheck && t.Issuer != v.issuer {
+		// Google sometimes returns "accounts.google.com" as the issuer claim instead of
+		// the required "https://accounts.google.com". Detect this case and allow it only
+		// for Google.
+		//
+		// We will not add hooks to let other providers go off spec like this.
+		if !(v.issuer == issuerGoogleAccounts && t.Issuer == issuerGoogleAccountsNoScheme) {
+			return nil, fmt.Errorf("oidc: id token issued by a different provider, expected %q got %q", v.issuer, t.Issuer)
+		}
+	}
+
+	// If a client ID has been provided, make sure it's part of the audience. SkipClientIDCheck must be true if ClientID is empty.
+	//
+	// This check DOES NOT ensure that the ClientID is the party to which the ID Token was issued (i.e. Authorized party).
+	if !v.config.SkipClientIDCheck {
+		if v.config.ClientID != "" {
+			if !contains(t.Audience, v.config.ClientID) {
+				return nil, fmt.Errorf("oidc: expected audience %q got %q", v.config.ClientID, t.Audience)
+			}
+		} else {
+			return nil, fmt.Errorf("oidc: invalid configuration, clientID must be provided or SkipClientIDCheck must be set")
+		}
+	}
+
+	// If a SkipExpiryCheck is false, make sure token is not expired.
+	if !v.config.SkipExpiryCheck {
+		now := time.Now
+		if v.config.Now != nil {
+			now = v.config.Now
+		}
+
+		if t.Expiry.Before(now()) {
+			return nil, fmt.Errorf("oidc: token is expired (Token Expiry: %v)", t.Expiry)
+		}
+	}
+
+	switch len(jws.Signatures) {
+	case 0:
+		return nil, fmt.Errorf("oidc: id token not signed")
+	case 1:
+	default:
+		return nil, fmt.Errorf("oidc: multiple signatures on id token not supported")
+	}
+
+	sig := jws.Signatures[0]
+	supportedSigAlgs := v.config.SupportedSigningAlgs
+	if len(supportedSigAlgs) == 0 {
+		supportedSigAlgs = []string{RS256}
+	}
+
+	if !contains(supportedSigAlgs, sig.Header.Algorithm) {
+		return nil, fmt.Errorf("oidc: id token signed with unsupported algorithm, expected %q got %q", supportedSigAlgs, sig.Header.Algorithm)
+	}
+
+	t.sigAlgorithm = sig.Header.Algorithm
+
+	gotPayload, err := v.keySet.VerifySignature(ctx, rawIDToken)
+	if err != nil {
+		return nil, fmt.Errorf("failed to verify signature: %v", err)
+	}
+
+	// Ensure that the payload returned by the square actually matches the payload parsed earlier.
+	if !bytes.Equal(gotPayload, payload) {
+		return nil, errors.New("oidc: internal error, payload parsed did not match previous payload")
+	}
+
+	return t, nil
+}
+
+// Nonce returns an auth code option which requires the ID Token created by the
+// OpenID Connect provider to contain the specified nonce.
+func Nonce(nonce string) oauth2.AuthCodeOption {
+	return oauth2.SetAuthURLParam("nonce", nonce)
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Chung-Ting Huang	66e087a825	Release 2019.8.3	2019-08-21 11:15:36 -05:00
Michael Borkenstein	47254113ee	Revert "AUTH-1941: Adds initial SSH server implementation" This reverts commit `e9c9bf3cbd`.	2019-08-20 17:20:48 -05:00
Chung-Ting Huang	026f2d1cc9	Release 2019.8.2	2019-08-20 16:47:23 -05:00
Austin Cherry	e9c9bf3cbd	AUTH-1941: Adds initial SSH server implementation	2019-08-20 16:18:37 -05:00
Ashcon Partovi	5da2109811	STOR-519: Add db-connect, a SQL over HTTPS server	2019-08-20 13:13:29 -05:00
Chung-Ting Huang	28f6c2ed7c	TUN-2163: Add GrapQLType method to Scope interface	2019-08-11 12:18:54 -05:00
Areg Harutyunyan	f6c7f8a96c	TUN-2152: Requests with a query in the URL are erroneously escaped	2019-08-06 17:47:00 -05:00
Areg Harutyunyan	1d73c2752e	Release 2019.8.1	2019-08-06 16:40:02 -05:00
Areg Harutyunyan	5afbb3fd6d	Revert "TUN-1736: Missing headers when passing an invalid path" This reverts commit `3c93d9b300`.	2019-08-06 16:35:41 -05:00
Chung-Ting Huang	fd4ab314dc	TUN-2111: Implement custom serialization logic for FallibleConfig and OriginConfig	2019-08-06 10:56:16 -05:00
Michael Borkenstein	993a9bc4b9	Release 2019.8.0	2019-08-06 09:49:49 -05:00
Michael Borkenstein	8d1ea7202a	Merge branch 'mike/AUTH-1972-delete-token-lockfile' of ssh://bitbucket.cfdata.org:7999/tun/cloudflared	2019-08-06 08:12:02 -05:00
Michael Borkenstein	9adbab96af	AUTH-1972: Deletes token lock file if backoff retry attempts exceeded and intercepts signals until lock is released	2019-08-06 08:07:48 -05:00
Chung-Ting Huang	bdd70e798a	TUN-2110: Implement custom deserialization logic for OriginConfig	2019-08-05 19:28:51 -05:00
Adam Chalmers	5feba7e3a9	TUN-2147: Implemented ScopeUnmarshaler	2019-08-05 18:14:32 -05:00
Adam Chalmers	d3d9460f64	TUN-2125: Add PostgresType() to Scope	2019-08-02 10:21:09 -05:00
Nick Vollmar	74f3a55c57	TUN-2117: read group/system-name from CLI, send it to edge	2019-08-01 22:04:05 +00:00
Areg Harutyunyan	3c93d9b300	TUN-1736: Missing headers when passing an invalid path	2019-07-31 16:56:29 +00:00
Nick Vollmar	3c0ea0db65	TUN-1956: Go 1.12 update	2019-07-12 22:09:16 +00:00