mfa

type Algorithm int

type CredentialInfo struct {
	ID         string    `json:"id"`
	Name       string    `json:"name"`
	CreatedAt  time.Time `json:"created_at"`
	LastUsedAt time.Time `json:"last_used_at"`
}

type CredentialManager struct {
	// contains filtered or unexported fields
}

type CredentialManagerConfig struct {
	// MaxCredentialsPerUser is the maximum number of credentials per user.
	MaxCredentialsPerUser int
}

type CredentialStore interface {
	// Create creates a new credential.
	Create(ctx context.Context, userID uuid.UUID, cred *WebAuthnCredential) error
	// GetByUser retrieves all credentials for a user.
	GetByUser(ctx context.Context, userID uuid.UUID) ([]WebAuthnCredential, error)
	// GetByID retrieves a credential by ID.
	GetByID(ctx context.Context, userID uuid.UUID, credID []byte) (*WebAuthnCredential, error)
	// Update updates a credential.
	Update(ctx context.Context, userID uuid.UUID, cred *WebAuthnCredential) error
	// Delete deletes a credential.
	Delete(ctx context.Context, userID uuid.UUID, credID []byte) error
	// Count returns the number of credentials for a user.
	Count(ctx context.Context, userID uuid.UUID) (int, error)
}

type DeleteCredentialRequest struct {
	Password string `json:"password" validate:"required"`
}

type Digits int

type DisableRequest struct {
	Code     string `json:"code"`
	Password string `json:"password" validate:"required"`
}

type Handler struct {
	// contains filtered or unexported fields
}

type InMemoryCredentialStore struct {
	// contains filtered or unexported fields
}

type Key struct {
	// contains filtered or unexported fields
}

type ListCredentialsResponse struct {
	Credentials []CredentialInfo `json:"credentials"`
	Count       int              `json:"count"`
	MaxAllowed  int              `json:"max_allowed"`
}

type LoginSession struct {
	UserID    uuid.UUID `json:"user_id"`
	Challenge string    `json:"challenge"`
	ExpiresAt time.Time `json:"expires_at"`
	// SessionData is the serialized webauthn.SessionData
	SessionData []byte `json:"session_data"`
}

type Recovery struct {
	// contains filtered or unexported fields
}

type RecoveryCodes struct {
	// Codes are the plaintext recovery codes (only available at generation time).
	Codes []string `json:"codes,omitempty"`
	// HashedCodes are the hashed recovery codes for storage.
	HashedCodes []string `json:"-"`
	// UsedCodes tracks which codes have been used (by index).
	UsedCodes []bool `json:"-"`
}

type RecoveryCodesResponse struct {
	Codes     []string `json:"codes"`
	Remaining int      `json:"remaining"`
}

type RecoveryConfig struct {
	// Count is the number of recovery codes to generate.
	Count int
	// Length is the length of each recovery code (in characters).
	Length int
}

type RegistrationSession struct {
	UserID    uuid.UUID `json:"user_id"`
	Challenge string    `json:"challenge"`
	ExpiresAt time.Time `json:"expires_at"`
	// SessionData is the serialized webauthn.SessionData
	SessionData []byte `json:"session_data"`
}

type SetupResponse struct {
	// Secret is the TOTP secret (base32 encoded).
	Secret string `json:"secret"`
	// URI is the provisioning URI for authenticator apps.
	URI string `json:"uri"`
}

type SetupResponseDTO struct {
	Secret string `json:"secret"`
	URI    string `json:"uri"`
}

type StatusResponse struct {
	Enabled       bool `json:"enabled"`
	RecoveryCount int  `json:"recovery_codes_remaining"`
	SetupRequired bool `json:"setup_required,omitempty"`
}

type TOTP struct {
	// contains filtered or unexported fields
}

type TOTPConfig struct {
	// Issuer is the name shown in authenticator apps.
	Issuer string
	// Algorithm is the hash algorithm (SHA1, SHA256, SHA512).
	Algorithm Algorithm
	// Digits is the number of digits in the code.
	Digits Digits
	// Period is the time step in seconds.
	Period uint
	// SecretSize is the size of the secret in bytes.
	SecretSize uint
	// Skew is the number of periods to allow for clock drift.
	Skew uint
}

type UpdateCredentialRequest struct {
	Name string `json:"name" validate:"required,min=1,max=100"`
}

type ValidateMFARequest struct {
	MFAToken     string `json:"mfa_token" validate:"required"`
	Code         string `json:"code"`
	RecoveryCode string `json:"recovery_code"`
}

type VerifyRequest struct {
	Code   string `json:"code" validate:"required"`
	Secret string `json:"secret" validate:"required"`
}

type VerifyResponse struct {
	Enabled       bool     `json:"enabled"`
	RecoveryCodes []string `json:"recovery_codes,omitempty"`
}

type WebAuthn struct {
	// contains filtered or unexported fields
}

type WebAuthnConfig struct {
	// RPDisplayName is the display name of the relying party.
	RPDisplayName string
	// RPID is the relying party ID (usually the domain).
	RPID string
	// RPOrigins are the allowed origins.
	RPOrigins []string
	// Timeout is the timeout for ceremonies in milliseconds.
	Timeout int
	// AuthenticatorSelection specifies authenticator requirements.
	AuthenticatorSelection *protocol.AuthenticatorSelection
	// AttestationPreference specifies attestation conveyance preference.
	AttestationPreference protocol.ConveyancePreference
}

type WebAuthnCredential struct {
	ID              []byte    `json:"id"`
	PublicKey       []byte    `json:"public_key"`
	AttestationType string    `json:"attestation_type"`
	AAGUID          []byte    `json:"aaguid"`
	SignCount       uint32    `json:"sign_count"`
	CloneWarning    bool      `json:"clone_warning"`
	Name            string    `json:"name"`
	CreatedAt       time.Time `json:"created_at"`
	LastUsedAt      time.Time `json:"last_used_at"`
}

type WebAuthnCredentialDTO struct {
	ID         string `json:"id"`
	Name       string `json:"name"`
	CreatedAt  string `json:"created_at"`
	LastUsedAt string `json:"last_used_at"`
}

type WebAuthnRegisterBeginRequest struct {
	Name string `json:"name" validate:"required"`
}

type WebAuthnStatusResponse struct {
	Enabled     bool                    `json:"enabled"`
	Credentials []WebAuthnCredentialDTO `json:"credentials"`
}

type WebAuthnUser struct {
	ID          uuid.UUID
	Name        string
	DisplayName string
	Credentials []WebAuthnCredential
}