core

type AccountList []string

type AccountListMap struct {
	// contains filtered or unexported fields
}

type AccountListOption func(a *AuthState) (AccountList, error)

type AddTOTPSecretFunc func(auth *AuthState, totp *mfa.TOTPSecret) (err error)

type AuthApplicationService interface {
	Authenticate(ctx context.Context, input AuthInput) (*AuthOutcome, error)
	LookupIdentity(ctx context.Context, input AuthInput) (*AuthOutcome, error)
	ListAccounts(ctx context.Context, input AuthInput) (*ListAccountsOutcome, error)
}

type AuthAttributes struct {
	// Attributes is a map of user attributes retrieved from the backend.
	Attributes bktype.AttributeMapping
	// contains filtered or unexported fields
}

type AuthCacheInvalidator interface {
	InvalidateIdentities(identities ...string) int
}

type AuthContext struct {
	RequestMetadata map[string][]string
	Transport       AuthTransportContext

	Method    string
	UserAgent string

	ClientIP          string
	ClientPort        string
	ClientHostname    string
	ClientID          string
	ExternalSessionID string

	LocalIP   string
	LocalPort string

	Protocol string

	XSSL                string
	XSSLSessionID       string
	XSSLClientVerify    string
	XSSLClientDN        string
	XSSLClientCN        string
	XSSLIssuer          string
	XSSLClientNotBefore string
	XSSLClientNotAfter  string
	XSSLSubjectDN       string
	XSSLIssuerDN        string
	XSSLClientSubjectDN string
	XSSLClientIssuerDN  string
	XSSLProtocol        string
	XSSLCipher          string

	SSLSerial      string
	SSLFingerprint string

	OIDCCID      string
	SAMLEntityID string
}

type AuthContextOption func(*AuthContext)

type AuthDecision string

type AuthDeps struct {
	Cfg                        config.File
	Logger                     *slog.Logger
	Env                        config.Environment
	Redis                      rediscli.Client
	Tolerate                   tolerate.Tolerate
	Resp                       ResponseWriter
	AccountCache               *accountcache.Manager
	Channel                    backend.Channel
	Backend                    BackendManager
	PluginBackendFactory       BackendManagerFactory
	NativeRuntime              AuthnNativeRuntime
	HostServices               AuthnHostServices
	LDAPQueue                  LDAPRequestQueue
	LDAPAuthQueue              LDAPAuthRequestQueue
	BackendAuthenticationCache *PositiveBackendAuthenticationCache
}

type AuthGroups struct {
	// Groups stores resolved group names.
	Groups []string

	// GroupDistinguishedNames stores resolved group distinguished names.
	GroupDistinguishedNames []string
	// contains filtered or unexported fields
}

type AuthIDPContext struct {
	IdentityAttributeRequest *IdentityAttributeRequest
	Request                  AuthIDPRequestContext
	ExistingBackendRef       RemoteBackendRef
}

type AuthIDPRequestContext struct {
	RequestedScopes []string
	GrantType       string
	RedirectURI     string
}

type AuthInput struct {
	Credentials        Credentials
	Context            AuthContext
	IDP                AuthIDPContext
	CorrelationID      string
	Mode               AuthMode
	EntryPoint         AuthnEntryPoint
	Service            string
	AuthLoginAttempt   uint
	DisableMemoryCache bool
	DisableCache       bool
}

type AuthInputError struct {
	Field  string
	Reason string
}

type AuthMode string

type AuthOutcome = authOutcomeProjection[AuthDecision]

type AuthPermissionDeniedError struct {
	Reason string
}

type AuthPreprocessRejectedError struct {
	Outcome *AuthOutcome
}

type AuthRequest struct {
	// Protocol is the protocol used for the request.
	Protocol *config.Protocol

	// HTTPClientContext is the Gin context associated with the request.
	HTTPClientContext *gin.Context

	// HTTPClientRequest is the HTTP request being processed.
	HTTPClientRequest *http.Request

	// RequestMetadata contains incoming transport metadata such as gRPC metadata.
	RequestMetadata map[string][]string

	// Transport contains server-observed transport evidence supplied by the boundary adapter.
	Transport AuthTransportContext

	// Method is the authentication method.
	Method string

	// Username is the name of the user attempting to authenticate.
	Username string

	// Password is the user's password.
	Password secret.Value

	// ClientIP is the IP address of the client making the request.
	ClientIP string

	// XClientPort is the port number of the client.
	XClientPort string

	// ClientHost is the hostname of the client.
	ClientHost string

	// UserAgent is the user agent string of the client.
	UserAgent string

	// Service is the name of the service being accessed.
	Service string

	// OIDCCID is the OIDC client ID.
	OIDCCID string

	// SAMLEntityID is the SAML Entity ID.
	SAMLEntityID string

	// XSSL indicates whether the connection is SSL/TLS.
	XSSL string // %[ssl_fc]

	// XSSLSessionID is the SSL session ID.
	XSSLSessionID string // %[ssl_fc_session_id,hex]

	// XSSLClientVerify indicates the status of client certificate verification.
	XSSLClientVerify string // %[ssl_c_verify]

	// XSSLClientDN is the distinguished name of the client certificate.
	XSSLClientDN string // %{+Q}[ssl_c_s_dn]

	// XSSLClientCN is the common name of the client certificate.
	XSSLClientCN string // %{+Q}[ssl_c_s_dn(cn)]

	// XSSLIssuer is the issuer of the client certificate.
	XSSLIssuer string // %{+Q}[ssl_c_i_dn]

	// XSSLClientNotBefore is the "Not Before" date of the client certificate.
	XSSLClientNotBefore string // %{+Q}[ssl_c_notbefore]

	// XSSLClientNotAfter is the "Not After" date of the client certificate.
	XSSLClientNotAfter string // %{+Q}[ssl_c_notafter]

	// XSSLSubjectDN is the subject DN of the server certificate.
	XSSLSubjectDN string // %{+Q}[ssl_c_s_dn]

	// XSSLIssuerDN is the issuer DN of the server certificate.
	XSSLIssuerDN string // %{+Q}[ssl_c_i_dn]

	// XSSLClientSubjectDN is the subject DN of the client certificate.
	XSSLClientSubjectDN string // %{+Q}[ssl_c_s_dn]

	// XSSLClientIssuerDN is the issuer DN of the client certificate.
	XSSLClientIssuerDN string // %{+Q}[ssl_c_i_dn]

	// XSSLProtocol is the SSL/TLS protocol version.
	XSSLProtocol string // %[ssl_fc_protocol]

	// XSSLCipher is the SSL/TLS cipher suite used.
	XSSLCipher string // %[ssl_fc_cipher]

	// SSLSerial is the serial number of the SSL certificate.
	SSLSerial string

	// SSLFingerprint is the fingerprint of the SSL certificate.
	SSLFingerprint string

	// AuthLoginAttempt is the incoming authentication attempt ordinal.
	AuthLoginAttempt uint

	// XClientID is a custom client identifier.
	XClientID string

	// ExternalSessionID is an upstream session identifier supplied by the caller.
	ExternalSessionID string

	// XLocalIP is the local IP address on which the request was received.
	XLocalIP string

	// XPort is the local port number on which the request was received.
	XPort string

	// NoAuth indicates whether authentication should be skipped.
	NoAuth bool

	// ListAccounts indicates whether to list available accounts.
	ListAccounts bool
}

type AuthResponseSettings struct {
	SMTPBackendAddress  string
	IMAPBackendAddress  string
	POP3BackendAddress  string
	DefaultLanguage     string
	InstanceName        string
	SMTPBackendPort     int
	IMAPBackendPort     int
	POP3BackendPort     int
	NginxWaitDelay      uint
	BackendHealthChecks bool
	Captured            bool
}

type AuthRuntime struct {
	// IDPContext carries typed request-local protocol facts for canonical browser flows.
	IDPContext *IDPRequestContext

	// StartTime is the time when the authentication request started.
	StartTime time.Time

	// AdditionalLogs contains additional log entries for the request.
	AdditionalLogs []any

	// MonitoringFlags holds flags related to request monitoring.
	MonitoringFlags []definitions.Monitoring

	// BruteForceBuckets contains read-only bucket facts collected for policy evaluation.
	BruteForceBuckets []bruteforce.BucketPolicyFact

	// AccountProviderPluginFacts contains native plugin account-list facts for policy evaluation.
	AccountProviderPluginFacts []pluginapi.PolicyFact

	// BruteForceToleration contains the request-local toleration fact collected for policy evaluation.
	BruteForceToleration tolerate.PolicyFact

	// RelayDomainPolicy contains the request-local relay-domain facts collected for policy evaluation.
	RelayDomainPolicy RelayDomainPolicyFact

	// RBLPolicy contains the request-local RBL facts collected for policy evaluation.
	RBLPolicy RBLPolicyFact

	// GUID is a unique identifier for the authentication request.
	GUID string

	// StatusMessage is a message describing the status of the request.
	StatusMessage string

	// StatusMessageI18NKey is the policy-selected localization key for StatusMessage.
	StatusMessageI18NKey string

	// ResponseLanguage is the policy-selected response-rendering language.
	ResponseLanguage string

	// AuthFSMTerminalState contains the current auth FSM terminal state when known.
	AuthFSMTerminalState string

	// AccountField is the name of the field containing the account information.
	AccountField string

	// AccountName is the name of the account being authenticated.
	AccountName string

	// EnvironmentName is the name of the environment control or source being accessed.
	EnvironmentName string

	// RemoteBackendRef binds follow-up identity operations to an authority-side backend.
	RemoteBackendRef RemoteBackendRef

	// IdentityAttributeRequest carries edge-side requested backend attributes for claim materialization.
	IdentityAttributeRequest *IdentityAttributeRequest

	// BackendName is the name of the backend used for authentication.
	BackendName string

	// UsedBackendIP is the IP address of the backend server used.
	UsedBackendIP string

	// TOTPSecret is the secret used for TOTP authentication.
	TOTPSecret string

	// TOTPSecretField is the field name containing the TOTP secret.
	TOTPSecretField string

	// TOTPRecoveryField is the field name containing the TOTP recovery codes.
	TOTPRecoveryField string

	// UniqueUserIDField is the field name containing the unique user ID.
	UniqueUserIDField string

	// DisplayNameField is the field name containing the user's display name.
	DisplayNameField string

	// BFClientNet is the network address used for brute-force detection.
	BFClientNet string

	// AdditionalAttributes contains additional attribute-specific data.
	AdditionalAttributes map[string]any

	// AuthFSMEventPath contains current auth FSM events seen by this request.
	AuthFSMEventPath []string

	// Context is the Lua context associated with the request.
	Context *lualib.Context

	// UsedBackendPort is the port number of the backend server used.
	UsedBackendPort int

	// StatusCodeOK is the HTTP status code for a successful request.
	StatusCodeOK int

	// StatusCodeInternalError is the HTTP status code for an internal server error.
	StatusCodeInternalError int

	// StatusCodeFail is the HTTP status code for a failed authentication.
	StatusCodeFail int

	// SourcePassDBBackend is the source password database backend.
	SourcePassDBBackend definitions.Backend

	// UsedPassDBBackend is the password database backend actually used.
	UsedPassDBBackend definitions.Backend

	// UserFound indicates whether the user was found in the backend.
	UserFound bool

	// Authenticated indicates whether the user was successfully authenticated.
	Authenticated bool

	// Authorized indicates whether the user is authorized for the request.
	Authorized bool

	// BFRepeating indicates whether brute-force detection is repeating.
	BFRepeating bool

	// BFRWP stores the request-level Repeating Wrong Password (RWP) allowance decision.
	// A pre-auth candidate is cleared after successful authentication, so final logs retain true only for failures
	// whose brute-force bucket counters were not increased.
	BFRWP bool
	// BruteForceError marks unavailable protection, distinct from an attack.
	BruteForceError bool

	// MasterUserMode indicates whether the request is in master user mode.
	MasterUserMode bool
}

type AuthSecurity struct {
	// Tolerate is the brute-force tolerance configuration.
	Tolerate tolerate.Tolerate

	// BruteForceName is the name of the brute-force protection profile.
	BruteForceName string

	// BruteForceCounter keeps track of brute-force attempts.
	BruteForceCounter map[string]uint

	// Logs contains custom log entries.
	Logs *lualib.CustomLogKeyValue

	// PasswordsAccountSeen is the number of passwords seen for the account.
	PasswordsAccountSeen uint

	// PasswordsTotalSeen is the total number of passwords seen.
	PasswordsTotalSeen uint

	// LoginAttempts is the number of login attempts made.
	LoginAttempts uint
	// contains filtered or unexported fields
}

type AuthState struct {

	// Request holds data directly extracted from the HTTP request or connection metadata.
	Request AuthRequest

	// Runtime holds process-related data generated or tracked during the authentication request.
	Runtime AuthRuntime

	// Security manages counters, managers and history related to brute-force and security.
	Security AuthSecurity

	// Attributes handles user attributes and their synchronization.
	Attributes AuthAttributes

	// Groups handles resolved groups and their synchronization.
	Groups AuthGroups
	// contains filtered or unexported fields
}

type AuthTransportContext struct {
	Kind         string
	Listener     string
	HTTPMethod   string
	HTTPRoute    string
	GRPCMethod   string
	Peer         string
	MTLSIdentity string
	Protected    bool
}

type AuthnEntryCallerProfiles struct {
	// Authenticate is the opaque internal caller evidence for password authentication.
	Authenticate decision.AuthenticationInput
	// LookupIdentity is the opaque internal caller evidence for identity lookup.
	LookupIdentity decision.AuthenticationInput
	// EntryPoint is selected exclusively by the trusted host adapter.
	EntryPoint AuthnEntryPoint
}

type AuthnEntryPoint uint8

type AuthnHostServices struct {
	// contains filtered or unexported fields
}

type AuthnHostServicesInput struct {
	PasswordVerifier PasswordVerifier
	Cache            CacheService
	BruteForce       BruteForceService
	Subject          CapturedLuaSubject
	RBL              RBLService
}

type AuthnInternalCallerProfiles struct {
	// contains filtered or unexported fields
}

type AuthnNativeCapture struct {
	Runtime      pluginapi.RuntimeContext
	Credentials  pluginapi.CredentialProvider
	Snapshot     pluginapi.RequestSnapshot
	PasswordHash string
}

type AuthnNativeCaptureInput struct {
	Auth         *AuthState
	Capabilities []pluginapi.Capability
	Detached     bool
}

type AuthnNativeRuntime interface {
	Capture(context.Context, AuthnNativeCaptureInput) (AuthnNativeCapture, error)
	ApplyRuntimeDelta(*AuthState, pluginapi.RuntimeDelta) error
}

type AuthnRequestStageFlags struct {
	EnvironmentRejected      bool
	EnvironmentStageExpected bool
	SubjectStageExpected     bool
}

type BackendAuthenticationCacheKey struct {
	// contains filtered or unexported fields
}

type BackendManager interface {
	// PassDB authenticates a user through a password database using the provided AuthState and returns the authentication result.
	PassDB(auth *AuthState) (passDBResult *PassDBResult, err error)

	// AccountDB retrieves a list of user accounts from the backend using the provided authentication state.
	AccountDB(auth *AuthState) (accounts AccountList, err error)

	// AddTOTPSecret adds the specified TOTP secret to the user's authentication state in the backend.
	AddTOTPSecret(auth *AuthState, totp *mfa.TOTPSecret) (err error)

	// DeleteTOTPSecret removes the TOTP secret for the user in the backend.
	DeleteTOTPSecret(auth *AuthState) (err error)

	// AddTOTPRecoveryCodes adds the specified TOTP recovery codes to the user's authentication state in the backend.
	AddTOTPRecoveryCodes(auth *AuthState, recovery *mfa.TOTPRecovery) (err error)

	// DeleteTOTPRecoveryCodes removes all TOTP recovery codes for the user in the backend.
	DeleteTOTPRecoveryCodes(auth *AuthState) (err error)

	// GetWebAuthnCredentials retrieves WebAuthn credentials for the user in the backend.
	GetWebAuthnCredentials(auth *AuthState) (credentials []mfa.PersistentCredential, err error)

	// SaveWebAuthnCredential saves a WebAuthn credential for the user in the backend.
	SaveWebAuthnCredential(auth *AuthState, credential *mfa.PersistentCredential) (err error)

	// DeleteWebAuthnCredential removes a WebAuthn credential for the user in the backend.
	DeleteWebAuthnCredential(auth *AuthState, credential *mfa.PersistentCredential) (err error)

	// UpdateWebAuthnCredential updates an existing WebAuthn credential in the backend.
	UpdateWebAuthnCredential(auth *AuthState, oldCredential *mfa.PersistentCredential, newCredential *mfa.PersistentCredential) (err error)
}

type BackendManagerFactory func(backendName string, deps AuthDeps) BackendManager

type BackendServer struct {
	// contains filtered or unexported fields
}

type Bootstrap interface {
	// InitWebAuthn initializes the global WebAuthn configuration from environment/config.
	// Returns an error if the configuration is invalid.
	InitWebAuthn() error
	// InitGinLogging wires Gin log writers and sets Gin mode based on configuration.
	InitGinLogging()
}

type BruteForceService interface {
	// WaitDelay returns the wait time in seconds based on configured max and login attempts.
	WaitDelay(maxWaitDelay, loginAttempt uint) int

	// LoadHistories loads brute-force related histories and updates counters on the AuthState.
	LoadHistories(ctx *gin.Context, auth *AuthState, accountName string)
}

type CacheService interface {
	// OnSuccess updates the positive cache after a successful authentication attempt for the specified account name.
	OnSuccess(auth *AuthState, accountName string) error

	// OnFailure handles the actions required in case of an unsuccessful authentication attempt for the given account name.
	OnFailure(auth *AuthState, accountName string)

	// Purge removes all cached entries for the specified username.
	Purge(auth *AuthState, username string)
}

type CachedBackendAuthentication struct {
	// contains filtered or unexported fields
}

type CaptureResponseWriter struct {
	// contains filtered or unexported fields
}

type CapturedAuthDecision string

type CapturedAuthOutcome = authOutcomeProjection[CapturedAuthDecision]

type CapturedLuaSubject interface {
	AnalyzeSource(
		ctx *gin.Context,
		view *StateView,
		result *PassDBResult,
		name string,
		prototype *lua.FunctionProto,
		pools *vmpool.Manager,
		poolKey vmpool.PoolKey,
		modules *luaseal.Modules,
	) definitions.AuthResult
}

type ClaimManager struct {
	// contains filtered or unexported fields
}

type CompositeAuthCacheInvalidator struct {
	// contains filtered or unexported fields
}

type CredentialOption func(*Credentials)

type Credentials struct {
	Username     string
	Password     secret.Value
	TOTP         string
	TOTPRecovery string
}

type DefaultBootstrap struct {
	// contains filtered or unexported fields
}

type DefaultHTTPApp struct {
	Bootstrap         Bootstrap
	RouterComposer    RouterComposer
	HTTPServerFactory HTTPServerFactory
	ProxyProvider     ProxyListenerProvider
	TLSConfigurator   TLSConfigurator
	TransportRunner   TransportRunner
	// contains filtered or unexported fields
}

type DefaultHTTPServerFactory struct {
	// contains filtered or unexported fields
}

type DefaultRouterComposer struct {
	// contains filtered or unexported fields
}

type DefaultServerSignals struct {
	// contains filtered or unexported fields
}

type DefaultTLSConfigurator struct {
	// contains filtered or unexported fields
}

type DefaultTransportRunner struct {
	// contains filtered or unexported fields
}

type Done struct{}

type FieldMapping struct {
	Account     string
	TOTPSecret  string
	UniqueID    string
	DisplayName string
}

type FrontendAsset struct {
	RelativePath string
	Content      []byte
}

type HAProxyListenerProvider struct {
	// contains filtered or unexported fields
}

type HTTPApplication interface {
	Start(ctx context.Context,
		setupHealth func(*gin.Engine),
		setupMetrics func(*gin.Engine),
		setupIDP func(*gin.Engine),
		setupBackchannel func(*gin.Engine),
		signals ServerSignals,
	)
}

type HTTPAuthResponseRenderer struct {
	// contains filtered or unexported fields
}

type HTTPDeps struct {
	Cfg            config.File
	Logger         *slog.Logger
	Env            config.Environment
	Redis          rediscli.Client
	AccountCache   *accountcache.Manager
	RouteArtifacts *RouteArtifacts
}

type HTTPServerFactory interface {
	New(*gin.Engine) *http.Server
}

type IDPMFAProtocolContext struct {
	Protocol     string
	OIDCClientID string
	SAMLEntityID string
	Request      IDPRequestContext
}

type IDPRequestContext struct {
	GrantType       string
	RedirectURI     string
	RequestedScopes []string
	MFACompleted    bool
	MFAMethod       string
}

type IdentityAttributeRequest struct {
	Names                          []string
	IncludeStandardIdentity        bool
	IncludeGroups                  bool
	IncludeGroupDistinguishedNames bool
	ReportMissing                  bool
}

type JSONErrorMsg struct {
	// Field represents the name of the field that caused the validation error.
	Field string `json:"field"`

	// Message represents the error message associated with the validation error.
	Message string `json:"message"`
}

type LDAPAuthRequestQueue interface {
	Push(request *bktype.LDAPAuthRequest, priority int)
}

type LDAPRequestQueue interface {
	Push(request *bktype.LDAPRequest, priority int)
}

type ListAccountsOutcome struct {
	ResponseHeaders         http.Header
	MessageResolver         localization.MessageResolver
	ResponseHeaderDeletes   []string
	FSMEventPath            []string
	Accounts                AccountList
	ResponseSettings        AuthResponseSettings
	Decision                AuthDecision
	TerminalState           string
	Session                 string
	StatusMessage           string
	StatusMessageI18NKey    string
	ResponseLanguage        string
	Error                   string
	Protocol                string
	HTTPStatus              int
	LoginAttempts           uint
	MemoryCacheHit          bool
	DelayedResponseEligible bool
}

type LoginAttemptManager interface {
	InitFromHeader(headerVal string)
	InitFromAttemptOrdinal(ordinal uint)
	InitFromBucket(counter uint)
	OnAuthFailure()
	OnAuthSuccess()
	FailCount() uint
	AttemptOrdinal() uint
	Remaining() uint
	ShouldBlock() bool
}

type Metric struct {
	Value float64 `redis:"value"`
	Label string  `redis:"label"`
}

type PassDBMap struct {
	// contains filtered or unexported fields
}

type PassDBOption func(auth *AuthState) (*PassDBResult, error)

type PassDBResult struct {
	// BackendName specifies the name of the backend that authenticated or found the user in the password database.
	BackendName string

	// AccountField is the SQL field or LDAP attribute that was used for the user account.
	AccountField string

	// Account is the actual account name of the user.
	Account string

	// TOTPSecretField is set by the Database which has found the user.
	TOTPSecretField string

	// TOTPRecoveryField NYI
	TOTPRecoveryField string

	// UniqueUserIDField is a string representing a unique user identifier.
	UniqueUserIDField string

	// DisplayNameField is the display name of a user
	DisplayNameField string

	// BackendRef binds this result to an authority-side backend without exposing credentials.
	BackendRef RemoteBackendRef

	// Attributes is the result catalog returned by the underlying password Database.
	Attributes bktype.AttributeMapping

	// Groups contains resolved group names.
	Groups []string

	// GroupDistinguishedNames contains resolved group distinguished names.
	GroupDistinguishedNames []string

	// AdditionalAttributes contains additional backend attributes
	AdditionalAttributes map[string]any

	// Authenticated is a flag that is set if a user was not only found, but also succeeded authentication.
	Authenticated bool

	// UserFound is a flag that is set if the user was found in a password Database.
	UserFound bool

	// Backend is set by the Database backend, which has found the user.
	Backend definitions.Backend
}

type PasswordVerifier interface {
	Verify(ctx *gin.Context, a *AuthState, passDBs []*PassDBMap) (*PassDBResult, error)
}

type PositiveBackendAuthenticationCache struct {
	// contains filtered or unexported fields
}

type PostActionExecutionGate = effectsupervisor.Gate

type ProxyListenerProvider interface {
	Get() *proxyproto.Listener // nil if disabled
}

type PublicMFAState struct {
	WebAuthnCredentials []mfa.PersistentCredential
	RecoveryCodeCount   int
	HasTOTP             bool
	HasWebAuthn         bool
}

type PublicMFAStateProvider interface {
	GetPublicMFAState(auth *AuthState, includeWebAuthn bool) (PublicMFAState, error)
}

type RBLFactService interface {
	// ScoreWithFacts computes the aggregated RBL score and returns the request-local policy facts.
	ScoreWithFacts(ctx *gin.Context, view *StateView) (RBLPolicyFact, error)
}

type RBLListPolicyFact struct {
	Name         string
	Host         string
	Query        string
	ReturnCode   string
	ReasonCode   string
	IPFamily     string
	Weight       int
	Listed       bool
	Error        bool
	AllowFailure bool
}

type RBLPolicyFact struct {
	Lists                  []RBLListPolicyFact
	MatchedLists           []string
	Score                  int
	Threshold              int
	MatchedCount           int
	ListCount              int
	AllowFailureErrorCount int
	EffectiveError         bool
	SoftAllowlisted        bool
	IPAllowlisted          bool
}

type RBLService interface {
	// Score computes the aggregated RBL score for the request.
	Score(ctx *gin.Context, view *StateView) (int, error)
}

type RelayDomainPolicyFact struct {
	Value           string
	MatchedDomain   string
	ConfiguredCount int
	Present         bool
	Known           bool
	Rejected        bool
	StaticMatch     bool
	SoftAllowlisted bool
}

type RemoteBackendRef struct {
	Type        string
	Name        string
	Protocol    string
	Authority   string
	OpaqueToken string
}

type RemoteMFAOperations interface {
	BeginTOTPRegistration(auth *AuthState, idempotencyKey string) (TOTPRegistration, error)
	FinishTOTPRegistration(auth *AuthState, pendingRegistrationID string, code string, idempotencyKey string) error
	VerifyTOTP(auth *AuthState, code string) (bool, error)
	DeleteTOTP(auth *AuthState, idempotencyKey string) error
	GenerateRecoveryCodes(auth *AuthState, count uint32, idempotencyKey string) ([]string, error)
	UseRecoveryCode(auth *AuthState, code string, idempotencyKey string) (bool, error)
	DeleteRecoveryCodes(auth *AuthState, idempotencyKey string) error
}

type ResponseDeps struct {
	Cfg       config.File
	Env       config.Environment
	Logger    *slog.Logger
	Resolver  localization.MessageResolver
	WaitDelay func(maxWaitDelay, loginAttempt uint) int
}

type ResponseWriter interface {
	// OK sends a success response to the client by setting appropriate headers and processing authentication logic.
	OK(ctx *gin.Context, view *StateView)

	// Fail sends a failure response to the client by setting appropriate headers and processing login attempt logic.
	Fail(ctx *gin.Context, view *StateView)

	// TempFail sends a temporary failure response with the specified reason and logs the error for debugging purposes.
	TempFail(ctx *gin.Context, view *StateView, reason string)
}

type RouteArtifacts struct {
	// contains filtered or unexported fields
}

type RouterComposer interface {
	ComposeEngine() *gin.Engine
	ApplyEarlyMiddlewares(*gin.Engine) // pprof, limit, logger
	ApplyCoreMiddlewares(*gin.Engine)  // recovery, proxies, compression, metrics
	RegisterRoutes(r *gin.Engine,
		setupHealth func(*gin.Engine),
		setupMetrics func(*gin.Engine),
		setupIDP func(*gin.Engine),
		setupBackchannel func(*gin.Engine),
	)
}

type ScopeManager struct {
	// contains filtered or unexported fields
}

type ServerSignals interface {
	// HTTPDone returns a channel that is signaled when the HTTP/1.1+2 server
	// has terminated gracefully.
	HTTPDone() chan Done
	// HTTP3Done returns a channel that is signaled when the HTTP/3 server
	// has terminated gracefully. It may be nil if HTTP/3 is disabled.
	HTTP3Done() chan Done
}

type State interface {
	// DeleteWebAuthnCredential removes a WebAuthn credential for the user in the backend.
	DeleteWebAuthnCredential(credential *mfa.PersistentCredential) (err error)

	// SaveWebAuthnCredential saves a WebAuthn credential for the user in the backend.
	SaveWebAuthnCredential(credential *mfa.PersistentCredential) (err error)

	// UpdateWebAuthnCredential updates an existing WebAuthn credential in the backend.
	UpdateWebAuthnCredential(oldCredential *mfa.PersistentCredential, newCredential *mfa.PersistentCredential) (err error)

	// GetWebAuthnCredentials retrieves WebAuthn credentials for the user in the backend.
	GetWebAuthnCredentials() (credentials []mfa.PersistentCredential, err error)

	// FinishSetup completes the initialization of the state and logs the incoming request.
	FinishSetup(ctx *gin.Context)

	// SetUsername sets the username for the current authentication state.
	SetUsername(username string)

	// SetPassword sets the password for the current authentication state.
	SetPassword(password secret.Value)

	// SetClientIP sets the client's IP address used during the authentication process.
	SetClientIP(clientIP string)

	// SetClientPort sets the client's port as a string.
	SetClientPort(clientPort string)

	// SetClientHost sets the client host information for the current state using the provided hostname string.
	SetClientHost(clientHost string)

	// SetClientID sets the client ID to the provided string value.
	SetClientID(clientID string)

	// SetStatusCodes sets the current status code associated with the authentication process.
	SetStatusCodes(statusCode string)

	// SetOperationMode sets the operation mode for the authentication process based on the provided gin context.
	SetOperationMode(ctx *gin.Context)

	// SetNoAuth sets the authentication state to no authentication required when true, or requires authentication when false.
	SetNoAuth(bool)

	// SetProtocol sets the authentication protocol to be used during the authentication process.
	SetProtocol(protocol *config.Protocol)

	// GetGUID retrieves the globally unique identifier (GUID) associated with the current authentication state.
	GetGUID() string

	// GetUsername retrieves the username currently stored in the state and returns it as a string.
	GetUsername() string

	// GetPassword retrieves the current password stored in the authentication state.
	GetPassword() secret.Value

	// GetProtocol retrieves the protocol configuration associated with the current state.
	GetProtocol() *config.Protocol

	// FinishLogging logs the authentication result and updates metrics.
	FinishLogging(ctx *gin.Context, result definitions.AuthResult)

	// SetLoginAttempts sets the number of login attempts for the current authentication process.
	SetLoginAttempts(uint)

	// SetMethod sets the authentication method used during the authentication process.
	SetMethod(method string)

	// SetUserAgent sets the user agent information for the current authentication state.
	SetUserAgent(userAgent string)

	// SetLocalIP sets the local IP address for the current state.
	SetLocalIP(localIP string)

	// SetLocalPort sets the local port for the authentication state.
	SetLocalPort(localPort string)

	// SetSSL sets the SSL parameter to the specified value for the authentication process.
	SetSSL(ssl string)

	// SetSSLSessionID sets the SSL session ID associated with the current state for tracking and verification purposes.
	SetSSLSessionID(sslSessionID string)

	// SetSSLClientVerify sets the verification result of the SSL client as a string. Typically used for SSL client validation.
	SetSSLClientVerify(sslClientVerify string)

	// SetSSLClientDN sets the SSL client distinguished name (DN) for the current authentication state.
	SetSSLClientDN(sslClientDN string)

	// SetSSLClientCN sets the Common Name (CN) from the SSL client certificate for the current authentication state.
	SetSSLClientCN(sslClientCN string)

	// SetSSLIssuer sets the SSL issuer string for the current authentication state.
	SetSSLIssuer(sslIssuer string)

	// SetSSLClientNotBefore sets the "not before" validity period for the SSL client certificate.
	SetSSLClientNotBefore(sslClientNotBefore string)

	// SetSSLClientNotAfter sets the expiration date and time of the SSL client certificate.
	SetSSLClientNotAfter(sslClientNotAfter string)

	// SetSSLSubjectDN sets the SSL subject distinguished name (DN) associated with the current authentication state.
	SetSSLSubjectDN(sslSubjectDN string)

	// SetSSLIssuerDN sets the distinguished name (DN) of the SSL issuer for the current state.
	SetSSLIssuerDN(sslIssuerDN string)

	// SetSSLClientSubjectDN sets the distinguished name (DN) of the SSL client certificate's subject.
	SetSSLClientSubjectDN(sslClientSubjectDN string)

	// SetSSLClientIssuerDN sets the distinguished name (DN) of the SSL client issuer to the provided string value.
	SetSSLClientIssuerDN(sslClientIssuerDN string)

	// SetSSLProtocol sets the SSL security protocol for the current authentication session.
	SetSSLProtocol(sslProtocol string)

	// SetSSLCipher sets the SSL cipher used for the client connection.
	SetSSLCipher(sslCipher string)

	// SetSSLSerial sets the SSL serial number for the authentication state.
	SetSSLSerial(sslSerial string)

	// SetSSLFingerprint sets the SSL fingerprint value for the current state.
	SetSSLFingerprint(sslFingerprint string)

	// SetOIDCCID sets the OIDC Client ID for the authentication state.
	SetOIDCCID(oidcCID string)

	// SetSAMLEntityID sets the SAML Entity ID for the authentication state.
	SetSAMLEntityID(samlEntityID string)

	// GetAccountOk returns the account field value and a boolean indicating if the account field is present and valid.
	GetAccountOk() (string, bool)

	// GetUniqueUserIDOk returns the unique user identifier and a boolean indicating its presence.
	GetUniqueUserIDOk() (string, bool)

	// GetDisplayNameOk returns the user display name and a boolean indicating its presence.
	GetDisplayNameOk() (string, bool)

	// GetTOTPSecretOk retrieves the TOTP secret if available and returns it along with a bool indicating its presence.
	GetTOTPSecretOk() (string, bool)

	// GetAccountField retrieves the current account field associated with the authentication process.
	GetAccountField() string

	// GetTOTPSecretField retrieves the TOTP secret field associated with the current authentication state.
	GetTOTPSecretField() string

	// GetTOTPRecoveryField retrieves the TOTP recovery field used during the authentication process.
	GetTOTPRecoveryField() string

	// GetUniqueUserIDField returns the name of the field or attribute that represents a unique user identifier in the database.
	GetUniqueUserIDField() string

	// GetDisplayNameField retrieves the display name field of a user from the current state.
	GetDisplayNameField() string

	// GetUsedPassDBBackend returns the backend used for the password database during the authentication process.
	GetUsedPassDBBackend() definitions.Backend

	// GetUsedPassDBBackendName returns the name of the backend used for the password database during the authentication process.
	GetUsedPassDBBackendName() string

	// GetSourcePassDBBackend returns the source backend used for the password database during the authentication process.
	GetSourcePassDBBackend() definitions.Backend

	// GetAttributes retrieves a map of database attributes where keys are field names and values are the corresponding data.
	GetAttributes() bktype.AttributeMapping

	// GetAttributesCopy returns a deep copy of the attributes map.
	GetAttributesCopy() bktype.AttributeMapping

	// GetAdditionalLogs retrieves a slice of additional log entries, useful for appending context-specific logging details.
	GetAdditionalLogs() []any

	// GetClientIP retrieves the client's IP address associated with the current authentication or request context.
	GetClientIP() string

	// GetLogger returns the injected logger for this state.
	GetLogger() *slog.Logger

	// PreproccessAuthRequest preprocesses the authentication request and determines if it should be rejected.
	PreproccessAuthRequest(ctx *gin.Context) bool

	// UpdateBruteForceBucketsCounter increments counters to track brute-force attack attempts for the associated client IP.
	UpdateBruteForceBucketsCounter(ctx *gin.Context)

	// WithDefaults configures the State with default values derived from the provided gin.Context.
	WithDefaults(ctx *gin.Context) State

	// WithClientInfo adds client-related information from the provided context to the current authentication state and returns it.
	WithClientInfo(ctx *gin.Context) State

	// WithLocalInfo enriches the authentication state with the client's local information based on the provided context.
	WithLocalInfo(ctx *gin.Context) State

	// WithUserAgent updates the State object with information extracted from the request's User-Agent header.
	WithUserAgent(ctx *gin.Context) State

	// WithXSSL sets XSSL-related context for the authentication process and returns the updated State object.
	WithXSSL(ctx *gin.Context) State

	// InitMethodAndUserAgent initializes the authentication method and user agent fields if they are not already set.
	InitMethodAndUserAgent() State

	// IsMasterUser determines if the authenticated user has master-level privileges, returning true if they do.
	IsMasterUser() bool

	// AccountCache returns the AccountCache manager.
	AccountCache() *accountcache.Manager

	// Channel returns the backend channel.
	Channel() backend.Channel

	// PurgeCache invalidates the user authentication cache.
	PurgeCache()

	// PurgeCacheFor invalidates the user authentication cache for a specific username.
	PurgeCacheFor(username string)
	// contains filtered or unexported methods
}

type StateView struct {
	// contains filtered or unexported fields
}

type TLSConfigurator interface {
	Build() *tls.Config // nil if TLS disabled
}

type TOTPRecoveryCodeConsumer interface {
	ConsumeTOTPRecoveryCode(auth *AuthState, code string) (valid bool, remaining int, err error)
}