passkey

type AuthenticationOptions struct {
	// SessionID is the opaque challenge session identifier used to finish authentication.
	SessionID string `json:"session_id"`

	// Options contains the standard WebAuthn PublicKeyCredentialRequestOptions.
	Options *protocol.CredentialAssertion `json:"options"`

	// ExpiresAt specifies when the challenge expires.
	ExpiresAt time.Time `json:"expires_at"`
}

type BeginAuthenticationInput struct {
	// UserID is optional. If provided, server restricts allowed credentials to this user.
	// If empty, discoverable (usernameless / resident key) authentication is initiated.
	UserID string

	// UserVerification overrides the default user verification requirement.
	UserVerification protocol.UserVerificationRequirement
}

type BeginRegistrationInput struct {
	// UserID identifies the user registering a passkey. Required.
	UserID string

	// FriendlyName is an optional human label for the device (e.g. "Pixel 8 Pro").
	FriendlyName string

	// UserVerification overrides the default user verification requirement.
	UserVerification protocol.UserVerificationRequirement

	// ResidentKey overrides the default resident key requirement.
	ResidentKey protocol.ResidentKeyRequirement

	// AuthenticatorAttachment optionally restricts attachment (platform or cross-platform).
	AuthenticatorAttachment protocol.AuthenticatorAttachment
}

type Capability = Passkeys

type CeremonyError struct {
	Op         string
	Reason     string
	Underlying error
}

type Config struct {
	// RPDisplayName is the human-readable Relying Party name (e.g. "Acme Corp"). Required.
	RPDisplayName string

	// RPID is the Relying Party server identifier (e.g. "acme.com" or "localhost"). Required.
	RPID string

	// RPOrigins lists the allowed origin URLs (e.g. "https://acme.com", "http://localhost:3000"). Required.
	RPOrigins []string

	// UserVerification specifies the default user verification requirement (required, preferred, discouraged).
	// Default: preferred.
	UserVerification protocol.UserVerificationRequirement

	// ResidentKey specifies the default resident key / discoverable credential requirement.
	// Default: preferred.
	ResidentKey protocol.ResidentKeyRequirement

	// Timeout defines the maximum duration allowed to complete a registration or login ceremony.
	// Default: 60 seconds.
	Timeout time.Duration

	// EnforceSignCounter ensures that authenticator sign counter regressions trigger clone detection errors.
	// Default: true.
	EnforceSignCounter bool

	// ChallengeStore is the storage adapter for transient ceremony challenges.
	// Defaults to in-memory challenge store if nil.
	ChallengeStore challenge.Store

	// Hooks provides extension hooks for ceremony workflows.
	Hooks *Hooks

	// Debug enables verbose debug logging in the WebAuthn engine.
	Debug bool
}

type DeleteCredentialInput struct {
	// UserID verifies ownership. Required.
	UserID string

	// CredentialID is the binary ID of the credential to delete. Required.
	CredentialID []byte
}

type FinishAuthenticationInput struct {
	// SessionID is the ceremony session ID returned by BeginAuthentication. Required.
	SessionID string

	// Response is the raw JSON response payload from navigator.credentials.get().
	Response []byte

	// Body allows streaming the client JSON response directly from a reader.
	Body io.Reader

	// ParsedResponse allows supplying pre-parsed credential assertion data.
	ParsedResponse *protocol.ParsedCredentialAssertionData

	// Session holds optional IP and User-Agent metadata for the issued core session.
	Session auth.SessionOptions
}

type FinishRegistrationInput struct {
	// SessionID is the ceremony session ID returned by BeginRegistration. Required.
	SessionID string

	// Response is the raw JSON response payload from navigator.credentials.create().
	Response []byte

	// Body allows streaming the client JSON response directly from a reader.
	Body io.Reader

	// ParsedResponse allows supplying pre-parsed credential creation data.
	ParsedResponse *protocol.ParsedCredentialCreationData

	// FriendlyName optionally overrides the label provided during BeginRegistration.
	FriendlyName string
}

type Hooks struct {
	BeforeBeginRegistration  func(ctx context.Context, in *BeginRegistrationInput) error
	BeforeFinishRegistration func(ctx context.Context, in *FinishRegistrationInput) error
	AfterRegistration        func(ctx context.Context, cred *Passkey) error

	BeforeBeginAuthentication  func(ctx context.Context, in *BeginAuthenticationInput) error
	BeforeFinishAuthentication func(ctx context.Context, in *FinishAuthenticationInput) error
	AfterAuthentication        func(ctx context.Context, res *auth.AuthResult) error
}

type Module struct {
	// contains filtered or unexported fields
}

type Option func(*Config)

type Passkey struct {
	ID              string                            `json:"id"`
	CredentialID    []byte                            `json:"credential_id"`
	UserID          string                            `json:"user_id"`
	FriendlyName    string                            `json:"friendly_name"`
	PublicKey       []byte                            `json:"public_key"`
	AttestationType string                            `json:"attestation_type"`
	AAGUID          []byte                            `json:"aaguid"`
	SignCount       uint32                            `json:"sign_count"`
	CloneWarning    bool                              `json:"clone_warning"`
	Attachment      protocol.AuthenticatorAttachment  `json:"attachment"`
	Transports      []protocol.AuthenticatorTransport `json:"transports"`
	UserPresent     bool                              `json:"user_present"`
	UserVerified    bool                              `json:"user_verified"`
	BackupEligible  bool                              `json:"backup_eligible"`
	BackupState     bool                              `json:"backup_state"`
	CreatedAt       time.Time                         `json:"created_at"`
	UpdatedAt       time.Time                         `json:"updated_at"`
	LastUsedAt      *time.Time                        `json:"last_used_at,omitempty"`
	RevokedAt       *time.Time                        `json:"revoked_at,omitempty"`
}

type PasskeyRegisteredPayload struct {
	UserID       string    `json:"user_id"`
	CredentialID string    `json:"credential_id"` // base64url encoded
	FriendlyName string    `json:"friendly_name"`
	AAGUID       string    `json:"aaguid,omitempty"`
	RegisteredAt time.Time `json:"registered_at"`
}

type PasskeyRevokedPayload struct {
	UserID       string    `json:"user_id"`
	CredentialID string    `json:"credential_id"` // base64url encoded
	RevokedAt    time.Time `json:"revoked_at"`
}

type PasskeyUsedPayload struct {
	UserID       string    `json:"user_id"`
	CredentialID string    `json:"credential_id"` // base64url encoded
	SessionID    string    `json:"session_id"`
	UsedAt       time.Time `json:"used_at"`
}

type Passkeys interface {
	// BeginRegistration generates the public key options required by navigator.credentials.create().
	BeginRegistration(ctx context.Context, in BeginRegistrationInput) (*RegistrationOptions, error)

	// FinishRegistration validates the client response, persists the credential, and links the Core account.
	FinishRegistration(ctx context.Context, in FinishRegistrationInput) (*Passkey, error)

	// BeginAuthentication generates the options required by navigator.credentials.get().
	// Supports both user-specified and discoverable (usernameless / resident key) flows.
	BeginAuthentication(ctx context.Context, in BeginAuthenticationInput) (*AuthenticationOptions, error)

	// FinishAuthentication verifies the client assertion, checks sign counter replay protection,
	// and issues an authenticated session via GoModularAuth Core.
	FinishAuthentication(ctx context.Context, in FinishAuthenticationInput) (*auth.AuthResult, error)

	// ListCredentials returns all active passkeys registered to the specified user.
	ListCredentials(ctx context.Context, userID string) ([]*Passkey, error)

	// GetCredential returns a single passkey by credential ID with ownership verification.
	GetCredential(ctx context.Context, userID string, credentialID []byte) (*Passkey, error)

	// UpdateCredential updates metadata (e.g. friendly name) for an existing passkey.
	UpdateCredential(ctx context.Context, in UpdateCredentialInput) (*Passkey, error)

	// DeleteCredential revokes/removes the passkey and cleans up its associated Core account.
	DeleteCredential(ctx context.Context, in DeleteCredentialInput) error
}

type RegistrationOptions struct {
	// SessionID is the opaque challenge session identifier used to finish registration.
	SessionID string `json:"session_id"`

	// Options contains the standard WebAuthn PublicKeyCredentialCreationOptions.
	Options *protocol.CredentialCreation `json:"options"`

	// ExpiresAt specifies when the challenge expires.
	ExpiresAt time.Time `json:"expires_at"`
}

type UpdateCredentialInput struct {
	// UserID verifies ownership. Required.
	UserID string

	// CredentialID is the binary ID of the credential to update. Required.
	CredentialID []byte

	// FriendlyName is the new label for the passkey.
	FriendlyName string
}