httpapi

type APIKeyCreateRequest struct {
	Name      string     `json:"name"`
	Role      string     `json:"role"`
	ExpiresAt *time.Time `json:"expires_at"`
}

type Availability struct {
	Username    *AvailabilityField `json:"username"`
	Email       *AvailabilityField `json:"email"`
	PhoneNumber *AvailabilityField `json:"phone_number"`
}

type AvailabilityField struct {
	Available bool    `json:"available"`
	Error     *string `json:"error"`
}

type AvailabilityQuery struct {
	Username    string `query:"username"`
	Email       string `query:"email"`
	PhoneNumber string `query:"phone_number"`
}

type Backend interface {
	ops.Operations
	// contains filtered or unexported methods
}

type BackupCodes struct {
	BackupCodes []string `json:"backup_codes"`
}

type BanRequest struct {
	Reason string `json:"reason"`
	// Until is an RFC 3339 time or "infinite".
	Until        *string `json:"until"`
	KeepExisting bool    `json:"keep_existing"`
}

type Capabilities struct {
	Registration           RegistrationCapabilities `json:"registration"`
	ExternalLoginProviders []ExternalLoginProvider  `json:"external_login_providers"`
	Username               UsernameCapabilities     `json:"username"`
	Password               PasswordCapabilities     `json:"password"`
	Passwordless           PasswordlessCapabilities `json:"passwordless"`
	Passkeys               PasskeyCapabilities      `json:"passkeys"`
	Solana                 SolanaCapabilities       `json:"solana"`
	Verification           VerificationCapabilities `json:"verification"`
	Channels               ChannelCapabilities      `json:"channels"`
	TwoFactor              TwoFactorCapabilities    `json:"two_factor"`
	Languages              []string                 `json:"languages"`
	Paths                  MountPaths               `json:"paths"`
}

type ChannelCapabilities struct {
	Email bool `json:"email"`
	SMS   bool `json:"sms"`
}

type ClientIPFunc func(r *http.Request) string

type CodeOrLinkRequest struct {
	Identifier string `json:"identifier"`
	Code       string `json:"code"`
	Token      string `json:"token"`
}

type CookieVariant struct {
	Kind   cookieKind
	Name   string
	Path   string
	Domain string // AuthKit never sets Domain: every variant is host-only
	Secure bool   // issued on HTTPS deployments (always true for __Host-)
	// Current marks the variant AuthKit issues now, per Secure mode.
	Current bool
}

type DelegatedTokenRequest struct {
	// TTLSeconds is an optional override, clamped into the configured
	// floor/ceiling; absent or <= 0 mints the configured default.
	TTLSeconds int `json:"ttl_seconds"`
	// Audiences is an optional narrowing; every requested audience must be in
	// the configured allowlist. Absent mints the full configured list.
	Audiences []string `json:"audiences"`
	// DelegateCertificateDERB64URL is the delegate's public X.509 leaf as
	// unpadded base64url DER; the token is bound to exactly this certificate.
	// Omitted when a DPoP proof binds the token instead.
	DelegateCertificateDERB64URL string `json:"delegate_certificate_der_b64url"`
	// RequestedGrant is one host-schema JSON object passed to the authorizer
	// verbatim and never copied into the token.
	RequestedGrant json.RawMessage `json:"requested_grant"`
}

type DeviceKeyEnrollBeginRequest struct {
	Email     string `json:"email"`
	PublicKey string `json:"public_key"`
	Label     string `json:"label"`
}

type DeviceKeyEnrollFinishRequest struct {
	EnrollmentID string `json:"enrollment_id"`
	Code         string `json:"code"`
	Signature    string `json:"signature"`
	SecondFactor string `json:"code_2fa"`
}

type DeviceKeyEnrollment struct {
	EnrollmentID string    `json:"enrollment_id"`
	Challenge    string    `json:"challenge"`
	ExpiresAt    time.Time `json:"expires_at"`
}

type DeviceKeyLoginBeginRequest struct {
	DeviceKeyID string `json:"device_key_id"`
}

type DeviceKeyLoginChallenge struct {
	ChallengeID string    `json:"challenge_id"`
	Challenge   string    `json:"challenge"`
	ExpiresAt   time.Time `json:"expires_at"`
}

type DeviceKeyLoginFinishRequest struct {
	ChallengeID string `json:"challenge_id"`
	Signature   string `json:"signature"`
}

type DeviceKeySession struct {
	TokenSet  iam.TokenSet  `json:"token_set"`
	DeviceKey iam.DeviceKey `json:"device_key"`
}

type ExternalLoginProvider struct {
	ID                   string `json:"id"`
	Name                 string `json:"name"`
	SupportsLogin        bool   `json:"supports_login"`
	SupportsRegistration bool   `json:"supports_registration"`
	SupportsLink         bool   `json:"supports_link"`
}

type Feature string

type FreshAuth struct {
	StepUpRequiredForSensitiveActions bool       `json:"step_up_required_for_sensitive_actions"`
	TimeUntilStepUpRequired           int64      `json:"time_until_step_up_required"`
	LastAuthenticatedAt               *time.Time `json:"last_authenticated_at"`
	AuthMethods                       []string   `json:"auth_methods"`
}

type GroupOp int

type GroupQuery struct {
	GroupID string `query:"group_id"`
}

type IdentifierPasswordRequest struct {
	Identifier string `json:"identifier"`
	Password   string `json:"password"`
}

type IdentifierRequest struct {
	Identifier string `json:"identifier"`
}

type InvitationCreateRequest struct {
	Role      string     `json:"role"`
	ExpiresAt *time.Time `json:"expires_at"`
}

type InviteRedeemRequest struct {
	Code string `json:"code"`
}

type LabelRequest struct {
	Label string `json:"label"`
}

type MemberAddRequest struct {
	UserID string `json:"user_id"`
	Email  string `json:"email"`
	Role   string `json:"role"`
}

type MemberListQuery struct {
	PageQuery
	Kind []string `query:"kind"`
	Role []string `query:"role"`
}

type Mount struct {
	// contains filtered or unexported fields
}

type MountPaths struct {
	API  string  `json:"api"`
	OIDC *string `json:"oidc"`
	JWKS *string `json:"jwks"`
}

type OIDCCallbackQuery struct {
	State  string `query:"state"`
	Code   string `query:"code"`
	Error  string `query:"error"`
	Format string `query:"format"`
}

type OIDCLoginQuery struct {
	UI         string `query:"ui"`
	PopupNonce string `query:"popup_nonce"`
	ReturnTo   string `query:"return_to"`
}

type OIDCLoginRequest struct {
	ReturnTo           string `json:"return_to"`
	AccountInviteToken string `json:"account_invite_token"`
	UI                 string `json:"ui"`
	PopupNonce         string `json:"popup_nonce"`
}

type OIDCLoginResult struct {
	TokenSet iam.TokenSet `json:"token_set"`
	User     OIDCUser     `json:"user"`
}

type OIDCStart struct {
	AuthURL string `json:"auth_url"`
	State   string `json:"state"`
}

type OIDCStepUpResult struct {
	TokenSet  iam.TokenSet `json:"token_set"`
	FreshAuth FreshAuth    `json:"fresh_auth"`
	Provider  string       `json:"provider"`
}

type OIDCUser struct {
	ID    string  `json:"id"`
	Email *string `json:"email"`
}

type PageQuery struct {
	Cursor string `query:"cursor"`
	Limit  *int   `query:"limit"`
}

type PasskeyCapabilities struct {
	Login bool `json:"login"`
}

type PasswordCapabilities struct {
	MinLength        int  `json:"min_length"`
	MaxLength        int  `json:"max_length"`
	RequireUppercase bool `json:"require_uppercase"`
	RequireLowercase bool `json:"require_lowercase"`
	RequireDigit     bool `json:"require_digit"`
	RequireSymbol    bool `json:"require_symbol"`
	AllowCommon      bool `json:"allow_common"`
}

type PasswordChangeRequest struct {
	CurrentPassword string `json:"current_password"`
	NewPassword     string `json:"new_password"`
}

type PasswordLoginRequest struct {
	Identifier string `json:"identifier"` // email, phone number or username
	Password   string `json:"password"`
}

type PasswordRequest struct {
	Password string `json:"password"`
}

type PasswordResetConfirmRequest struct {
	Token       string `json:"token"`
	NewPassword string `json:"new_password"`
}

type PasswordlessCapabilities struct {
	Enabled  bool     `json:"enabled"`
	Channels []string `json:"channels"`
}

type PasswordlessResult struct {
	TokenSet iam.TokenSet `json:"token_set"`
	ReturnTo *string      `json:"return_to"`
}

type PasswordlessStartRequest struct {
	Identifier         string `json:"identifier"`
	Mode               string `json:"mode"`
	ReturnTo           string `json:"return_to"`
	PreferredLanguage  string `json:"preferred_language"`
	AccountInviteToken string `json:"account_invite_token"`
}

type PermissionSet struct {
	GroupID     string     `json:"group_id"`
	Permissions []iam.Perm `json:"permissions"`
}

type PreferredLanguage struct {
	PreferredLanguage string `json:"preferred_language"`
}

type PreferredLanguageRequest struct {
	PreferredLanguage string `json:"preferred_language"`
}

type RateLimitResult struct {
	Allowed      bool
	RetryAfter   time.Duration
	Availability *authflow.ActionAvailability
}

type RateLimiter interface {
	AllowNamed(bucket string, key string) (bool, error)
}

type RateLimiterWithResult interface {
	AllowNamedResult(bucket string, key string) (ratelimit.Result, error)
}

type RegisterRequest struct {
	Identifier         string `json:"identifier"`
	Username           string `json:"username"`
	Password           string `json:"password"`
	AccountInviteToken string `json:"account_invite_token"`
}

type RegistrationCapabilities struct {
	Mode                string `json:"mode"`
	InviteTokenRequired bool   `json:"invite_token_required"`
}

type RegistrationResult struct {
	User     RegistrationUser `json:"user"`
	TokenSet iam.TokenSet     `json:"token_set"`
}

type RegistrationUser struct {
	Username    string  `json:"username"`
	Email       *string `json:"email"`
	PhoneNumber *string `json:"phone_number"`
}

type RemovedRole struct {
	GroupID   string      `json:"group_id"`
	Persona   iam.Persona `json:"persona"`
	Role      iam.Role    `json:"role"`
	RemovedAt time.Time   `json:"removed_at"`
}

type RemovedRoles struct {
	RemovedRoles []RemovedRole `json:"removed_roles"`
}

type Reply struct {
	Status int
	Body   any
}

type ReturnToRequest struct {
	ReturnTo string `json:"return_to"`
}

type RoleInfo struct {
	Name        iam.Role `json:"name"`
	Permissions []string `json:"permissions"`
}

type RouteSpec struct {
	Method  string
	Path    string
	Surface Surface
	Group   iam.RouteGroup
	// Auth is the tier the route enforces before its handler runs.
	Auth iam.RouteAuthTier
	// Perm is the permission the route requires; `<persona>` stands for the
	// addressed group's persona. The route checks it when Auth is
	// AuthPermission; otherwise the operation does.
	Perm string
	// Bucket is the per-IP rate-limit bucket applied in front of the handler
	// ("" = none). Per-identifier and branch-specific buckets stay in the
	// handler.
	Bucket string
	// MountedWhen is the configuration the route needs.
	MountedWhen Feature
	// MFAEnrollmentExempt marks the 2FA enroll/challenge/verify surface a
	// forced-enrollment-gated user must still reach (#243).
	MFAEnrollmentExempt bool
	// Query, Request: the query string and the JSON body (zero values; nil
	// for none). Responses: every success outcome.
	Query     any
	Request   any
	Responses []Reply

	// Handler is the mounted handler, set by APIRoutes and OIDCBrowserRoutes.
	Handler http.Handler
	// contains filtered or unexported fields
}

type Service struct {
	// contains filtered or unexported fields
}

type SolanaAccount struct {
	Address   string `json:"address"`
	PublicKey string `json:"publicKey"`
}

type SolanaCapabilities struct {
	Login bool `json:"login"`
}

type SolanaChallenge struct {
	Nonce    string    `json:"nonce"`
	IssuedAt time.Time `json:"issued_at"`
	// Message is the Sign-In-With-Solana text the wallet signs.
	Message string `json:"message"`
}

type SolanaChallengeRequest struct {
	Address  string `json:"address"`
	Username string `json:"username"`
}

type SolanaLink struct {
	SolanaAddress string `json:"solana_address"`
}

type SolanaLoginResult struct {
	TokenSet iam.TokenSet `json:"token_set"`
	Created  bool         `json:"created"`
	User     SolanaUser   `json:"user"`
}

type SolanaSignInOutput struct {
	Account       SolanaAccount `json:"account"`
	Signature     string        `json:"signature"`
	SignedMessage string        `json:"signedMessage"`
}

type SolanaSignInRequest struct {
	Output SolanaSignInOutput `json:"output"`
}

type SolanaUser struct {
	ID            string `json:"id"`
	SolanaAddress string `json:"solana_address"`
}

type StepUpResult struct {
	TokenSet  iam.TokenSet `json:"token_set"`
	FreshAuth FreshAuth    `json:"fresh_auth"`
}

type Surface string

type TokenRefreshRequest struct {
	GrantType string `json:"grant_type"`
	// RefreshToken is empty on cookie mounts, where the cookie carries it.
	RefreshToken string `json:"refresh_token"`
}

type TokenRequest struct {
	Token string `json:"token"`
}

type TwoFactorCapabilities struct {
	Mode    iam.TwoFactorMode     `json:"mode"`
	Methods []iam.TwoFactorMethod `json:"methods"`
}

type TwoFactorChallengeRequest struct {
	UserID    string `json:"user_id"`
	Challenge string `json:"challenge"`
	FactorID  string `json:"factor_id"`
}

type TwoFactorEnrollRequest struct {
	Method      string  `json:"method"`
	Code        string  `json:"code"`
	PhoneNumber *string `json:"phone_number"`
	Default     bool    `json:"default"`
	FactorID    string  `json:"factor_id"`
}

type TwoFactorEnrollResult struct {
	Method      string        `json:"method"`
	Enabled     bool          `json:"enabled"`
	Secret      *string       `json:"secret"`
	OTPAuthURI  *string       `json:"otpauth_uri"`
	BackupCodes []string      `json:"backup_codes"`
	TokenSet    *iam.TokenSet `json:"token_set"`
	FreshAuth   *FreshAuth    `json:"fresh_auth"`
}

type TwoFactorFactor struct {
	ID          string  `json:"id"`
	Method      string  `json:"method"`
	IsDefault   bool    `json:"is_default"`
	PhoneNumber *string `json:"phone_number"`
	// Email is the masked address an email factor's codes go to.
	Email *string `json:"email"`
}

type TwoFactorFactorQuery struct {
	FactorID string `query:"factor_id"`
}

type TwoFactorStatus struct {
	Enabled              bool              `json:"enabled"`
	Method               string            `json:"method"`
	PhoneNumber          *string           `json:"phone_number"`
	DefaultFactor        *TwoFactorFactor  `json:"default_factor"`
	Factors              []TwoFactorFactor `json:"factors"`
	AllowedMethods       []string          `json:"allowed_methods"`
	BackupCodesRemaining int               `json:"backup_codes_remaining"`
}

type TwoFactorStepUpRequest struct {
	Code       string `json:"code"`
	Method     string `json:"method"`
	FactorID   string `json:"factor_id"`
	BackupCode bool   `json:"backup_code"`
}

type TwoFactorVerifyRequest struct {
	UserID     string `json:"user_id"`
	Code       string `json:"code"`
	Challenge  string `json:"challenge"`
	FactorID   string `json:"factor_id"`
	BackupCode bool   `json:"backup_code"`
}

type UserListQuery struct {
	PageQuery
	Search      string `query:"search"`
	RootRole    string `query:"root_role"`
	Status      string `query:"status"`
	Sort        string `query:"sort"`
	Order       string `query:"order"`
	Entitlement string `query:"entitlement"`
}

type UserProfile = authflow.UserProfile

type UsernameCapabilities struct {
	MinLength             int               `json:"min_length"`
	MaxLength             int               `json:"max_length"`
	Pattern               string            `json:"pattern"`
	Renames               bool              `json:"renames"`
	RenameIntervalSeconds int64             `json:"rename_interval_seconds"`
	FormerNames           naming.PolicyInfo `json:"former_names"`
}

type UsernameChange struct {
	Username string       `json:"username"`
	Naming   naming.State `json:"naming"`
}

type UsernameRequest struct {
	Username string `json:"username"`
}

type VerificationCapabilities struct {
	Registration string `json:"registration"`
}

type WebAuthnCredential = json.RawMessage

type WireField struct {
	Name string
	Type reflect.Type
	// Optional marks an omitempty member, absent when zero: only protocol
	// documents (JWKS) have them.
	Optional bool
	// Tag is the field's full json tag.
	Tag string
}

type WireKind int