service

type Call struct {
	// Op is "checkin:<MessageType>", "connect", "enqueue", "export", or
	// "import".
	Op       string
	Request  *mdm.Request
	Checkin  *mdm.Checkin
	Response *mdm.Response
	Command  *mdm.Command
}

type CertReusePolicy func(ctx context.Context, r *mdm.Request, previous []storage.CertAssociation) error

type CheckinResult struct {
	Body        []byte
	ContentType string
	// Status overrides the HTTP status when non-zero.
	Status int
}

type Code int

type Config struct {
	Store storage.Store
	// Bus receives events; nil disables publishing.
	Bus *event.Bus
	// Clock defaults to the real clock.
	Clock clock.Clock
	Hooks []Hook
	// Logger defaults to slog.Default.
	Logger *slog.Logger
	// Pinning defaults to PinEnforce.
	Pinning PinMode
	// Reenroll defaults to AllowReenroll.
	Reenroll ReenrollPolicy
	// CertReuse defaults to DenyCertReuse. It is consulted when an
	// Authenticate presents a certificate whose hash appears in another
	// enrollment's history and is ignored under PinOff. AllowCertReuse only
	// permits certificates that are in history but not currently pinned: a
	// live pin held by another enrollment still yields ErrCertMismatch with
	// CodeForbidden, because the pin exists to stop a second device using
	// the identity.
	CertReuse CertReusePolicy
	// RequireUserAuth makes a user channel's TokenUpdate depend on a
	// completed UserAuthenticate session (a token issued by DigestUserAuth):
	// without one the TokenUpdate is CodeForbidden (decision record 0029).
	// Shared iPad and User Enrollment user channels are exempt because
	// Apple never sends UserAuthenticate for them.
	RequireUserAuth bool
	// ValidateTargets checks every Enqueue target against the request
	// type's support metadata (channel, Shared iPad, User Enrollment) from
	// schema/commands and reports unsupported targets in
	// EnqueueResult.Skipped instead of queuing them. Default true.
	ValidateTargets *bool
	// Optional message handlers.
	DeclarativeManagement DMHandler
	GetToken              GetTokenHandler
	UserAuthenticate      UserAuthenticateHandler
}

type Core struct {
	// contains filtered or unexported fields
}

type DMHandler func(ctx context.Context, r *mdm.Request, ck *mdm.Checkin, m *checkin.DeclarativeManagement) (DMResponse, error)

type DMResponse struct {
	Body        []byte
	ContentType string
	// Status overrides the HTTP status when non-zero (for example 404 for
	// an unknown declaration).
	Status int
}

type DigestUserAuth struct {
	Store    storage.UserAuthStore
	Verifier UserVerifier
	// Realm defaults to DefaultUserAuthRealm.
	Realm string
	// ChallengeTTL defaults to DefaultUserAuthChallengeTTL.
	ChallengeTTL time.Duration
	// Manage decides whether the user is managed at all. Returning
	// ErrUserNotManaged answers 410 (CodeGone) for this login session; any
	// other error is CodeInternal. Nil manages everyone.
	Manage func(ctx context.Context, r *mdm.Request, m *checkin.UserAuthenticate) error
	// Clock defaults to the real clock.
	Clock clock.Clock
	// Bus receives UserAuthenticated and UserAuthFailed; nil disables it.
	Bus *event.Bus
	// Rand defaults to crypto/rand.
	Rand io.Reader
}

type Error struct {
	Code Code
	Err  error
}

type GetTokenHandler func(ctx context.Context, r *mdm.Request, m *checkin.GetToken) (*checkin.GetTokenResponse, error)

type Hook interface {
	Before(ctx context.Context, c *Call) (context.Context, error)
	After(ctx context.Context, c *Call, err error)
}

type PinMode int

type ReenrollPolicy func(ctx context.Context, r *mdm.Request, existing *storage.Enrollment) error

type UserAuthenticateHandler func(ctx context.Context, r *mdm.Request, m *checkin.UserAuthenticate) (*mdm.UserAuthenticateResponse, error)

type UserVerifier interface {
	Verify(ctx context.Context, r *mdm.Request, in VerifyInput) (bool, error)
}

type UserVerifierFunc func(ctx context.Context, r *mdm.Request, in VerifyInput) (bool, error)

type VerifyInput struct {
	// UserID is the GUID from the UserAuthenticate message.
	UserID string
	// Realm is the realm the challenge was issued for.
	Realm string
	// Challenge is the full DigestChallenge string that was issued.
	Challenge string
	// DigestResponse is the client's Authorization-style parameter list.
	DigestResponse string
}