auth

type Algo string

type Argon2Params struct {
	Memory  uint32 // KiB
	Time    uint32
	Threads uint8
	SaltLen uint32
	KeyLen  uint32
}

type Backoff struct {
	// contains filtered or unexported fields
}

type BackoffConfig struct {
	// Free is the number of failures tolerated before any delay applies.
	Free int
	// Base is the delay after the first failure beyond Free; it doubles with
	// every further failure.
	Base time.Duration
	// Max caps the delay.
	Max time.Duration
	// Forget drops a key's history after this long without failures.
	Forget time.Duration
}

type ClientClaims struct {
	UserID uint32 `json:"user_id"`
	jwt.RegisteredClaims
}

type ClientJWT struct {
	// contains filtered or unexported fields
}

type Hasher struct {
	Params Argon2Params
}

type Limiter interface {
	// Allow reports whether an attempt for key may proceed now. When it may
	// not, retryAfter is how long the caller must wait.
	Allow(key string) (ok bool, retryAfter time.Duration)
	// Failure records a failed attempt, extending the backoff for key.
	Failure(key string)
	// Success clears the failure history for key.
	Success(key string)
}

type OpaqueToken struct {
	// Plain is handed to the client exactly once (cookie, URL, ...).
	Plain string
	// Hash is sha256(Plain), the only form persisted.
	Hash []byte
}

type RecoveryCode struct {
	// Plain is shown to the user once, formatted "xxxx-xxxx-xxxx-xxxx".
	Plain string
	// Hash is sha256 of the normalised code (80 bits of entropy, so a fast
	// hash is sufficient).
	Hash []byte
}

type TOTPKey struct {
	// Secret is the base32 seed; store it AEAD-encrypted.
	Secret string
	// URL is the otpauth:// URI to render as a QR code.
	URL string
}