identityservice

type Account struct {
	ID string
	// Email identifies the account: the canonical password sign-in email, or
	// the latest one Google reported for a Google account.
	Email  string
	Admin  bool
	Method Method
}

type AccountSummary struct {
	Account
	Disabled  bool
	CreatedAt time.Time
}

type Audience string

type CreatedToken struct {
	Token
	Secret string
}

type GoogleClient interface {
	AuthorizeURL(state, nonce, verifier string) string
	Exchange(ctx context.Context, code, verifier, nonce string) (google.Identity, error)
}

type GoogleFlow struct {
	BindingHash string
	Nonce       string
	Verifier    string
	InviteID    string
	SetupHash   string
	ExpiresAt   time.Time
}

type GoogleStore interface {
	// CreateInvite revokes the email's pending invites in the same transaction;
	// an email linked to an account is ErrConflict.
	CreateInvite(ctx context.Context, invite Invite, tokenHash string) error
	Invites(context.Context) ([]Invite, error)
	Invite(ctx context.Context, id string) (Invite, error)
	RevokeInvite(ctx context.Context, id string, at time.Time) error
	// PendingInvite resolves an unexpired, unused, unrevoked invite by its secret.
	PendingInvite(ctx context.Context, tokenHash string, now time.Time) (Invite, error)
	// AcceptInvite creates the account and its Google identity and uses the
	// pending invite in one transaction. A taken email is ErrConflict; an
	// unavailable invite or an already linked subject is ErrNotFound.
	AcceptInvite(ctx context.Context, inviteID string, account Account, identity google.Identity, now time.Time) error
	// AcceptPasswordInvite creates a password account and uses the pending
	// invite in one transaction, refusing with ErrDisabled unless every setting
	// required is on. A taken email is ErrConflict; an unavailable invite is ErrNotFound.
	AcceptPasswordInvite(ctx context.Context, inviteID string, account Account, passwordHash string, now time.Time, required Settings) error
	// CreateGoogleAccount creates an account and its Google identity without an
	// invite, refusing with ErrDisabled unless every setting required is on. A
	// taken email is ErrConflict; an already linked subject is ErrNotFound.
	CreateGoogleAccount(ctx context.Context, account Account, identity google.Identity, now time.Time, required Settings) error
	// CreateGoogleAdmin consumes the setup secret and creates the first admin
	// with its Google identity in one transaction. A taken email is
	// ErrConflict; a missing, expired or used secret or a linked subject is ErrNotFound.
	CreateGoogleAdmin(ctx context.Context, account Account, identity google.Identity, setupHash string, now time.Time) error
	// PromoteSetupAdmin consumes the setup secret and makes an existing,
	// enabled account the first admin; otherwise it is ErrNotFound.
	PromoteSetupAdmin(ctx context.Context, accountID, setupHash string, now time.Time) error
	// GoogleAccount resolves a linked subject, recording the latest email.
	GoogleAccount(ctx context.Context, identity google.Identity, now time.Time) (account Account, disabled bool, err error)
	PutGoogleFlow(ctx context.Context, stateHash string, flow GoogleFlow) error
	// TakeGoogleFlow consumes an unexpired flow exactly once.
	TakeGoogleFlow(ctx context.Context, stateHash string, now time.Time) (GoogleFlow, error)
}

type Invite struct {
	ID        string
	Email     string
	CreatedAt time.Time
	ExpiresAt time.Time
	UsedAt    *time.Time
	// UsedBy is the email of the account that accepted the invite while it exists.
	UsedBy    string
	RevokedAt *time.Time
}

type InviteStatus string

type Method string

type Option func(*Service)

type PasswordCredential struct {
	Account Account
	Hash    string
}

type Purpose string

type Service struct {
	// contains filtered or unexported fields
}

type Session struct {
	Account   Account
	Secret    string
	CSRFToken string
	ExpiresAt time.Time
}

type Settings struct {
	// Signup lets people create accounts without an invite.
	Signup bool
	// PasswordSignup lets new accounts choose a password, by signup or invite.
	// Existing password accounts always sign in, whatever its value.
	PasswordSignup bool
}

type Store interface {
	// PutAdminSetup replaces the pending setup secret while no admin exists and
	// reports whether it was stored. Setup creates the first admin only.
	PutAdminSetup(context.Context, string, time.Time) (bool, error)
	AdminExists(context.Context) (bool, error)
	// CreateAdmin consumes the unexpired setup secret and creates the admin in
	// one transaction; a missing, expired or used secret is ErrNotFound.
	CreateAdmin(ctx context.Context, account Account, passwordHash, setupHash string, now time.Time) error
	// PendingAdminSetup reports whether the setup secret is unexpired while no admin exists.
	PendingAdminSetup(ctx context.Context, setupHash string, now time.Time) (bool, error)
	// CreateAccount commits a member and its password hash; a taken email
	// is ErrConflict. It reads the settings in its transaction and refuses with
	// ErrDisabled unless every setting required is on.
	CreateAccount(ctx context.Context, account Account, passwordHash string, created time.Time, required Settings) error
	AppSettings(context.Context) (Settings, error)
	// PutAppSettings replaces the settings and notifies every replica at commit.
	PutAppSettings(ctx context.Context, settings Settings, actorID string, at time.Time) error
	AccountSummaries(context.Context) ([]AccountSummary, error)
	// SetAccountDisabled revokes sessions and tokens when disabling. It,
	// DeleteAccount and SetAdmin refuse with ErrLastAdmin when the change would
	// leave no enabled admin, deciding atomically with concurrent changes.
	SetAccountDisabled(ctx context.Context, accountID string, disabled bool, at time.Time) error
	DeleteAccount(context.Context, string) error
	SetAdmin(ctx context.Context, accountID string, admin bool) error
	// AccountPassword resolves an enabled account by its canonical email.
	AccountPassword(context.Context, string) (PasswordCredential, error)
	AccountPasswordByID(context.Context, string) (PasswordCredential, error)
	ReplacePassword(context.Context, string, string, string) error
	// PutPasswordReset replaces the account's pending reset secret.
	PutPasswordReset(ctx context.Context, accountID, tokenHash string, expires time.Time) error
	// PasswordReset resolves an unexpired reset of an enabled account to its credential.
	PasswordReset(ctx context.Context, tokenHash string, now time.Time) (PasswordCredential, error)
	// CompletePasswordReset consumes the unexpired reset, replaces the password
	// fenced on the expected hash and revokes browser sessions in one
	// transaction; API tokens are independent. A missing reset is ErrNotFound.
	CompletePasswordReset(ctx context.Context, tokenHash, expected, replacement string, now time.Time) error
	CreateSession(context.Context, string, string, string, string, time.Time) error
	ResolveSession(context.Context, string, time.Time) (Session, error)
	DeleteSession(context.Context, string) error
	CreateIdentityToken(context.Context, string, Token, string) error
	IdentityTokens(context.Context, string) ([]Token, error)
	DeleteIdentityToken(context.Context, string, string) error
	ResolveIdentityToken(context.Context, string, time.Time) (TokenIdentity, error)
	IdentityAccounts(context.Context) ([]Account, error)
	GoogleStore
}

type Token struct {
	ID         string
	Name       string
	Purpose    Purpose
	CreatedAt  time.Time
	LastUsedAt *time.Time
	ExpiresAt  time.Time
}

type TokenIdentity struct {
	Account   Account
	Purpose   Purpose
	ExpiresAt time.Time
}