auth

type AgentClaims struct {
	AgentID   string `json:"agent_id"`
	SessionID string `json:"session_id"`
}

type AgentToken struct {
	Token     string
	AgentID   string
	SessionID string
	CreatedAt time.Time
	ExpiresAt time.Time
}

type AuditLogger interface {
	LogSecurityEvent(event SecurityEvent)
}

type Auth struct {
	// contains filtered or unexported fields
}

type Challenge struct {
	Nonce       []byte
	OperatorID  string
	Fingerprint string
	CreatedAt   time.Time
	ExpiresAt   time.Time
}

type Claims struct {
	OperatorID string `json:"operator_id"`
	SessionID  string `json:"session_id,omitempty"`
}

type Config struct {
	// AuthorizedKeysPath is the path to the authorized_keys file.
	// Format: <operator_name> <key_type> <public_key> <comment>
	AuthorizedKeysPath string

	// AuthorizedKeysData is the raw authorized_keys content (alternative to path).
	AuthorizedKeysData string

	// StaticToken is an optional shared secret token for quickstart/E2E mode.
	// When set, operators can authenticate with this token directly via Bearer auth.
	// Must be 64 hex characters (256 bits of entropy).
	StaticToken string

	// TokenExpiry is how long operator session tokens are valid. Default: 24 hours.
	TokenExpiry time.Duration

	// AgentTokenExpiry is how long agent tokens are valid. Default: 24 hours.
	AgentTokenExpiry time.Duration

	// ChallengeExpiry is how long challenges are valid. Default: 5 minutes.
	ChallengeExpiry time.Duration
}

type ContextKey string

type Operator struct {
	Name        string
	PublicKey   ssh.PublicKey
	Fingerprint string // SHA256 fingerprint
	Comment     string
}

type SecurityEvent struct {
	Timestamp   time.Time `json:"timestamp"`
	EventType   string    `json:"event_type"`
	ClientIP    string    `json:"client_ip"`
	Path        string    `json:"path"`
	Method      string    `json:"method"`
	Principal   string    `json:"principal"`
	PrincipalID string    `json:"principal_id,omitempty"`
	SessionID   string    `json:"session_id,omitempty"`
	Reason      string    `json:"reason"`
	UserAgent   string    `json:"user_agent,omitempty"`
}

type StagerValidator interface {
	ValidateStager(id string) (sessionID string, expired bool, exists bool)
}

type StructuredAuditLogger struct {
	// contains filtered or unexported fields
}

type Token struct {
	Value      string
	OperatorID string
	CreatedAt  time.Time
	ExpiresAt  time.Time
}