idv

type Provider interface {
	// Name returns the provider identifier (e.g., "azure", "stub").
	// It is persisted in IdentityVerificationRecord.Provider so an
	// audit reader can tell which backend issued a session.
	Name() string

	// BeginVerification creates a new verification session.
	BeginVerification(ctx context.Context, req Request) (*Session, error)

	// GetVerification returns the current state of an existing
	// session. Sync providers (Azure Face API) query the upstream
	// service; async providers (Onfido webhooks) return their last
	// known state, which the caller's webhook handler keeps fresh.
	GetVerification(ctx context.Context, providerSessionID string) (*StatusResult, error)
}

type Request struct {
	UserID      string // local user id, used as the provider-side actor
	TenantID    string // local tenant id, for providers that scope by it
	Email       string // optional, for applicant creation
	DisplayName string // optional, for applicant creation
	RedirectURL string // optional, for hosted-flow providers
}

type Session struct {
	ProviderSessionID string    // provider's identifier for the check
	SessionToken      string    // opaque token the client SDK exchanges
	ExpiresAt         time.Time // when SessionToken stops accepting captures
}

type StatusResult struct {
	Status          string    // one of Status* constants
	RejectionReason string    // empty unless Status == StatusRejected
	CompletedAt     time.Time // zero if Status is pending/in_review
}

type StubProvider struct {
	// Verdict controls the StatusResult returned by GetVerification
	// for sessions whose verdict has not been set explicitly. Defaults
	// to StatusApproved so tests of the happy path do not need setup.
	Verdict string

	// Clock returns the current time. Tests may override.
	Clock func() time.Time

	// SessionTTL is the lifetime applied to ExpiresAt. Defaults to 15m.
	SessionTTL time.Duration
	// contains filtered or unexported fields
}