flows

type AccountCreateRequest struct {
	Identifier string
	Password   string
	Role       string
	RememberMe bool
}

type AccountCreateResult struct {
	UserID       string
	Role         string
	AccessToken  string
	RefreshToken string
}

type AccountCreateUserInput struct {
	Identifier        string
	PasswordHash      string
	Role              string
	TenantID          string
	Status            uint8
	PermissionVersion uint32
	RoleVersion       uint32
	AccountVersion    uint32
}

type AccountDeps struct {
	Enabled                  bool
	AutoLogin                bool
	RefreshTTL               time.Duration
	MultiTenantEnabled       bool
	DefaultRole              string
	EmailVerificationEnabled bool
	ShouldRequireVerified    bool
	ActiveStatus             uint8
	PendingStatus            uint8

	TenantIDFromContext         func(context.Context) string
	TenantIDFromContextExplicit func(context.Context) (string, bool)

	EnforceAccountLimiter func(context.Context, string, string) error
	MapLimiterError       func(error) error
	RoleExists            func(string) bool

	HashPassword       func(string) (string, error)
	CreateUser         func(context.Context, AccountCreateUserInput) (AccountUserRecord, error)
	IssueSessionTokens func(context.Context, AccountUserRecord, bool) (string, string, error)

	MetricInc     func(int)
	EmitAudit     func(context.Context, string, bool, string, string, string, error, func() map[string]string)
	EmitRateLimit func(context.Context, string, string, func() map[string]string)

	Metrics AccountMetrics
	Events  AccountEvents
	Errors  AccountErrors
}

type AccountErrors struct {
	EngineNotReady              error
	AccountCreationDisabled     error
	AccountCreationUnavailable  error
	AccountCreationInvalid      error
	AccountRoleInvalid          error
	AccountCreationRateLimited  error
	PasswordPolicy              error
	AccountExists               error
	ProviderDuplicateIdentifier error
	SessionCreationFailed       error
}

type AccountEvents struct {
	AccountCreationSuccess     string
	AccountCreationFailure     string
	AccountCreationDuplicate   string
	AccountCreationRateLimited string
}

type AccountMetrics struct {
	AccountCreationSuccess     int
	AccountCreationDuplicate   int
	AccountCreationRateLimited int
}

type AccountSessionDeps struct {
	TenantIDFromContext func(context.Context) string
	Now                 func() time.Time
	SessionLifetime     func(rememberMe bool) time.Duration

	GetRoleMask        func(string) (interface{}, bool)
	NewSessionID       func() (string, error)
	NewRefreshSecret   func() ([32]byte, error)
	HashRefreshSecret  func([32]byte) [32]byte
	EncodeRefreshToken func(string, [32]byte) (string, error)
	SaveSession        func(context.Context, *session.Session, time.Duration) error
	IssueAccessToken   func(*session.Session) (string, error)

	MetricInc            func(int)
	SessionCreatedMetric int

	ErrEngineNotReady     error
	ErrAccountRoleInvalid error
}

type AccountStatusRecord struct {
	Status         uint8
	AccountVersion uint32
	TenantID       string
}

type AccountUserRecord struct {
	UserID            string
	Identifier        string
	TenantID          string
	PasswordHash      string
	Status            uint8
	Role              string
	PermissionVersion uint32
	RoleVersion       uint32
	AccountVersion    uint32
}

type BackupCodeDeps struct {
	Enabled          bool
	BackupCodeCount  int
	BackupCodeLength int

	TenantIDFromContext func(context.Context) string
	AccountStatusError  func(uint8) error

	GetUserByID        func(context.Context, string) (BackupCodeUser, error)
	GetBackupCodes     func(context.Context, string) ([]BackupCodeRecord, error)
	ReplaceBackupCodes func(context.Context, string, []BackupCodeRecord) error
	ConsumeBackupCode  func(context.Context, string, [32]byte) (bool, error)
	VerifyTOTPForUser  func(context.Context, BackupCodeUser, string) error

	CheckLimiter         func(context.Context, string, string) error
	RecordLimiterFailure func(context.Context, string, string) error
	ResetLimiter         func(context.Context, string, string) error
	IsRateLimited        func(error) bool

	RandomIndex func(int) (int, error)

	MetricInc func(int)
	EmitAudit func(context.Context, string, bool, string, string, string, error, func() map[string]string)

	Metrics BackupCodeMetrics
	Events  BackupCodeEvents
	Errors  BackupCodeErrors
}

type BackupCodeErrors struct {
	TOTPFeatureDisabled                error
	EngineNotReady                     error
	UserNotFound                       error
	BackupCodeUnavailable              error
	BackupCodeRegenerationRequiresTOTP error
	BackupCodeInvalid                  error
	BackupCodeRateLimited              error
}

type BackupCodeEvents struct {
	BackupCodesGenerated string
	BackupCodeUsed       string
	BackupCodeFailed     string
}

type BackupCodeMetrics struct {
	BackupCodeUsed        int
	BackupCodeFailed      int
	BackupCodeRegenerated int
}

type BackupCodeRecord struct {
	Hash [32]byte
}

type BackupCodeUser struct {
	UserID   string
	TenantID string
	Status   uint8
}

type Deps struct {
	Refresh           RefreshDeps
	Validate          ValidateDeps
	Logout            LogoutDeps
	Introspection     IntrospectionDeps
	Account           AccountDeps
	AccountSession    AccountSessionDeps
	AccountStatus     UpdateAccountStatusDeps
	BackupCode        BackupCodeDeps
	DeviceBinding     DeviceBindingDeps
	EmailVerification EmailVerificationDeps
	Login             LoginDeps
	PasswordReset     PasswordResetDeps
	TOTP              TOTPDeps
	WebAuthn          WebAuthnDeps
}

type DeviceBindingConfig struct {
	Enabled                 bool
	EnforceIPBinding        bool
	DetectIPChange          bool
	EnforceUserAgentBinding bool
	DetectUserAgentChange   bool
}

type DeviceBindingDeps struct {
	Config                     DeviceBindingConfig
	ClientIPFromContext        func(context.Context) string
	UserAgentFromContext       func(context.Context) string
	HashBindingValue           func(string) [32]byte
	ShouldEmitDeviceAnomaly    func(context.Context, string, string) bool
	MetricInc                  func(int)
	EmitAudit                  func(context.Context, string, bool, string, string, string, error, func() map[string]string)
	EventDeviceAnomalyDetected string
	EventDeviceBindingRejected string
	MetricDeviceIPMismatch     int
	MetricDeviceUAMismatch     int
	MetricDeviceRejected       int
	ErrDeviceBindingRejected   error
}

type DeviceBindingSession struct {
	SessionID     string
	UserID        string
	TenantID      string
	IPHash        [32]byte
	UserAgentHash [32]byte
}

type EmailVerificationDeps struct {
	Enabled         bool
	Strategy        int
	OTPDigits       int
	VerificationTTL time.Duration
	MaxAttempts     int
	ActiveStatus    uint8

	TenantIDFromContext func(context.Context) string
	AccountStatusError  func(uint8) error
	Now                 func() time.Time

	CheckRequestLimiter func(context.Context, string, string) error
	CheckConfirmLimiter func(context.Context, string, string) error
	MapLimiterError     func(error) error
	MapStoreError       func(error) error

	// EnforceTenantMatch requires a resolved user's TenantID to equal the
	// request's tenant. Set only when multi-tenancy is enabled.
	EnforceTenantMatch bool

	Warn func(string, ...any)

	// GetUserByIdentifier takes a context so the engine can scope the
	// lookup to the request's tenant when multi-tenancy is on.
	GetUserByIdentifier func(context.Context, string) (EmailVerificationUser, error)

	// GetUserByIDInTenant scopes the lookup to an explicitly supplied
	// tenant rather than the request context's. Confirm paths pass the
	// tenant the verification record was loaded under, which for
	// token/UUID challenges comes from the challenge itself and is
	// authoritative — the context tenant may be absent or different.
	GetUserByIDInTenant func(ctx context.Context, tenantID, userID string) (EmailVerificationUser, error)

	// WithTenant returns ctx carrying tenantID as the request tenant. The
	// confirm paths use it to propagate the challenge's authoritative
	// tenant into downstream operations that read the tenant from context.
	WithTenant func(ctx context.Context, tenantID string) context.Context

	UpdateStatusAndInvalidate func(context.Context, string, uint8) error

	SaveVerificationRecord    func(context.Context, string, string, EmailVerificationStoreRecord, time.Duration) error
	ConsumeVerificationRecord func(context.Context, string, string, [32]byte, int, int) (EmailVerificationStoreRecord, error)

	GenerateChallenge     func(int, int, string) (string, string, [32]byte, error)
	ParseChallenge        func(int, string, int) (string, string, [32]byte, error)
	ParseChallengeCode    func(int, string, string, int) ([32]byte, error)
	SleepEnumerationDelay func(context.Context) error

	MetricInc     func(int)
	EmitAudit     func(context.Context, string, bool, string, string, string, error, func() map[string]string)
	EmitRateLimit func(context.Context, string, string, func() map[string]string)

	Metrics EmailVerificationMetrics
	Events  EmailVerificationEvents
	Errors  EmailVerificationErrors
}

type EmailVerificationErrors struct {
	EngineNotReady               error
	EmailVerificationDisabled    error
	EmailVerificationInvalid     error
	EmailVerificationRateLimited error
	EmailVerificationUnavailable error
	EmailVerificationAttempts    error
	UserNotFound                 error
}

type EmailVerificationEvents struct {
	EmailVerificationRequest string
	EmailVerificationConfirm string
}

type EmailVerificationMetrics struct {
	EmailVerificationRequest          int
	EmailVerificationSuccess          int
	EmailVerificationFailure          int
	EmailVerificationAttemptsExceeded int
}

type EmailVerificationStoreRecord struct {
	UserID     string
	SecretHash [32]byte
	ExpiresAt  int64
	Attempts   uint16
	Strategy   int
}

type EmailVerificationUser struct {
	UserID   string
	TenantID string
	Status   uint8
}

type IntrospectionDeps struct {
	SessionStore                IntrospectionSessionStore
	RateLimiter                 IntrospectionRateLimiter
	MultiTenantEnabled          bool
	TenantIDFromContext         func(context.Context) string
	TenantIDFromContextExplicit func(context.Context) (string, bool)
	UnauthorizedErr             error
	EngineNotReadyErr           error
	UserNotFoundErr             error
	SessionNotFoundErr          error
	RedisNil                    error
}

type IntrospectionRateLimiter interface {
	GetLoginAttempts(ctx context.Context, tenantID, identifier string) (int, error)
}

type IntrospectionSessionStore interface {
	ActiveSessionCount(ctx context.Context, tenantID, userID string) (int, error)
	ActiveSessionIDs(ctx context.Context, tenantID, userID string) ([]string, error)
	GetManyReadOnly(ctx context.Context, tenantID string, sessionIDs []string) ([]*session.Session, error)
	GetReadOnly(ctx context.Context, tenantID, sessionID string) (*session.Session, error)
	EstimateActiveSessions(ctx context.Context, tenantID string) (int, error)
	Ping(ctx context.Context) (time.Duration, error)
}

type LoginDeps struct {
	TOTPEnabled               bool
	RequireTOTPForLogin       bool
	WebAuthnEnabled           bool
	WebAuthnRequireForLogin   bool
	EnforceReplayProtection   bool
	RequireVerified           bool
	PendingVerificationStatus uint8
	PasswordUpgradeOnLogin    bool
	MFALoginMaxAttempts       int
	MFALoginChallengeTTL      time.Duration
	DeviceBindingEnabled      bool
	EnforceIPBinding          bool
	EnforceUserAgentBinding   bool

	TenantIDFromContext  func(context.Context) string
	ClientIPFromContext  func(context.Context) string
	UserAgentFromContext func(context.Context) string
	Now                  func() time.Time
	AccountStatusError   func(status uint8) error

	CheckLoginRate     func(context.Context, string) error
	IncrementLoginRate func(context.Context, string) error
	ResetLoginRate     func(context.Context, string) error

	// Auto-lockout hooks: RecordLockoutFailure returns true when threshold is reached.
	AutoLockoutEnabled   bool
	RecordLockoutFailure func(context.Context, string) (bool, error)
	ResetLockoutCounter  func(context.Context, string) error
	LockAccount          func(context.Context, string) error

	// EnforceTenantMatch requires a resolved user's TenantID to equal the
	// request's tenant. Set only when multi-tenancy is enabled; with it
	// false the flow behaves exactly as it did before tenant scoping.
	EnforceTenantMatch bool

	// GetUserByIdentifier and GetUserByID take a context so the engine can
	// scope the lookup to the request's tenant when multi-tenancy is on.
	GetUserByIdentifier       func(context.Context, string) (LoginUserRecord, error)
	GetUserByID               func(context.Context, string) (LoginUserRecord, error)
	UpdatePasswordHash        func(string, string) error
	GetTOTPSecret             func(context.Context, string) (*LoginTOTPRecord, error)
	UpdateTOTPLastUsedCounter func(context.Context, string, int64) error

	VerifyPassword           func(string, string) (bool, error)
	PasswordNeedsUpgrade     func(string) (bool, error)
	HashPassword             func(string) (string, error)
	VerifyTOTPCode           func([]byte, string, time.Time) (bool, int64, error)
	VerifyBackupCodeInTenant func(context.Context, string, string, string) error

	GetMFAChallenge    func(context.Context, string) (*MFALoginChallengeRecord, error)
	SaveMFAChallenge   func(context.Context, string, *MFALoginChallengeRecord, time.Duration) error
	DeleteMFAChallenge func(context.Context, string) (bool, error)
	RecordMFAFailure   func(context.Context, string, int) (bool, error)
	MapMFAStoreError   func(error) error

	CreateMFALoginChallenge func(context.Context, string, string, bool) (string, error)
	IssueLoginSessionTokens func(context.Context, string, LoginUserRecord, string, bool) (string, string, error)
	EnforceSessionHardening func(context.Context, string, string) error

	// WebAuthn second-factor hooks (nil when the feature is disabled).
	HasWebAuthnCredentials   func(context.Context, string) (bool, error)
	ConfirmWebAuthnAssertion func(context.Context, string, string, []byte) error

	GetRoleMask        func(string) (interface{}, bool)
	NewSessionID       func() (string, error)
	NewRefreshSecret   func() ([32]byte, error)
	HashRefreshSecret  func([32]byte) [32]byte
	EncodeRefreshToken func(string, [32]byte) (string, error)
	HashBindingValue   func(string) [32]byte
	SessionLifetime    func(rememberMe bool) time.Duration
	SaveSession        func(context.Context, *session.Session, time.Duration) error
	IssueAccessToken   func(*session.Session) (string, error)

	MetricInc     func(int)
	EmitAudit     func(context.Context, string, bool, string, string, string, error, func() map[string]string)
	EmitRateLimit func(context.Context, string, string, func() map[string]string)
	Warn          func(string, ...any)

	Metrics LoginMetrics
	Events  LoginEvents
	Errors  LoginErrors
}

type LoginErrors struct {
	EngineNotReady           error
	InvalidCredentials       error
	LoginRateLimited         error
	AccountUnverified        error
	AccountLocked            error
	DeviceBindingRejected    error
	TOTPFeatureDisabled      error
	MFALoginInvalid          error
	MFALoginExpired          error
	MFALoginAttemptsExceeded error
	MFALoginReplay           error
	MFALoginUnavailable      error
	UserNotFound             error
	BackupCodeRateLimited    error
	BackupCodeInvalid        error
	BackupCodesNotConfigured error
	WebAuthnCloneDetected    error
	WebAuthnCeremonyExpired  error
	WebAuthnUnavailable      error
}

type LoginEvents struct {
	LoginSuccess        string
	LoginFailure        string
	LoginRateLimited    string
	MFARequired         string
	MFASuccess          string
	MFAFailure          string
	MFAAttemptsExceeded string
}

type LoginMetrics struct {
	LoginSuccess     int
	LoginFailure     int
	LoginRateLimited int
	LockoutTrigger   int
	SessionCreated   int
	MFALoginRequired int
	MFALoginSuccess  int
	MFALoginFailure  int
	MFAReplayAttempt int
}

type LoginOptions struct {
	RememberMe bool
}

type LoginResult struct {
	AccessToken  string
	RefreshToken string
	MFARequired  bool
	MFAType      string
	MFASession   string
	MFATypes     []string
}

type LoginTOTPRecord struct {
	Secret          []byte
	Enabled         bool
	LastUsedCounter int64
}

type LoginUserRecord struct {
	UserID            string
	Identifier        string
	TenantID          string
	PasswordHash      string
	Role              string
	Status            uint8
	PermissionVersion uint32
	RoleVersion       uint32
	AccountVersion    uint32
}

type LogoutByAccessResult struct {
	TenantID  string
	SessionID string
	// TokenExpired reports that the access token was expired but otherwise
	// authentic; surfaced as audit metadata, not as an error.
	TokenExpired bool
	Err          error
}

type LogoutDeps struct {
	// ParseAccessAllowExpired accepts authentic tokens whose only defect is
	// expiry, so an expired session can still be logged out gracefully.
	ParseAccessAllowExpired func(string) (*jwt.AccessClaims, error)
	TenantIDFromContext     func(context.Context) string
	TenantIDFromToken       func(string) string
	Now                     func() time.Time
	SessionStore            LogoutSessionStore
}

type LogoutSessionStore interface {
	Delete(ctx context.Context, tenantID, sessionID string) error
	DeleteAllForUser(ctx context.Context, tenantID, userID string) error
}

type MFALoginChallengeRecord struct {
	UserID     string
	TenantID   string
	ExpiresAt  int64
	Attempts   uint16
	RememberMe bool
}

type ModeResolverConfig struct {
	ModeInherit int
	ModeJWTOnly int
	ModeHybrid  int
	ModeStrict  int
}

type PasswordResetDeps struct {
	Enabled     bool
	Strategy    int
	OTPDigits   int
	ResetTTL    time.Duration
	MaxAttempts int
	RequireMFA  bool

	TenantIDFromContext func(context.Context) string
	AccountStatusError  func(uint8) error
	Now                 func() time.Time

	CheckRequestLimiter func(context.Context, string, string) error
	CheckConfirmLimiter func(context.Context, string, string) error
	MapLimiterError     func(error) error
	MapStoreError       func(error) error
	IsStoreNotFound     func(error) bool

	// EnforceTenantMatch requires a resolved user's TenantID to equal the
	// request's tenant. Set only when multi-tenancy is enabled.
	EnforceTenantMatch bool

	Warn func(string, ...any)

	// GetUserByIdentifier and GetUserByID take a context so the engine can
	// scope the lookup to the request's tenant when multi-tenancy is on.
	GetUserByIdentifier func(context.Context, string) (PasswordResetUser, error)
	GetUserByID         func(context.Context, string) (PasswordResetUser, error)
	HashPassword        func(string) (string, error)
	UpdatePasswordHash  func(string, string) error
	LogoutAllInTenant   func(context.Context, string, string) error

	SaveResetRecord    func(context.Context, string, string, PasswordResetStoreRecord, time.Duration) error
	GetResetRecord     func(context.Context, string, string) (PasswordResetStoreRecord, error)
	ConsumeResetRecord func(context.Context, string, string, [32]byte, int, int) (PasswordResetStoreRecord, error)

	GenerateChallenge     func(int, int) (string, string, [32]byte, error)
	ParseChallenge        func(int, string, int) (string, [32]byte, error)
	SleepEnumerationDelay func(context.Context) error

	VerifyTOTPForUser        func(context.Context, PasswordResetUser, string) error
	VerifyBackupCodeInTenant func(context.Context, string, string, string) error

	MetricInc     func(int)
	EmitAudit     func(context.Context, string, bool, string, string, string, error, func() map[string]string)
	EmitRateLimit func(context.Context, string, string, func() map[string]string)

	Metrics PasswordResetMetrics
	Events  PasswordResetEvents
	Errors  PasswordResetErrors
}

type PasswordResetErrors struct {
	EngineNotReady            error
	PasswordResetDisabled     error
	PasswordResetInvalid      error
	PasswordResetRateLimited  error
	PasswordResetUnavailable  error
	PasswordResetAttempts     error
	PasswordPolicy            error
	UserNotFound              error
	SessionInvalidationFailed error
	TOTPInvalid               error
}

type PasswordResetEvents struct {
	PasswordResetRequest string
	PasswordResetConfirm string
	PasswordResetReplay  string
}

type PasswordResetMetrics struct {
	PasswordResetRequest          int
	PasswordResetConfirmSuccess   int
	PasswordResetConfirmFailure   int
	PasswordResetAttemptsExceeded int
}

type PasswordResetStoreRecord struct {
	UserID     string
	SecretHash [32]byte
	ExpiresAt  int64
	Attempts   uint16
	Strategy   int
}

type PasswordResetUser struct {
	UserID   string
	TenantID string
	Status   uint8
}

type RefreshDeps struct {
	TenantIDFromContext       func(context.Context) string
	DecodeRefreshToken        func(string) (string, [32]byte, error)
	NewRefreshSecret          func() ([32]byte, error)
	HashRefreshSecret         func([32]byte) [32]byte
	EncodeRefreshToken        func(string, [32]byte) (string, error)
	IssueAccessToken          func(*session.Session) (string, error)
	AccountStatusError        func(uint8) error
	ShouldRequireVerified     func() bool
	PendingVerificationStatus uint8
	SessionLifetime           func() time.Duration
	EnableReplayTracking      bool
	Warn                      func(string, ...any)
	SessionStore              RefreshSessionStore
	RefreshHashMismatch       error
	RedisNil                  error
}

type RefreshFailureKind int

type RefreshResult struct {
	Failure      RefreshFailureKind
	Err          error
	TenantID     string
	SessionID    string
	UserID       string
	Session      *session.Session
	AccessToken  string
	RefreshToken string
}

type RefreshSessionStore interface {
	RotateRefreshHash(
		ctx context.Context,
		tenantID, sessionID string,
		providedHash [32]byte,
		nextHash [32]byte,
	) (*session.Session, error)
	TrackReplayAnomaly(ctx context.Context, sessionID string, ttl time.Duration) error
	Delete(ctx context.Context, tenantID, sessionID string) error
}

type Service struct {
	// contains filtered or unexported fields
}

type TOTPDeps struct {
	Enabled                 bool
	EnforceReplayProtection bool

	Now                 func() time.Time
	TenantIDFromContext func(context.Context) string
	AccountStatusError  func(uint8) error

	GetUserByID               func(context.Context, string) (TOTPUser, error)
	GetTOTPSecret             func(context.Context, string) (*TOTPRecord, error)
	EnableTOTP                func(context.Context, string, []byte) error
	DisableTOTP               func(context.Context, string) error
	MarkTOTPVerified          func(context.Context, string) error
	UpdateTOTPLastUsedCounter func(context.Context, string, int64) error
	LogoutAllInTenant         func(context.Context, string, string) error

	GenerateSecret func() ([]byte, string, error)
	ProvisionURI   func(string, string) string
	VerifyCode     func([]byte, string, time.Time) (bool, int64, error)

	CheckTOTPLimiter         func(context.Context, string) error
	RecordTOTPLimiterFailure func(context.Context, string) error
	ResetTOTPLimiter         func(context.Context, string) error
	IsTOTPRateLimited        func(error) bool

	MetricInc func(int)
	EmitAudit func(context.Context, string, bool, string, string, string, error, func() map[string]string)

	Metrics TOTPMetrics
	Events  TOTPEvents
	Errors  TOTPErrors
}

type TOTPErrors struct {
	TOTPFeatureDisabled       error
	EngineNotReady            error
	UserNotFound              error
	TOTPUnavailable           error
	TOTPNotConfigured         error
	TOTPRequired              error
	TOTPInvalid               error
	TOTPRateLimited           error
	AccountVersionNotAdvanced error
	SessionInvalidationFailed error
}

type TOTPEvents struct {
	TOTPSetupRequested string
	TOTPEnabled        string
	TOTPDisabled       string
	TOTPFailure        string
	TOTPSuccess        string
}

type TOTPMetrics struct {
	TOTPRequired int
	TOTPFailure  int
	TOTPSuccess  int
}

type TOTPProvision struct {
	Secret string
	URI    string
}

type TOTPRecord struct {
	Secret          []byte
	Enabled         bool
	LastUsedCounter int64
}

type TOTPSetup struct {
	SecretBase32 string
	QRCodeURL    string
}

type TOTPUser struct {
	UserID         string
	Identifier     string
	TenantID       string
	Status         uint8
	AccountVersion uint32
}

type UpdateAccountStatusDeps struct {
	GetUserByID                  func(ctx context.Context, userID string) (AccountStatusRecord, error)
	UpdateAccountStatus          func(ctx context.Context, userID string, status uint8) (AccountStatusRecord, error)
	LogoutAllInTenant            func(ctx context.Context, tenantID, userID string) error
	TenantIDFromContext          func(context.Context) string
	ErrEngineNotReady            error
	ErrUserNotFound              error
	ErrAccountVersionNotAdvanced error
	ErrUnauthorized              error
	ErrSessionInvalidationFailed error
}

type ValidateDeps struct {
	ParseAccess               func(string) (*jwt.AccessClaims, error)
	ResolveRouteMode          func(int) (int, error)
	Now                       func() time.Time
	MaxClockSkew              time.Duration
	ModeJWTOnly               int
	ModeHybrid                int
	EnablePermissionCheck     bool
	EnableRoleCheck           bool
	EnableAccountCheck        bool
	ShouldRequireVerified     func() bool
	PendingVerificationStatus uint8
	AccountStatusError        func(uint8) error
	ValidateDeviceBinding     func(context.Context, *session.Session) error
	TenantIDFromToken         func(string) string
	SessionLifetime           func() time.Duration
	SessionStore              ValidateSessionStore
	RedisUnavailable          error
	RedisNil                  error
}

type ValidateFailureKind int

type ValidateResult struct {
	Failure ValidateFailureKind
	Err     error
	Claims  *jwt.AccessClaims
	Session *session.Session
}

type ValidateSessionStore interface {
	Get(ctx context.Context, tenantID, sessionID string, ttl time.Duration) (*session.Session, error)
	Delete(ctx context.Context, tenantID, sessionID string) error
}

type WebAuthnDeps struct {
	Enabled                    bool
	RequireForLogin            bool
	RejectClonedAuthenticators bool
	CeremonyTTL                time.Duration

	WebAuthn *webauthn.WebAuthn

	TenantIDFromContext func(context.Context) string
	Now                 func() time.Time
	NewCeremonyID       func() (string, error)

	GetUserByID               func(context.Context, string) (LoginUserRecord, error)
	GetCredentials            func(context.Context, string) ([]webauthn.Credential, error)
	AddCredential             func(context.Context, string, webauthn.Credential) error
	UpdateCredentialSignCount func(context.Context, string, []byte, uint32) error

	SaveSession          func(context.Context, string, *WebAuthnSessionRecord, time.Duration) error
	ConsumeSession       func(context.Context, string) (*WebAuthnSessionRecord, error)
	MapSessionStoreError func(error) error

	GetMFAChallenge  func(context.Context, string) (*MFALoginChallengeRecord, error)
	MapMFAStoreError func(error) error

	MetricInc func(int)
	EmitAudit func(context.Context, string, bool, string, string, string, error, func() map[string]string)

	Events WebAuthnEvents
	Errors WebAuthnErrors
}

type WebAuthnErrors struct {
	EngineNotReady     error
	Disabled           error
	Invalid            error
	CeremonyExpired    error
	CloneDetected      error
	CredentialNotFound error
	Unavailable        error
	UserNotFound       error
}

type WebAuthnEvents struct {
	RegisterSuccess string
	RegisterFailure string
}

type WebAuthnSessionRecord struct {
	UserID      string
	TenantID    string
	Purpose     byte
	SessionJSON []byte
}