auth

type JWTClaims struct {
	Subject   string `json:"sub"`
	IssuedAt  int64  `json:"iat"`
	ExpiresAt int64  `json:"exp"`
	TokenType string `json:"type"` // "access" or "refresh"
}

type JWTManager struct {
	// contains filtered or unexported fields
}

type KleverAuthManager struct {
	// contains filtered or unexported fields
}

type PasskeyCredential struct {
	ID             string `json:"id"`              // Credential ID (hex-encoded)
	PublicKey      []byte `json:"public_key"`      // COSE public key
	Name           string `json:"name"`            // User-friendly name (e.g., "MacBook Pro")
	SignCount      uint32 `json:"sign_count"`      // Signature counter (replay detection)
	BackupEligible bool   `json:"backup_eligible"` // Whether credential supports backup/sync
	BackupState    bool   `json:"backup_state"`    // Whether credential is currently backed up
	RegisteredAt   int64  `json:"registered_at"`   // Unix timestamp
}

type PasswordManager struct {
	// contains filtered or unexported fields
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type RecoveryCode struct {
	Hash string `json:"hash"` // Argon2id hash (hex-encoded: salt + hash)
	Used bool   `json:"used"`
}

type RecoveryManager struct {
	// contains filtered or unexported fields
}

type TokenPair struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
	ExpiresIn    int64  `json:"expires_in"` // seconds
}

type WebAuthnConfig struct {
	RPDisplayName string   // Relying Party display name (e.g., "Klever Node Hub")
	RPID          string   // Relying Party ID (e.g., "localhost" or domain)
	RPOrigins     []string // Allowed origins (e.g., "https://localhost:9443")
	InstanceID    string   // Unique ID for this dashboard instance (prevents passkey collisions when multiple dashboards share the same RP ID)
}

type WebAuthnManager struct {
	// contains filtered or unexported fields
}