httpapi

type AuthCapabilities struct {
	Registration           AuthRegistrationCapabilities `json:"registration"`
	ExternalLoginProviders []AuthProviderSummary        `json:"external_login_providers"`
	Username               AuthUsernameCapabilities     `json:"username"`
	Password               AuthPasswordCapabilities     `json:"password"`
	Passwordless           AuthPasswordlessCapabilities `json:"passwordless"`
	Passkeys               AuthPasskeyCapabilities      `json:"passkeys"`
	Solana                 AuthSolanaCapabilities       `json:"solana"`
	Verification           AuthVerificationCapabilities `json:"verification"`
	Channels               AuthChannelCapabilities      `json:"channels"`
	Languages              []string                     `json:"languages,omitempty"`
	Paths                  AuthPaths                    `json:"paths"`
}

type AuthChannelCapabilities struct {
	Email bool `json:"email"`
	SMS   bool `json:"sms"`
}

type AuthPasskeyCapabilities struct {
	Login bool `json:"login"`
}

type AuthPasswordCapabilities struct {
	MinLength        int  `json:"min_length"`
	MaxLength        int  `json:"max_length"`
	RequireUppercase bool `json:"require_uppercase"`
	RequireLowercase bool `json:"require_lowercase"`
	RequireDigit     bool `json:"require_digit"`
	RequireSymbol    bool `json:"require_symbol"`
	RejectCommon     bool `json:"reject_common"`
}

type AuthPasswordlessCapabilities struct {
	Enabled  bool     `json:"enabled"`
	Channels []string `json:"channels,omitempty"`
}

type AuthPaths struct {
	API  string `json:"api"`
	OIDC string `json:"oidc,omitempty"`
	JWKS string `json:"jwks,omitempty"`
}

type AuthProviderSummary struct {
	ID                   string `json:"id"`
	Name                 string `json:"name"`
	SupportsLogin        bool   `json:"supports_login"`
	SupportsRegistration bool   `json:"supports_registration"`
	SupportsLink         bool   `json:"supports_link"`
}

type AuthRegistrationCapabilities struct {
	Mode                string `json:"mode"`
	InviteTokenRequired bool   `json:"invite_token_required"`
}

type AuthSolanaCapabilities struct {
	Login bool `json:"login"`
}

type AuthUsernameCapabilities struct {
	MinLength             int               `json:"min_length"`
	MaxLength             int               `json:"max_length"`
	Pattern               string            `json:"pattern"`
	Renames               bool              `json:"renames"`
	RenameIntervalSeconds int64             `json:"rename_interval_seconds"`
	FormerNames           naming.PolicyInfo `json:"former_names"`
}

type AuthVerificationCapabilities struct {
	Registration string `json:"registration"`
}

type Backend interface {
	ops.Operations
	// contains filtered or unexported methods
}

type ClientIPFunc func(r *http.Request) string

type CookieVariant struct {
	Kind   cookieKind
	Name   string
	Path   string
	Domain string // AuthKit never sets Domain: every variant is host-only
	Secure bool   // issued on HTTPS deployments (always true for __Host-)
	// Current marks the variant AuthKit issues now, per Secure mode.
	Current bool
}

type DelegatedTokenResponse struct {
	Token     string    `json:"token"`
	ExpiresAt time.Time `json:"expires_at"`
	TokenType string    `json:"token_type,omitempty"`
}

type GroupOp int

type GroupRoute struct {
	Method string
	Path   string // e.g. /groups/:group_id/members
	Op     GroupOp
}

type Mount struct {
	// contains filtered or unexported fields
}

type RateLimitResult struct {
	Allowed      bool
	RetryAfter   time.Duration
	Availability *authflow.ActionAvailability
}

type RateLimiter interface {
	AllowNamed(bucket string, key string) (bool, error)
}

type RateLimiterWithResult interface {
	AllowNamedResult(bucket string, key string) (ratelimit.Result, error)
}

type RouteSpec struct {
	Method  string
	Path    string
	Group   iam.RouteGroup
	Handler http.Handler
	// Auth is the tier the handler wrapper enforces before the handler runs;
	// Permission names the root/group permission for AuthPermission (#328).
	Auth       iam.RouteAuthTier
	Permission string
	// Bucket is the per-IP rate-limit bucket APIRoutes applies in front of the
	// handler ("" = none). Per-identifier and branch-specific buckets stay in
	// the handler.
	Bucket string
	// MFAEnrollmentExempt marks a route as part of the 2FA enroll/challenge/
	// verify surface a forced-enrollment-gated user (TwoFactor.Mode required)
	// must still be able to reach. NewMount derives the engine's exempt-path
	// allowlist from routes tagged here (#243) — the route table is the single
	// source of truth, so a rename/add stays consistent by construction.
	MFAEnrollmentExempt bool
}

type Service struct {
	// contains filtered or unexported fields
}

type TwoFactorFactorResponse struct {
	ID          string  `json:"id,omitempty"`
	Method      string  `json:"method"`
	IsDefault   bool    `json:"is_default,omitempty"`
	PhoneNumber *string `json:"phone_number,omitempty"`
	// Email is the masked address an email factor's codes go to.
	Email *string `json:"email,omitempty"`
}