slp

type AgentAuthContext struct {
	SelectedProtocol     uint16 `cbor:"1,keyasint"`
	SessionId            []byte `cbor:"2,keyasint"`
	StaticKeyCert        []byte `cbor:"3,keyasint,omitempty"`
	AppContextUrl        string `cbor:"4,keyasint"`
	AuthServerGetChalUrl string `cbor:"5,keyasint"`
	AuthServerLoginUrl   string `cbor:"6,keyasint"`
	AppStartUrl          string `cbor:"7,keyasint"`
}

type AppAuthRequest struct {
	// Application Realm Identifier
	// RealmId encodes a "PKI context" that allows validating Application public key certificates
	RealmId []byte `json:"rId" cbor:"1,keyasint"`

	// Url where to submit CardChallengeRequest request
	AuthServerGetChalUrl string `json:"getChalUrl" cbor:"2,keyasint"`

	// Enumerates Application supported Authentication methods
	AllowedMethods []AuthMethod `json:"methods" cbor:"3,keyasint"`
}

type AuthContext struct {
	RealmId              [32]byte
	AuthMethod           AuthMethod
	AppContextUrl        string
	AuthServerGetChalUrl string
	AuthServerLoginUrl   string
	AppStartUrl          string
}

type AuthMethod struct {
	// One of the enumerated Slp authentication protocol
	Protocol uint16 `json:"proto" cbor:"1,keyasint"`

	// One of the registered EPHEMSEC scheme
	Scheme uint16 `json:"scheme" cbor:"2,keyasint"`
}

type CardChalResponse struct {
	// references a Server generated CardChallenge
	SessionId []byte `json:"sid" cbor:"1,keyasint"`

	// identifier allowing ServerCard access
	CardId []byte `json:"cid" cbor:"2,keyasint"`

	// synchronization hint allowing Server to determine Client OTP time
	SyncHint byte `json:"sync" cbor:"3,keyasint"`

	// Client generated ephemeral key
	// transmitted if authentication scheme uses E2S2 key exchange
	E credentials.PublicKeyHandle `json:"e,omitzero" cbor:"4,keyasint,omitzero"`
}

type CardChallenge struct {
	// AuthServer generated SessionId
	SessionId []byte `json:"sId" cbor:"1,keyasint"`

	// AuthServer generated ephemeral key
	// E is compatible with the EPHEMSEC scheme selected in related CardChallengeRequest.
	E credentials.PublicKeyHandle `json:"E" cbor:"2,keyasint"`

	// AuthServer generated nonce
	INonce []byte `json:"nonce" cbor:"3,keyasint"`

	// AuthServer EPHEMSEC static key
	// It is set if the selected EPHEMSEC scheme uses E1S2 or E2S2 key exchange pattern
	S credentials.PublicKeyHandle `json:"S" cbor:"4,keyasint,omitzero"`

	// Static key certificate
	// It is set if the selected EPHEMSEC scheme uses E1S2 or E2S2 key exchange pattern
	StaticKeyCert []byte `json:"cert" cbor:"5,keyasint,omitempty"`

	// Url where to start the selected authentication protocol
	// CardAgent & AuthServer independently append this Url to their EPHEMSEC OTP/OTK generation context
	AuthServerLoginUrl string `json:"loginUrl" cbor:"6,keyasint"`

	// Url where to go following successful Slp authentication
	// CardAgent & AuthServer independently append this Url to their EPHEMSEC OTP/OTK generation context
	AppStartUrl string `json:"appStartUrl" cbor:"7,keyasint"`
}

type CardChallengeEndpoint struct {
	// contains filtered or unexported fields
}

type CardChallengeRequest struct {
	// Application Realm Identifier
	// RealmId encodes a "PKI context" that allows validating Application public key certificates
	RealmId []byte `json:"rId" cbor:"1,keyasint"`

	// CardAgent selected AuthMethod Id
	// It is the index of the selected AuthMethod in related AppAuthRequest.AllowedMethods
	SelectedMethod AuthMethod `json:"mtd" cbor:"2,keyasint"`

	// CardAgent acquired Url that corresponds to where the AppAuthRequest was obtained.
	// AuthServer may refuse CardChallengeRequest request if this url is not legit.
	// CardAgent & AuthServer independently append this Url to their EPHEMSEC OTP/OTK generation context.
	AppContextUrl string `json:"appUrl" cbor:"3,keyasint"`
}

type ChalSetter interface {
	// SetChal set ecdh ephemeral key & nonce in dst.
	SetChal(crv algos.Curve, sid []byte, dst *SessionChal) error
}

type ChallengeFactory interface {
	// GetCardChallenge generates a CardChallenge in response to a CardChallengeRequest.
	// Returns an error if the request does not match any configured AuthContext or challenge generation fails.
	GetCardChallenge(req *CardChallengeRequest, dst *CardChallenge) error

	// GetAgentAuthContext retrieves the AgentAuthContext bound to the given session ID.
	// Returns an error if the session ID is invalid or expired, or the AuthContext cannot be reconstructed.
	GetAgentAuthContext(sid []byte, dst *AgentAuthContext) error

	// GetServerOtp derives the server-side OTP/OTK matching the one independently derived
	// by the Client for the authentication session referenced in cc.
	// Returns an error if the session is invalid, the card cannot be loaded, or OTP derivation fails.
	GetServerOtp(cc *CardChalResponse, dst []byte) ([]byte, error)
}

type ChallengeFactoryImpl struct {
	Skf  session.KeyFactory[session.Sid]
	Kst  credentials.KeyStore
	Scs  credentials.ServerCredStore
	Cst  ChalSetter
	Cfgs []AuthContext
}

type DirectEndpoint struct {
	// contains filtered or unexported fields
}

type DirectLoginRequest struct {
	SessionId []byte                      `json:"sid" cbor:"1,keyasint"`
	CardId    []byte                      `json:"cid" cbor:"2,keyasint"`
	Otp       []byte                      `json:"otp" cbor:"3,keyasint"`
	E         credentials.PublicKeyHandle `json:"e,omitzero" cbor:"4,keyasint,omitzero"`
}

type DirectValidationResult struct {
	Valid bool `json:"valid" cbor:"1,keyasint"`
}

type HkdfChalSetter struct {
	// contains filtered or unexported fields
}

type HttpClient interface {
	Do(req *http.Request) (*http.Response, error)
}

type SessionChal struct {
	// contains filtered or unexported fields
}