challenge

type CeremonyType string

type MemoryOption func(*MemoryStore)

type MemoryStore struct {
	// contains filtered or unexported fields
}

type Session struct {
	// ID is the unique random session token issued to the client.
	ID string `json:"id"`

	// Type distinguishes registration from authentication.
	Type CeremonyType `json:"type"`

	// UserID is the user ID if known during initiation (empty for discoverable authentication).
	UserID string `json:"user_id,omitempty"`

	// FriendlyName holds the device name provided at initiation time.
	FriendlyName string `json:"friendly_name,omitempty"`

	// Data holds the underlying WebAuthn session data (challenge bytes, timeouts, flags).
	Data webauthn.SessionData `json:"data"`

	// CreatedAt marks when the challenge was generated.
	CreatedAt time.Time `json:"created_at"`

	// ExpiresAt marks when the challenge becomes invalid.
	ExpiresAt time.Time `json:"expires_at"`

	// ConsumedAt marks when the challenge was redeemed (nil if still unconsumed).
	ConsumedAt *time.Time `json:"consumed_at,omitempty"`
}

type Store interface {
	// Save persists a newly generated ceremony session.
	Save(ctx context.Context, s *Session) error

	// Get retrieves a ceremony session without consuming it.
	Get(ctx context.Context, id string) (*Session, error)

	// Consume atomically marks the session as used and returns it.
	// Must return ErrAlreadyConsumed on replay and ErrExpired if expired.
	Consume(ctx context.Context, id string) (*Session, error)

	// Delete removes a ceremony session.
	Delete(ctx context.Context, id string) error

	// DeleteExpired purges sessions that expired before the specified cutoff.
	DeleteExpired(ctx context.Context, before time.Time) (int, error)
}