authlocal

type ClaimRequest struct {
	// CurrentPassword is the bootstrap password the operator received.
	CurrentPassword string
	// NewEmail optionally renames the admin to a personal address.
	NewEmail string
	// NewPassword is the operator's chosen permanent secret.
	NewPassword string
}

type Config struct {
	// Store backs the singleton break-glass record. Required.
	Store Store
	// Sessions mints HS256 session JWTs identical to the OIDC callback path.
	// Required.
	Sessions *authsession.Manager
	// DefaultTenantID is stamped into the session claims for break-glass
	// logins. Defaults to "default".
	DefaultTenantID string
	// BootstrapEmail overrides the default break-glass email
	// ([BreakGlassEmail]) used by [Service.Bootstrap].
	BootstrapEmail string
	// SessionCookieName must match the cookie used by the OIDC flow so a
	// break-glass session is indistinguishable from an OIDC session.
	// Defaults to [authsession.DefaultSessionCookieName].
	SessionCookieName string
	// SessionCookieSecure controls the Secure flag on auth cookies.
	SessionCookieSecure bool
	// ClaimLocked refuses claims even when the record is still in bootstrap
	// state. Used to harden production after the legitimate admin has
	// claimed.
	ClaimLocked bool
	// Now is injectable for tests.
	Now func() time.Time
}

type Handlers struct {
	// contains filtered or unexported fields
}

type HandlersOption func(*Handlers)

type MethodsResponse struct {
	Providers  []ProviderInfo `json:"providers"`
	BreakGlass Status         `json:"breakglass"`
}

type ProviderInfo struct {
	ID    string `json:"id"`
	Kind  string `json:"kind"`
	Label string `json:"label"`
	// AuthURL is the relative URL the frontend should navigate to in order
	// to start an OIDC redirect. Empty for local providers.
	AuthURL string `json:"auth_url,omitempty"`
}

type Record struct {
	// Email is the login identifier. Bootstrap creates it as
	// [BreakGlassEmail] (or [Config.BootstrapEmail]) but Claim() lets the
	// operator rename it.
	Email string
	// PasswordHash is bcrypt(password). Empty means the record has not been
	// initialized yet.
	PasswordHash string
	// ShowPassword carries the plaintext password while the envelope is
	// alive. Empty after Reveal() consumed it or PasswordEnvelopeTTL elapsed.
	ShowPassword string
	// ShowUntil is the envelope expiry. Zero means no pending envelope.
	ShowUntil time.Time
	// Claimed reports whether the operator has rotated the bootstrap secret
	// at least once via Claim(). After claim, Reveal() returns 410.
	Claimed bool
	// CreatedAt and UpdatedAt are auto-stamped by the store.
	CreatedAt time.Time
	UpdatedAt time.Time
}

type RevealResult struct {
	Email     string    `json:"email"`
	Password  string    `json:"password"`
	ExpiresAt time.Time `json:"expires_at"`
	Claimed   bool      `json:"claimed"`
}

type Service struct {
	// contains filtered or unexported fields
}

type Status struct {
	Initialized      bool      `json:"initialized"`
	Claimed          bool      `json:"claimed"`
	Email            string    `json:"email,omitempty"`
	HasPendingReveal bool      `json:"has_pending_reveal"`
	RevealExpiresAt  time.Time `json:"reveal_expires_at,omitempty"`
	Locked           bool      `json:"locked"`
}

type Store interface {
	// Get returns the current record or nil if it has never been written.
	Get(ctx context.Context) (*Record, error)
	// Save creates or replaces the singleton record.
	Save(ctx context.Context, r *Record) error
}