authflow

type AccountRecoveryConfirmation struct {
	Token     string    `json:"token"`
	ExpiresAt time.Time `json:"expires_at"`
	PurgeAt   time.Time `json:"purge_at"`
}

type ActionAvailability = errmodel.ActionAvailability

type AuthSessionEvent struct {
	OccurredAt time.Time
	Issuer     string
	UserID     string
	SessionID  string
	Event      iam.SessionEventKind
	Method     *string
	Reason     *string
	IPAddr     *string
	UserAgent  *string
}

type DeviceKeyAuthResult struct {
	UserID      string
	AccessToken string
	ExpiresAt   time.Time
	DeviceKey   iam.DeviceKey
}

type DeviceKeyChallenge struct {
	ID        string
	Challenge string
	ExpiresAt time.Time
}

type DeviceKeySecondFactorRequired struct{ Method string }

type ExternalIdentity struct {
	Provider          string // provider slug (the configured name)
	Issuer            string
	Subject           string
	Email             string
	EmailVerified     bool
	PreferredUsername string
	DisplayName       string
}

type ExternalLinkAuthorization struct {
	UserID          string
	SessionID       string
	AuthenticatedAt time.Time
}

type ExternalLoginInput struct {
	Identity ExternalIdentity
	// Link authorizes a provider mutation only; it never creates a session.
	Link               *ExternalLinkAuthorization
	AccountInviteToken string
	// ReturnTo is where the browser flow began; the sign-in's continuations
	// carry it to their AuthResult.
	ReturnTo  string
	Event     string // session-created audit event, e.g. "oidc_login"
	UserAgent string
	IP        string
}

type FactorEnrollmentMode string

type FreshAuth struct {
	LastAuthenticatedAt               *time.Time `json:"last_authenticated_at"`
	StepUpRequiredForSensitiveActions bool       `json:"step_up_required_for_sensitive_actions"`
	StepUpRequiredInSeconds           int64      `json:"step_up_required_in_seconds"`
	AuthMethods                       []string   `json:"auth_methods"`
}

type InviteRedemption struct {
	GroupID string
	Persona iam.Persona
	Role    iam.Role
}

type IssuedSession struct {
	SessionID       string
	RefreshToken    string
	AccessToken     string
	AccessExpiresAt time.Time
}

type LinkedProvider struct {
	Provider string    `json:"provider"`
	Email    *string   `json:"email"`
	LinkedAt time.Time `json:"linked_at"`
}

type LoginChallengeInput struct {
	UserID     string
	Challenge  string
	FactorID   string
	Code       string
	BackupCode bool
	UserAgent  string
	IP         string
}

type LoginOutcome struct {
	Recovery       *AccountRecoveryConfirmation
	Enrollment     *iam.TokenSet
	AllowedMethods []iam.TwoFactorMethod
	ReturnTo       string
	Created        bool
	Kind           LoginOutcomeKind
	UserID         string
	Reason         error
	Session        *IssuedSession
	Verification   *VerificationRequired
	Challenge      *TwoFactorChallenge
}

type LoginOutcomeKind string

type MFAContinuationRequiredError struct {
	UserID    string
	SessionID string
	Reason    error
}

type MFAStatus struct {
	Enabled        bool
	Satisfied      bool
	AllowedMethods []iam.TwoFactorMethod
}

type PasswordLoginInput struct {
	Identifier string
	Password   string
	UserAgent  string
	IP         string
}

type PasswordlessLoginInput struct {
	Identifier string
	Code       string
	Token      string
	UserAgent  string
	IP         string
}

type PasswordlessStartRequest struct {
	Identifier         string
	Mode               string
	ReturnTo           string
	PreferredLanguage  string
	AccountInviteToken string
}

type PasswordlessStartResult struct {
	Sent    bool
	Channel string
	Code    string
	LinkURL string
}

type PendingRegistration struct {
	Email             string
	Username          string
	PasswordHash      string
	PreferredLanguage string
}

type ProfileInput struct {
	UserID          string
	ClaimsUsername  string // fallback when the row carries no username
	AuthTime        time.Time
	StepUpSatisfied bool     // the presented token is fresh enough for sensitive actions
	AuthMethods     []string // the presented token's authentication methods (amr)
	// ProviderSupportsStepUp reports which linked providers can re-authenticate.
	ProviderSupportsStepUp func(provider string) bool
}

type RegisterInput struct {
	Identifier         string
	Username           string
	Password           string
	PreferredLanguage  string
	AccountInviteToken string
	UserAgent          string
	IP                 string
}

type RegisterOutcome struct {
	Login    *LoginOutcome
	Kind     RegisterOutcomeKind
	Username string
	Email    *string
	Phone    *string
}

type RegisterOutcomeKind string

type RemovedMFARoleAssignment struct {
	PermissionGroupID string
	Persona           iam.Persona
	Role              iam.Role
	RemovedAt         time.Time
}

type SessionFreshness struct {
	LastAuthenticatedAt           time.Time
	TimeUntilStepUpRequired       time.Duration
	StepUpRequiredForSensitiveOps bool
	AuthMethods                   []string
	// MFAAuthenticatedAt is when the session last proved a second factor.
	MFAAuthenticatedAt time.Time
}

type SessionRevokeReason string

type SolanaLinkedAccount struct {
	Provider            string     `json:"provider"`
	Issuer              string     `json:"issuer"`
	Address             string     `json:"address"`
	Verified            bool       `json:"verified"`
	VerifiedAt          *time.Time `json:"verified_at"`
	PrimarySNSName      *string    `json:"primary_sns_name"`
	SNSResolutionStatus string     `json:"sns_resolution_status"`
	SNSResolvedAt       *time.Time `json:"sns_resolved_at"`
	SNSStale            bool       `json:"sns_stale"`
	SNSError            *string    `json:"sns_error"`
}

type StepUpRequired struct {
	StepUpMethods []string                `json:"step_up_methods"`
	MaxAgeSeconds int64                   `json:"max_age_seconds"`
	StepUp2FA     *StepUpTwoFactorOptions `json:"step_up_2fa"`
	MFARequired   bool                    `json:"mfa_required"`
}

type StepUpTwoFactorOption struct {
	Method      string  `json:"method"`
	IsDefault   bool    `json:"is_default"`
	Destination *string `json:"destination"`
}

type StepUpTwoFactorOptions struct {
	Methods       []string                `json:"methods"`
	DefaultMethod string                  `json:"default_method"`
	Options       []StepUpTwoFactorOption `json:"options"`
}

type TwoFactorChallenge struct {
	Method      string
	Destination string // where the code went (email/phone), unmasked
	Challenge   string
	Factor      TwoFactorFactor
	Factors     []TwoFactorFactor
}

type TwoFactorEnrollInput struct {
	LoginChallenge string
	// SessionID is the caller's session; a confirmed code marks it 2FA-verified.
	SessionID   string
	UserAgent   string
	IP          string
	UserID      string
	Mode        FactorEnrollmentMode
	Method      string // "email" | "sms" | "totp"
	Code        string // email/SMS setup code or TOTP code; empty starts the method's setup
	PhoneNumber string
	MakeDefault bool
}

type TwoFactorEnrollKind string

type TwoFactorEnrollOutcome struct {
	Login           *LoginOutcome
	Kind            TwoFactorEnrollKind
	Method          string
	Destination     string
	Secret          string
	OTPAuthURI      string
	Factor          TwoFactorFactor
	BackupCodes     []string
	SessionVerified bool
}

type TwoFactorEnrollmentScope struct {
	Mode       FactorEnrollmentMode
	HasFactors bool
}

type TwoFactorFactor struct {
	ID          string
	UserID      string
	Method      string
	PhoneNumber *string
	// Email is the address an email factor was proven for; its codes go
	// there, never to the account's current address.
	Email        *string
	TOTPSecret   []byte
	LastTOTPStep *int64
	IsDefault    bool
	Enabled      bool
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type TwoFactorSettings struct {
	UserID       string
	Enabled      bool
	Method       string // "email", "sms", or "totp"
	PhoneNumber  *string
	TOTPSecret   []byte
	LastTOTPStep *int64
	BackupCodes  []string // Hashed backup codes
	Factors      []TwoFactorFactor
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type UserProfile struct {
	iam.User
	RootRole     *iam.Role            `json:"root_role"`
	Entitlements []string             `json:"entitlements"`
	HasPassword  bool                 `json:"has_password"`
	Providers    []LinkedProvider     `json:"providers"`
	SolanaWallet *SolanaLinkedAccount `json:"solana_wallet"`
	Naming       naming.State         `json:"naming"`
}

type UserSecurity struct {
	FreshAuth
	StepUpMethods     []string                `json:"step_up_methods"`
	StepUp2FA         *StepUpTwoFactorOptions `json:"step_up_2fa"`
	MFAEnabled        bool                    `json:"mfa_enabled"`
	MFASatisfied      bool                    `json:"mfa_satisfied"`
	MFAAllowedMethods []iam.TwoFactorMethod   `json:"mfa_allowed_methods"`
}

type VerificationInput struct {
	Identifier string
	Code       string
	Token      string
	UserID     string
	SessionID  string
	UserAgent  string
	IP         string
}

type VerificationRequired struct {
	Identifier string
	Channel    string // "email" | "phone"
}