passkey

type BeginLoginOptions struct {
	Options      map[string]any `json:"options"`
	SessionToken string         `json:"sessionToken"`
}

type BeginRegistrationOptions struct {
	Options      map[string]any `json:"options"`
	SessionToken string         `json:"sessionToken"`
}

type CacheSessionStore struct {
	// contains filtered or unexported fields
}

type Credential struct {
	ID                uuid.UUID
	UserID            string
	CredentialID      []byte
	PublicKey         []byte
	AttestationType   string
	AttestationFormat string
	AAGUID            *uuid.UUID
	SignCount         uint32
	Transports        []string
	Name              string
	CreatedAt         time.Time
	LastUsedAt        *time.Time
}

type FinishRegistrationResult struct {
	Credential         Credential
	RecoveryCodes      []string
	RecoveryCodeHashes []string
}

type Logger interface {
	Warn(msg string, args ...any)
}

type PgStore struct {
	// contains filtered or unexported fields
}

type RecoveryCode struct {
	ID        uuid.UUID
	UserID    string
	CodeHash  string
	UsedAt    *time.Time
	CreatedAt time.Time
}

type Service struct {
	// contains filtered or unexported fields
}

type ServiceConfig struct {
	RPID      string
	RPName    string
	RPOrigins []string
	Store     Store
	Users     UserLookup
	Sessions  SessionStore
	Logger    Logger
}

type SessionStore interface {
	SaveChallenge(ctx context.Context, token string, data []byte, ttl time.Duration) error
	// ConsumeChallenge atomically reads and deletes a challenge in a single
	// operation (e.g. Redis GETDEL). This closes the replay window that
	// separate Get+Delete calls would leave open under concurrent requests.
	// Returns (nil, nil) when the token has no stored challenge.
	ConsumeChallenge(ctx context.Context, token string) ([]byte, error)
}

type Store interface {
	// ListCredentials returns every passkey a user has registered. Used both to
	// build the go-webauthn User (WebAuthnCredentials) at login and to surface
	// the credential list in account settings.
	ListCredentials(ctx context.Context, userID string) ([]Credential, error)
	// GetCredentialByCredentialID looks up a credential by its WebAuthn
	// credential id (authenticator-generated, globally unique). Used during
	// login assertion to find the owning user when the authenticator is
	// discoverable.
	GetCredentialByCredentialID(ctx context.Context, credentialID []byte) (*Credential, error)
	// CreateCredential persists a newly-registered credential. Fails on a
	// duplicate credential_id (unique index) — an authenticator cannot be bound
	// to two accounts.
	CreateCredential(ctx context.Context, c *Credential) error
	// CreateCredentialAndRecoveryCodes atomically persists a credential AND
	// its associated recovery-code hashes in a single transaction. Used at
	// passkey enrollment so a partial failure (credential committed, recovery
	// codes lost) cannot leave a passkey-only user with zero recovery codes.
	CreateCredentialAndRecoveryCodes(ctx context.Context, cred *Credential, recoveryCodeHashes []string) error
	// UpdateCredentialAfterLogin records the post-assertion sign count (cloned-
	// authenticator detection) and last-used timestamp.
	UpdateCredentialAfterLogin(ctx context.Context, id uuid.UUID, signCount uint32, lastUsedAt time.Time) error
	// DeleteCredential removes a credential. Refused when it is the user's last
	// one (passkey-only users must keep ≥1 credential or they are locked out).
	DeleteCredential(ctx context.Context, userID string, id uuid.UUID) error
	// CountCredentials returns the number of credentials a user has.
	CountCredentials(ctx context.Context, userID string) (int, error)

	// CreateRecoveryCodes stores a batch of freshly-generated recovery codes
	// (bcrypt-hashed by the caller). Replaces any existing unused codes for the
	// user (re-enrollment invalidates prior codes).
	CreateRecoveryCodes(ctx context.Context, userID string, hashes []string) error
	// ListAvailableRecoveryCodes returns the user's unused recovery-code rows.
	ListAvailableRecoveryCodes(ctx context.Context, userID string) ([]RecoveryCode, error)
	// ConsumeRecoveryCode marks a recovery code used (single-use). Returns
	// ErrRecoveryCodeNotFound when no unused code for the user matches.
	ConsumeRecoveryCode(ctx context.Context, userID string, codeHash string) error
}

type UserLookup interface {
	GetUserByEmail(ctx context.Context, email string) (*types.User, error)
	GetUser(ctx context.Context, userID string) (*types.User, error)
}