apiv1

type AuthorizeRequest struct {
	ResponseType        string `form:"response_type" binding:"required" validate:"required,max=128,printascii"`
	ClientID            string `form:"client_id" binding:"required" validate:"required,max=128,printascii"`
	RedirectURI         string `form:"redirect_uri" binding:"required" validate:"required,max=2048,printascii"`
	Scope               string `form:"scope" binding:"required" validate:"required,max=1024,printascii"`
	State               string `form:"state" validate:"omitempty,max=500,printascii"`
	Nonce               string `form:"nonce" validate:"omitempty,max=256,printascii"`
	CodeChallenge       string `form:"code_challenge" validate:"omitempty,max=128,printascii"`
	CodeChallengeMethod string `form:"code_challenge_method" validate:"omitempty,max=128,printascii"`
	ResponseMode        string `form:"response_mode" validate:"omitempty,max=128,printascii"`
	Display             string `form:"display" validate:"omitempty,max=128,printascii"`
	Prompt              string `form:"prompt" validate:"omitempty,max=128,printascii"`
	MaxAge              int    `form:"max_age"`
	UILocales           string `form:"ui_locales" validate:"omitempty,max=256,printascii"`
	IDTokenHint         string `form:"id_token_hint" validate:"omitempty,max=8192,printascii"`
	LoginHint           string `form:"login_hint" validate:"omitempty,max=256,printascii"`
	ACRValues           string `form:"acr_values" validate:"omitempty,max=512,printascii"`
}

type AuthorizeResponse struct {
	SessionID        string       `json:"session_id"`
	QRCodeData       string       `json:"qr_code_data"`
	QRCodeImageURL   string       `json:"qr_code_image_url"`
	DeepLinkURL      string       `json:"deep_link_url"`
	PollURL          string       `json:"poll_url"`
	WalletLinks      []WalletLink `json:"wallet_links,omitempty"`
	PreferredFormats []string     `json:"preferred_formats"`
	UseJAR           bool         `json:"use_jar"`
	ResponseMode     string       `json:"response_mode"`
	Title            string       `json:"title"`
	Subtitle         string       `json:"subtitle"`
	PrimaryColor     string       `json:"primary_color"`
	SecondaryColor   string       `json:"secondary_color"`
	Theme            string       `json:"theme"`
	CustomCSS        string       `json:"custom_css"`
	CSSFile          string       `json:"css_file"`
	LogoURL          string       `json:"logo_url"`
}

type CallbackRequest struct {
	State string `form:"state" binding:"required" validate:"required,max=128,printascii"`
	Code  string `form:"code" validate:"omitempty,max=128,printascii"`
	Error string `form:"error" validate:"omitempty,max=1000,printascii"`
}

type CallbackResponse struct {
	RedirectURI string
}

type Client struct {
	// contains filtered or unexported fields
}

type ClientInformationResponse struct {
	ClientRegistrationResponse
}

type ClientRegistrationRequest struct {
	// REQUIRED or OPTIONAL OAuth 2.0 parameters
	RedirectURIs            []string `json:"redirect_uris,omitempty" validate:"required,min=1,dive,redirect_uri"`
	TokenEndpointAuthMethod string   `` /* 144-byte string literal not displayed */
	GrantTypes              []string `` /* 128-byte string literal not displayed */
	ResponseTypes           []string `json:"response_types,omitempty" default:"[\"code\"]" validate:"omitempty,dive,oneof=code"`
	ClientName              string   `json:"client_name,omitempty"`
	ClientURI               string   `json:"client_uri,omitempty" validate:"omitempty,httpsurl"`
	LogoURI                 string   `json:"logo_uri,omitempty" validate:"omitempty,httpsurl"`
	Scope                   string   `json:"scope,omitempty" default:"openid"`
	Contacts                []string `json:"contacts,omitempty"`
	TosURI                  string   `json:"tos_uri,omitempty" validate:"omitempty,httpsurl"`
	PolicyURI               string   `json:"policy_uri,omitempty" validate:"omitempty,httpsurl"`
	JWKSUri                 string   `json:"jwks_uri,omitempty" validate:"omitempty,excluded_with=JWKS"`
	JWKS                    any      `json:"jwks,omitempty"`
	SoftwareID              string   `json:"software_id,omitempty"`
	SoftwareVersion         string   `json:"software_version,omitempty"`

	// OpenID Connect specific
	ApplicationType         string   `json:"application_type,omitempty" default:"web" validate:"omitempty,oneof=web native"`
	SectorIdentifierURI     string   `json:"sector_identifier_uri,omitempty"`
	SubjectType             string   `json:"subject_type,omitempty" default:"public" validate:"omitempty,oneof=public pairwise"`
	IDTokenSignedRespAlg    string   `json:"id_token_signed_response_alg,omitempty" default:"RS256"`
	IDTokenEncryptedRespAlg string   `json:"id_token_encrypted_response_alg,omitempty"`
	IDTokenEncryptedRespEnc string   `json:"id_token_encrypted_response_enc,omitempty"`
	UserinfoSignedRespAlg   string   `json:"userinfo_signed_response_alg,omitempty"`
	RequestObjectSigningAlg string   `json:"request_object_signing_alg,omitempty"`
	DefaultMaxAge           int      `json:"default_max_age,omitempty"`
	RequireAuthTime         bool     `json:"require_auth_time,omitempty"`
	DefaultACRValues        []string `json:"default_acr_values,omitempty"`
	InitiateLoginURI        string   `json:"initiate_login_uri,omitempty"`
	RequestURIs             []string `json:"request_uris,omitempty"`

	// PKCE (RFC 7636)
	CodeChallengeMethod string `json:"code_challenge_method,omitempty" default:"S256" validate:"omitempty,oneof=S256 plain"`
}

type ClientRegistrationResponse struct {
	ClientID                string   `json:"client_id"`
	ClientSecret            string   `json:"client_secret,omitempty"`
	ClientIDIssuedAt        int64    `json:"client_id_issued_at,omitempty"`
	ClientSecretExpiresAt   int64    `json:"client_secret_expires_at"` // 0 = never expires, REQUIRED per RFC 7591
	RedirectURIs            []string `json:"redirect_uris,omitempty"`
	TokenEndpointAuthMethod string   `json:"token_endpoint_auth_method,omitempty"`
	GrantTypes              []string `json:"grant_types,omitempty"`
	ResponseTypes           []string `json:"response_types,omitempty"`
	ClientName              string   `json:"client_name,omitempty"`
	ClientURI               string   `json:"client_uri,omitempty"`
	LogoURI                 string   `json:"logo_uri,omitempty"`
	Scope                   string   `json:"scope,omitempty"`
	Contacts                []string `json:"contacts,omitempty"`
	TosURI                  string   `json:"tos_uri,omitempty"`
	PolicyURI               string   `json:"policy_uri,omitempty"`
	JWKSUri                 string   `json:"jwks_uri,omitempty"`
	JWKS                    any      `json:"jwks,omitempty"`
	SoftwareID              string   `json:"software_id,omitempty"`
	SoftwareVersion         string   `json:"software_version,omitempty"`
	RegistrationAccessToken string   `json:"registration_access_token,omitempty"`
	RegistrationClientURI   string   `json:"registration_client_uri,omitempty"`

	// OpenID Connect specific
	ApplicationType      string   `json:"application_type,omitempty"`
	SectorIdentifierURI  string   `json:"sector_identifier_uri,omitempty"`
	SubjectType          string   `json:"subject_type,omitempty"`
	IDTokenSignedRespAlg string   `json:"id_token_signed_response_alg,omitempty"`
	DefaultMaxAge        int      `json:"default_max_age,omitempty"`
	RequireAuthTime      bool     `json:"require_auth_time,omitempty"`
	DefaultACRValues     []string `json:"default_acr_values,omitempty"`
	InitiateLoginURI     string   `json:"initiate_login_uri,omitempty"`
	RequestURIs          []string `json:"request_uris,omitempty"`

	// PKCE
	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
}

type ConfirmCredentialDisplayRequest struct {
	SessionID string `json:"-" uri:"session_id" validate:"required,max=128,printascii"`
	Confirmed bool   `json:"confirmed"`
}

type ConfirmCredentialDisplayResponse struct {
	RedirectURI string `json:"redirect_uri"`
}

type CredentialFormat string

type DeleteClientRequest struct {
	ClientID                string `json:"-" uri:"client_id" validate:"required,max=128,printascii"`
	RegistrationAccessToken string `json:"-" header:"Authorization" validate:"required"`
}

type DirectPostRequest struct {
	// Not binding:"required": with response_mode=direct_post.jwt the wallet
	// posts only `response`, and state travels inside that JWE (OpenID4VP 1.0
	// 8.3.1). Requiring it here rejected a conformant wallet before anything
	// could be decrypted. ProcessDirectPost requires one of state/response.
	State                  string `json:"state" form:"state" validate:"omitempty,max=256,printascii"`
	VPToken                string `json:"vp_token" form:"vp_token" validate:"omitempty"`                               // For standard direct_post (JWT, can be very large)
	PresentationSubmission string `json:"presentation_submission" form:"presentation_submission" validate:"omitempty"` // For standard direct_post (JSON, can be large)
	Response               string `json:"response" form:"response" validate:"omitempty"`                               // For DC API encrypted JWT response (can be very large)
}

type DirectPostResponse struct {
	RedirectURI string
}

type DiscoveryMetadata struct {
	Issuer                            string   `json:"issuer"`
	AuthorizationEndpoint             string   `json:"authorization_endpoint"`
	TokenEndpoint                     string   `json:"token_endpoint"`
	UserInfoEndpoint                  string   `json:"userinfo_endpoint,omitempty"`
	JwksURI                           string   `json:"jwks_uri"`
	RegistrationEndpoint              string   `json:"registration_endpoint,omitempty"` // RFC 7591
	ResponseTypesSupported            []string `json:"response_types_supported"`
	SubjectTypesSupported             []string `json:"subject_types_supported"`
	IDTokenSigningAlgValuesSupported  []string `json:"id_token_signing_alg_values_supported"`
	ScopesSupported                   []string `json:"scopes_supported"`
	ClaimsSupported                   []string `json:"claims_supported"`
	GrantTypesSupported               []string `json:"grant_types_supported"`
	CodeChallengeMethodsSupported     []string `json:"code_challenge_methods_supported"`
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported"`
}

type GetClientInformationRequest struct {
	ClientID                string `json:"-" uri:"client_id" validate:"required,max=128,printascii"`
	RegistrationAccessToken string `json:"-" header:"Authorization" validate:"required"`
}

type GetCredentialDisplayDataRequest struct {
	SessionID string `json:"-" uri:"session_id" validate:"required,max=128,printascii"`
}

type GetCredentialDisplayDataResponse struct {
	SessionID         string         `json:"session_id"`
	VPToken           string         `json:"vp_token"`
	Claims            map[string]any `json:"claims"`
	ClientID          string         `json:"client_id"`
	RedirectURI       string         `json:"redirect_uri"`
	State             string         `json:"state"`
	ShowRawCredential bool           `json:"show_raw_credential"`
	ShowClaims        bool           `json:"show_claims"`
	PrimaryColor      string         `json:"primary_color"`
	SecondaryColor    string         `json:"secondary_color"`
	CustomCSS         string         `json:"custom_css"`
}

type GetQRCodeRequest struct {
	SessionID  string `json:"-" uri:"session_id" validate:"required,max=128,printascii"`
	WalletName string `json:"-" form:"wallet" validate:"omitempty,max=128"` // Optional: generate QR for a specific web wallet (display names may contain non-ASCII)
}

type GetQRCodeResponse struct {
	ImageData []byte
}

type GetRequestObjectRequest struct {
	SessionID string `json:"-" uri:"session_id" validate:"required,max=128,printascii"`
}

type GetRequestObjectResponse struct {
	RequestObject string
}

type OAuthError struct {
	// Error code as defined in OAuth 2.0 spec
	ErrorCode string `json:"error"`

	// Human-readable description
	ErrorDescription string `json:"error_description,omitempty"`

	// URI for more information
	ErrorURI string `json:"error_uri,omitempty"`

	// HTTP status code to return
	HTTPStatus int `json:"-"`

	// Original error for internal logging
	Cause error `json:"-"`
}

type PollSessionRequest struct {
	SessionID string `json:"-" uri:"session_id" validate:"required,max=128,printascii"`
}

type PollSessionResponse struct {
	Status      string `json:"status"`
	RedirectURI string `json:"redirect_uri,omitempty"`
}

type SessionPollResponse struct {
	SessionID         string `json:"session_id"`
	Status            string `json:"status"`
	AuthorizationCode string `json:"authorization_code,omitempty"`
	RedirectURI       string `json:"redirect_uri,omitempty"`
	State             string `json:"state,omitempty"`
}

type TokenRequest struct {
	GrantType    string `form:"grant_type" binding:"required" validate:"required,max=128,printascii"`
	Code         string `form:"code" validate:"omitempty,max=256,printascii"`
	RedirectURI  string `form:"redirect_uri" validate:"omitempty,max=2048,printascii"`
	ClientID     string `form:"client_id" validate:"omitempty,max=128,printascii"`
	ClientSecret string `form:"client_secret" validate:"omitempty,max=256,printascii"`
	CodeVerifier string `form:"code_verifier" validate:"omitempty,max=128,printascii"`
	RefreshToken string `form:"refresh_token" validate:"omitempty,max=256,printascii"`
}

type TokenResponse struct {
	AccessToken  string `json:"access_token,omitempty"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in,omitempty"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token"`
	Scope        string `json:"scope,omitempty"`
}

type UICredentialInfo struct {
	Format string `json:"format"`
	// VCT is the credential's own type identifier - the value
	// BuildCredentialWithSigner embeds as the credential's "vct" claim. Kept
	// as the single display identifier for the UI's credential picker.
	VCT string `json:"vct"`
	// VCTValues is the credential's canonical vct as a single-element list,
	// for DCQL meta.vct_values. ResolveVCTUrls yields exactly one identifier
	// per VCTM -- the file's own vct when present (URN or foreign URL), or
	// the apigw hosting URL when a local file left vct empty -- so the list
	// carries at most one value.
	// omitempty: mso_mdoc scopes get no list (they're identified by doctype,
	// not vct), so this drops the field entirely for them rather than
	// emitting a meaningless "vct_values": null.
	VCTValues  []string                        `json:"vct_values,omitempty"`
	Attributes map[string]map[string][]*string `json:"attributes"`
}

type UIInteractionReply struct {
	// SessionID identifies the authorization context this reply belongs to.
	// Returned so the browser can address later POSTs (e.g. session-preference)
	// to the exact request it was created for, rather than relying on the
	// shared per-origin cookie session that any other tab can overwrite.
	SessionID string `json:"session_id"`

	// AuthorizationRequest is the request reached through request_uri: the QR
	// code, the same-device link, and the polyfill's redirect fallback. Its
	// response_mode is direct_post.jwt, because a wallet arriving this way
	// has no browser DC API call to answer inside.
	AuthorizationRequest string `json:"authorization_request"`
	QRCode               string `json:"qr_code"`

	// DCAPIAuthorizationRequest is the request for navigator.credentials.get,
	// carrying response_mode dc_api.jwt. Empty when the Digital Credentials
	// API is disabled.
	//
	// Two requests rather than one, because response_mode has to follow the
	// delivery channel: dc_api modes are defined only for a request handed to
	// the browser DC API, where the response returns inside that call and the
	// transcript binds to the calling origin. Serving one request object to
	// both channels - which is what this flow did - meant every wallet that
	// scanned the QR or followed the link got a mode it could not honour, and
	// only found out after the user had selected credentials and signed
	// (SUNET/vc#652).
	DCAPIAuthorizationRequest string `json:"dc_api_authorization_request,omitempty"`
}

type UIInteractionRequest struct {
	DCQLQuery   *openid4vp.DCQL                        `json:"dcql_query" validate:"required"`
	Validations map[string][]openid4vp.ClaimValidation `json:"validations,omitempty" validate:"omitempty,dive,dive"`

	// SessionID is a reuse hint sourced ONLY from the request body (which
	// mirrors the tab-scoped sessionStorage value). The HTTP layer
	// deliberately does NOT populate it from the shared gin cookie
	// session, because that cookie is overwritten by any sibling tab and
	// would otherwise let a fresh tab inherit another tab's in-flight
	// authorization context. When this id names a still-valid,
	// still-unclaimed context with the same DCQL / validations, the
	// response returns that context's existing request_uri/QR so a
	// reload mid-flow does not orphan the wallet's outstanding scan.
	// Otherwise a fresh session id is minted and returned in the reply.
	SessionID string `json:"session_id,omitempty" validate:"omitempty,max=128,printascii"`
}

type UIMetadataReply struct {
	Credentials      map[string]*UICredentialInfo `json:"credentials"`
	SupportedWallets map[string]string            `json:"supported_wallets"`
	Presets          map[string]*UIPreset         `json:"presets,omitempty"`
	// PresetCategoryOrder lists every distinct non-empty Category found
	// across Presets, in display order - lowest-Order preset within the
	// category first, ties broken alphabetically by category name. JSON map
	// keys always serialize alphabetically (encoding/json), so this is the
	// only way an operator's intended category ordering (via
	// PresetDefinition.Order) survives onto the wire; the UI groups/orders
	// preset buttons by this list rather than alphabetizing category names
	// itself. Excludes the empty/uncategorized group, which the UI always
	// renders last under its own generic heading.
	PresetCategoryOrder []string `json:"preset_category_order,omitempty"`
	// DCAPIEnabled mirrors verifier.digital_credentials.enable, so the UI only
	// attempts the native W3C Digital Credentials API when an operator has
	// opted in, rather than always trying it regardless of server config.
	DCAPIEnabled bool `json:"dc_api_enabled"`
	// DCAPIAutoAttempt mirrors verifier.digital_credentials.auto_attempt -
	// see that field's own doc comment for why this is separate from
	// DCAPIEnabled (an OS-level DC API matcher rejection can pre-empt any
	// application code, with no clean fallback to catch).
	DCAPIAutoAttempt bool `json:"dc_api_auto_attempt"`
}

type UIPreset struct {
	Label string `json:"label"`
	// Category groups this preset with every other preset sharing the same
	// string, for progressive/grouped rendering - empty for an uncategorized
	// preset. See model.PresetDefinition.Category.
	Category string `json:"category,omitempty"`
	// Order is this preset's position within its Category (ascending; ties,
	// including the default 0, broken alphabetically by Label client-side).
	Order int `json:"order"`
	// Featured presets are shown immediately rather than behind the
	// progressive-disclosure grouping. See model.PresetDefinition.Featured.
	Featured    bool                 `json:"featured"`
	Credentials []UIPresetCredential `json:"credentials"`
}

type UIPresetClaim struct {
	Path []*string `json:"path"`
}

type UIPresetCredential struct {
	ID          string                      `json:"id"`
	Format      string                      `json:"format"`
	Meta        UIPresetMeta                `json:"meta"`
	Claims      []UIPresetClaim             `json:"claims,omitempty"`
	Validations []openid4vp.ClaimValidation `json:"validations,omitempty"`
}

type UIPresetMeta struct {
	VCTValues []string `json:"vct_values,omitempty"`
	// DoctypeValue is set for mdoc/ZK-mdoc scopes (openid4vp.MetaQuery's
	// mdoc-format field) - mirrors UICredentialInfo.VCT's mdoc branch.
	DoctypeValue string `json:"doctype_value,omitempty"`
	// ZKSystemType is set when the preset's VerificationPresetScope
	// overrides it - see that type's own doc comment.
	ZKSystemType []openid4vp.ZKSystemTypeSpec `json:"zk_system_type,omitempty"`
}

type UIResumeReply struct {
	Status UIResumeStatus `json:"status"`

	// Pending-only fields: same shape as UIInteractionReply so the client
	// can reuse its existing render path.
	SessionID                 string                                 `json:"session_id,omitempty"`
	AuthorizationRequest      string                                 `json:"authorization_request,omitempty"`
	QRCode                    string                                 `json:"qr_code,omitempty"`
	DCAPIAuthorizationRequest string                                 `json:"dc_api_authorization_request,omitempty"`
	DCQLQuery                 *openid4vp.DCQL                        `json:"dcql_query,omitempty"`
	Validations               map[string][]openid4vp.ClaimValidation `json:"validations,omitempty"`

	// Complete-only field.
	ResponseCode string `json:"response_code,omitempty"`
}

type UIResumeStatus string

type UpdateClientRequest struct {
	ClientID                string `json:"-" uri:"client_id" validate:"required,max=128,printascii"`
	RegistrationAccessToken string `json:"-" header:"Authorization" validate:"required"`
	ClientRegistrationRequest
}

type UpdateSessionPreferenceRequest struct {
	// SessionID is the authorization context this call targets. Callers
	// supply it in the JSON body: the OIDC-OP flow has it from template
	// render time; the standalone verifier UI gets it from the reply of
	// /ui/interaction (also persisted in sessionStorage so it survives a
	// reload). The HTTP layer falls back to the gin cookie session only
	// when the body is empty - a legacy / storage-blocked compatibility
	// path, not the normal channel.
	SessionID             string `json:"session_id" validate:"omitempty,max=128,printascii"`
	ShowCredentialDetails bool   `json:"show_credential_details"`
	// WalletFollowsRedirect is optional. When non-nil it records that the
	// user is continuing in a same-device web wallet that should follow
	// redirect_uri from direct_post. Omitted on credential-display saves
	// so those POSTs do not clear a previously set flag.
	WalletFollowsRedirect *bool `json:"wallet_follows_redirect"`
}

type UpdateSessionPreferenceResponse struct {
	Success bool `json:"success"`
}

type UserInfoRequest struct {
	Authorization string `json:"-" header:"Authorization" validate:"required,max=8192,printascii"`
	AccessToken   string `json:"-"` // Parsed from Authorization header
}

type UserInfoResponse map[string]any

type VerificationCallbackRequest struct {
	ResponseCode string `form:"response_code" uri:"response_code"`
}

type VerificationCallbackResponse struct {
	CredentialData []sdjwtvc.CredentialCache `json:"credential_data"`
}

type VerificationDirectPostRequest struct {
	Response string `json:"response"  form:"response"`
	// DCAPI marks a response returned inside a navigator.credentials.get
	// call and forwarded here by the verifier's own page, rather than POSTed
	// by a wallet reached through request_uri. The two bind their mdoc
	// session transcripts to different handovers, so this selects which one
	// the verifier recomputes - see mdoc.BuildOID4VPDCAPISessionTranscript.
	//
	// Client-supplied and not trusted as an assertion: the origin bound into
	// the transcript comes from configuration, never from the caller, so a
	// caller that sets this wrongly only fails its own verification. It
	// cannot choose what the presentation is checked against.
	DCAPI     bool   `json:"dc_api" form:"dc_api"`
	SessionID string `json:"-"` // Set by HTTP layer if same-device flow
}

type VerificationDirectPostResponse struct {
	// RedirectURI is present for same-device flows so the wallet can send
	// the browser back to the verifier. Cross-device flows omit it: the
	// still-open verifier tab is nudged over SSE instead.
	RedirectURI string `json:"redirect_uri,omitempty"`
}

type VerificationRequestObjectRequest struct {
	ID string `json:"-" form:"id" uri:"id" validate:"required,max=128,printascii"`
}

type WalletLink struct {
	Name           string `json:"name"`
	URL            string `json:"url"`
	QRCodeImageURL string `json:"qr_code_image_url"` // QR code image URL for cross-device flow
}