challenge

type Awaiter[K ~string | ~int64 | ~uint64] haxmap.Map[K, awaiterCallback]

type Class uint8

type FillRegistration func(state StateInterface, reg *Registration, parameters ast.Node) error

type Id int64

type Key [KeySize]byte

type KeyFlags uint8

type Register map[Id]*Registration

type Registration struct {

	// Name The unique name for this challenge
	Name string

	// Class whether this challenge is transparent or otherwise
	Class Class

	// Condition A CEL condition which is passed the same environment as general rules.
	// If nil, always true
	// If non-nil, must return true for this challenge to be allowed to be executed
	Condition cel.Program

	// Path The url path that this challenge is hosted under for the Handler to be called.
	Path string

	// Duration How long this challenge will be valid when passed
	Duration time.Duration

	// Handler An HTTP handler for all requests coming on the Path
	// This handler will need to handle MakeChallengeUrlSuffix and VerifyChallengeUrlSuffix as well if needed
	// Recommended to use http.ServeMux
	Handler http.Handler

	// Verify Verify an issued token
	Verify            VerifyFunc
	VerifyProbability float64

	// IssueChallenge Issues a challenge to a request.
	// If Class is ClassTransparent and VerifyResult is !VerifyResult.Ok(), continue with other challenges
	// TODO: have this return error as well
	IssueChallenge func(w http.ResponseWriter, r *http.Request, key Key, expiry time.Time) VerifyResult

	// Object used to handle state or similar
	// Can be nil if no state is needed
	// If non-nil must implement io.Closer even if there's nothing to do
	Object io.Closer
	// contains filtered or unexported fields
}

type RequestData struct {
	Id              RequestId
	Time            time.Time
	ChallengeVerify map[Id]VerifyResult
	ChallengeState  map[Id]VerifyState
	ChallengeMap    TokenChallengeMap

	RemoteAddress netip.AddrPort
	State         StateInterface

	ExtraHeaders http.Header
	// contains filtered or unexported fields
}

type RequestId [16]byte

type StateInterface interface {
	RegisterCondition(operator string, conditions ...string) (cel.Program, error)

	Client() *http.Client
	PrivateKeyFingerprint() []byte
	PrivateKey() ed25519.PrivateKey
	PublicKey() ed25519.PublicKey

	UrlPath() string

	ChallengeFailed(r *http.Request, reg *Registration, err error, redirect string, logger *slog.Logger)
	ChallengePassed(r *http.Request, reg *Registration, redirect string, logger *slog.Logger)
	ChallengeIssued(r *http.Request, reg *Registration, redirect string, logger *slog.Logger)
	ChallengeChecked(r *http.Request, reg *Registration, redirect string, logger *slog.Logger)

	RuleHit(r *http.Request, name string, logger *slog.Logger)
	RuleMiss(r *http.Request, name string, logger *slog.Logger)
	ActionHit(r *http.Request, name policy.RuleAction, logger *slog.Logger)

	Logger(r *http.Request) *slog.Logger

	ChallengePage(w http.ResponseWriter, r *http.Request, status int, reg *Registration, params map[string]any)
	ErrorPage(w http.ResponseWriter, r *http.Request, status int, err error, redirect string)

	GetChallenge(id Id) (*Registration, bool)
	GetChallengeByName(name string) (*Registration, bool)
	GetChallenges() Register

	Settings() policy.StateSettings

	Strings() utils.Strings

	GetBackend(host string) http.Handler
}

type Token struct {
	State TokenChallengeMap `json:"state"`

	Expiry    jwt.NumericDate `json:"exp,omitempty"`
	NotBefore jwt.NumericDate `json:"nbf,omitempty"`
	IssuedAt  jwt.NumericDate `json:"iat,omitempty"`
}

type TokenChallenge struct {
	Key    []byte `json:"key"`
	Result []byte `json:"result,omitempty"`
	Ok     bool   `json:"ok"`

	Expiry    jwt.NumericDate `json:"exp,omitempty"`
	NotBefore jwt.NumericDate `json:"nbf,omitempty"`
	IssuedAt  jwt.NumericDate `json:"iat,omitempty"`
}

type TokenChallengeMap map[string]TokenChallenge

type VerifyFunc func(key Key, token []byte, r *http.Request) (VerifyResult, error)

type VerifyResult uint8

type VerifyState uint8