loginflow

type ClientAuthorization struct {
	LoginHash  []byte     // SHA256(logintoken)
	PollHash   []byte     // SHA256(polltoken)
	ClientID   string     // UUIDv4, surfaced to audit / management API
	UserAgent  string     // raw User-Agent from Init
	CreatedAt  time.Time  // set at Init
	ExpiresAt  time.Time  // PENDING lifetime
	ApprovedAt *time.Time // nil = PENDING; non-nil = APPROVED
	UserID     string     // set on approval, opaque user id
	Username   string     // set on approval, login name for the poll response
	DeviceName string     // set on approval, becomes the app password label
}

type Manager interface {
	// Create inserts a new PENDING authorization.
	Create(ctx context.Context, ca *ClientAuthorization) error
	// GetByLogin returns the authorization for a login hash, including expired
	// ones so the caller can tell "gone" from "unknown". Returns
	// errtypes.NotFound if no live (non-deleted) row exists.
	GetByLogin(ctx context.Context, loginHash []byte) (*ClientAuthorization, error)
	// GetByPoll is GetByLogin keyed by poll hash.
	GetByPoll(ctx context.Context, pollHash []byte) (*ClientAuthorization, error)
	// Approve records the user's consent, once: who granted, and what they named
	// the device. Returns errtypes.Conflict if the authorization was already
	// granted, already denied, or has expired.
	Approve(ctx context.Context, loginHash []byte, userID, username, deviceName string) error
	// Consume hands out an approved authorization once and only once, so two
	// polls can never mint two app passwords from one approval. The winner gets
	// the user to mint for. Returns errtypes.NotFound if the authorization was
	// never approved, is already consumed, or has expired.
	Consume(ctx context.Context, pollHash []byte) (*ClientAuthorization, error)
	// Deny soft-deletes a PENDING authorization. It is a no-op if no PENDING row
	// exists.
	Deny(ctx context.Context, loginHash []byte) error
}