httpapi

type APIKeyCreateRequest struct {
	Name      string     `json:"name"`
	Role      string     `json:"role"`
	ExpiresAt *time.Time `json:"expires_at"`
}

type AdminUserUpdateRequest struct {
	Email             *string `json:"email"`
	PhoneNumber       *string `json:"phone_number"`
	Username          *string `json:"username"`
	AvatarURL         *string `json:"avatar_url"`
	PreferredLanguage *string `json:"preferred_language"`
}

type AuthResult struct {
	Status   AuthStatus    `json:"status"`
	TokenSet *iam.TokenSet `json:"token_set"`
	User     *iam.User     `json:"user"`
	// Created: this sign-in created the account.
	Created  bool    `json:"created"`
	ReturnTo *string `json:"return_to"`
	// FreshAuth: the session's step-up state after a re-authentication.
	FreshAuth *FreshAuth `json:"fresh_auth"`
	// DeviceKey: a device-key sign-in's key.
	DeviceKey    *iam.DeviceKey                        `json:"device_key"`
	SecondFactor *SecondFactorStep                     `json:"second_factor"`
	Enrollment   *EnrollmentStep                       `json:"enrollment"`
	Verification *VerificationStep                     `json:"verification"`
	Recovery     *authflow.AccountRecoveryConfirmation `json:"recovery"`
}

type AuthStatus string

type Availability struct {
	Username    *AvailabilityField `json:"username"`
	Email       *AvailabilityField `json:"email"`
	PhoneNumber *AvailabilityField `json:"phone_number"`
}

type AvailabilityField struct {
	Available bool    `json:"available"`
	Error     *string `json:"error"`
}

type AvailabilityQuery struct {
	Username    string `query:"username"`
	Email       string `query:"email"`
	PhoneNumber string `query:"phone_number"`
}

type Backend interface {
	ops.Operations
	// contains filtered or unexported methods
}

type BackupCodes struct {
	BackupCodes []string `json:"backup_codes"`
}

type BanRequest struct {
	Reason *string    `json:"reason"`
	Until  *time.Time `json:"until"`
}

type Capabilities struct {
	Registration           RegistrationCapabilities `json:"registration"`
	ExternalLoginProviders []ExternalLoginProvider  `json:"external_login_providers"`
	Username               UsernameCapabilities     `json:"username"`
	Password               PasswordCapabilities     `json:"password"`
	Passwordless           PasswordlessCapabilities `json:"passwordless"`
	Passkeys               PasskeyCapabilities      `json:"passkeys"`
	Solana                 SolanaCapabilities       `json:"solana"`
	Verification           VerificationCapabilities `json:"verification"`
	Channels               ChannelCapabilities      `json:"channels"`
	TwoFactor              TwoFactorCapabilities    `json:"two_factor"`
	Languages              []string                 `json:"languages"`
	Paths                  MountPaths               `json:"paths"`
}

type ChannelCapabilities struct {
	Email bool `json:"email"`
	SMS   bool `json:"sms"`
}

type ClientIPFunc func(r *http.Request) string

type CodeOrLinkRequest struct {
	Identifier string `json:"identifier"`
	Code       string `json:"code"`
	Token      string `json:"token"`
}

type CookieVariant struct {
	Kind   cookieKind
	Name   string
	Path   string
	Domain string // AuthKit never sets Domain: every variant is host-only
	Secure bool   // issued on HTTPS deployments (always true for __Host-)
	// Current marks the variant AuthKit issues now, per Secure mode.
	Current bool
}

type DelegatedTokenRequest struct {
	// TTLSeconds is an optional override, clamped into the configured
	// floor/ceiling; absent or <= 0 mints the configured default.
	TTLSeconds int `json:"ttl_seconds"`
	// Audiences is an optional narrowing; every requested audience must be in
	// the configured allowlist. Absent mints the full configured list.
	Audiences []string `json:"audiences"`
	// DelegateCertificateDERB64URL is the delegate's public X.509 leaf as
	// unpadded base64url DER; the token is bound to exactly this certificate.
	// Omitted when a DPoP proof binds the token instead.
	DelegateCertificateDERB64URL string `json:"delegate_certificate_der_b64url"`
	// RequestedGrant is one host-schema JSON object passed to the authorizer
	// verbatim and never copied into the token.
	RequestedGrant json.RawMessage `json:"requested_grant"`
}

type DeviceKeyEnrollBeginRequest struct {
	Email     string `json:"email"`
	PublicKey string `json:"public_key"`
	Label     string `json:"label"`
}

type DeviceKeyEnrollFinishRequest struct {
	EnrollmentID string `json:"enrollment_id"`
	Code         string `json:"code"`
	Signature    string `json:"signature"`
	SecondFactor string `json:"code_2fa"`
}

type DeviceKeyEnrollment struct {
	EnrollmentID string    `json:"enrollment_id"`
	Challenge    string    `json:"challenge"`
	ExpiresAt    time.Time `json:"expires_at"`
}

type DeviceKeyLoginBeginRequest struct {
	DeviceKeyID string `json:"device_key_id"`
}

type DeviceKeyLoginChallenge struct {
	ChallengeID string    `json:"challenge_id"`
	Challenge   string    `json:"challenge"`
	ExpiresAt   time.Time `json:"expires_at"`
}

type DeviceKeyLoginFinishRequest struct {
	ChallengeID string `json:"challenge_id"`
	Signature   string `json:"signature"`
}

type EmailChangeRequest struct {
	Email string `json:"email"`
}

type EnrollmentStep struct {
	TokenSet       iam.TokenSet          `json:"token_set"`
	AllowedMethods []iam.TwoFactorMethod `json:"allowed_methods"`
}

type ExternalLoginProvider struct {
	ID                   string `json:"id"`
	Name                 string `json:"name"`
	SupportsLogin        bool   `json:"supports_login"`
	SupportsRegistration bool   `json:"supports_registration"`
	SupportsLink         bool   `json:"supports_link"`
}

type Feature string

type FreshAuth = authflow.FreshAuth

type GroupOp int

type GroupQuery struct {
	GroupID string `query:"group_id"`
}

type IdentifierPasswordRequest struct {
	Identifier string `json:"identifier"`
	Password   string `json:"password"`
}

type IdentifierRequest struct {
	Identifier string `json:"identifier"`
}

type InvitationCreateRequest struct {
	Role      string     `json:"role"`
	Email     string     `json:"email"`
	ExpiresAt *time.Time `json:"expires_at"`
}

type InvitationRedeemRequest struct {
	Code string `json:"code"`
}

type LabelRequest struct {
	Label string `json:"label"`
}

type MemberListQuery struct {
	PageQuery
	Kind   []string `query:"kind"`
	Role   []string `query:"role"`
	Expand []string `query:"expand"`
}

type MemberRoleRequest struct {
	Role string `json:"role"`
}

type Mount struct {
	// contains filtered or unexported fields
}

type MountPaths struct {
	API  string  `json:"api"`
	OIDC *string `json:"oidc"`
	JWKS *string `json:"jwks"`
}

type OIDCCallbackQuery struct {
	State  string `query:"state"`
	Code   string `query:"code"`
	Error  string `query:"error"`
	Format string `query:"format"`
}

type OIDCExchangeRequest struct {
	Code string `json:"code"`
}

type OIDCLoginQuery struct {
	UI         string `query:"ui"`
	PopupNonce string `query:"popup_nonce"`
	ReturnTo   string `query:"return_to"`
}

type OIDCLoginStartRequest struct {
	ReturnTo   string `json:"return_to"`
	InviteCode string `json:"invite_code"`
	UI         string `json:"ui"`
	PopupNonce string `json:"popup_nonce"`
}

type OIDCStart struct {
	AuthURL string `json:"auth_url"`
	State   string `json:"state"`
}

type PageQuery struct {
	Cursor string `query:"cursor"`
	Limit  *int   `query:"limit"`
}

type PasskeyCapabilities struct {
	Login bool `json:"login"`
}

type PasswordCapabilities struct {
	MinLength        int  `json:"min_length"`
	MaxLength        int  `json:"max_length"`
	RequireUppercase bool `json:"require_uppercase"`
	RequireLowercase bool `json:"require_lowercase"`
	RequireDigit     bool `json:"require_digit"`
	RequireSymbol    bool `json:"require_symbol"`
	AllowCommon      bool `json:"allow_common"`
}

type PasswordChangeRequest struct {
	CurrentPassword string `json:"current_password"`
	NewPassword     string `json:"new_password"`
}

type PasswordLoginRequest struct {
	Identifier string `json:"identifier"` // email, phone number or username
	Password   string `json:"password"`
}

type PasswordRequest struct {
	Password string `json:"password"`
}

type PasswordResetConfirmRequest struct {
	Token       string `json:"token"`
	NewPassword string `json:"new_password"`
}

type PasswordlessCapabilities struct {
	Enabled  bool     `json:"enabled"`
	Channels []string `json:"channels"`
}

type PasswordlessStartRequest struct {
	Identifier        string `json:"identifier"`
	Mode              string `json:"mode"`
	ReturnTo          string `json:"return_to"`
	PreferredLanguage string `json:"preferred_language"`
	InviteCode        string `json:"invite_code"`
}

type PermissionSet struct {
	GroupID     string     `json:"group_id"`
	Role        *iam.Role  `json:"role"`
	Permissions []iam.Perm `json:"permissions"`
}

type PhoneChangeRequest struct {
	PhoneNumber string `json:"phone_number"`
}

type ProfileUpdateRequest struct {
	Username          *string `json:"username"`
	PreferredLanguage *string `json:"preferred_language"`
	AvatarURL         *string `json:"avatar_url"`
}

type ProviderError struct {
	ProviderError string `json:"provider_error"`
}

type RateLimitResult struct {
	Allowed      bool
	RetryAfter   time.Duration
	Availability *authflow.ActionAvailability
}

type RateLimiter interface {
	AllowNamed(bucket string, key string) (bool, error)
}

type RateLimiterWithResult interface {
	AllowNamedResult(bucket string, key string) (ratelimit.Result, error)
}

type RegisterRequest struct {
	Identifier string `json:"identifier"`
	Username   string `json:"username"`
	Password   string `json:"password"`
	InviteCode string `json:"invite_code"`
}

type RegistrationCapabilities struct {
	Mode                string `json:"mode"`
	InviteTokenRequired bool   `json:"invite_token_required"`
}

type Reply struct {
	Status int
	Body   any
}

type ReturnToRequest struct {
	ReturnTo string `json:"return_to"`
}

type RoleInfo struct {
	Name        iam.Role   `json:"name"`
	Permissions []iam.Perm `json:"permissions"`
}

type RouteSpec struct {
	Method  string
	Path    string
	Surface Surface
	Group   iam.RouteGroup
	// Auth is the tier the route enforces before its handler runs.
	Auth iam.RouteAuthTier
	// Perm is the permission the route requires; `<persona>` stands for the
	// addressed group's persona. The route checks it when Auth is
	// AuthPermission; otherwise the operation does.
	Perm string
	// Bucket is the per-IP rate-limit bucket applied in front of the handler
	// ("" = none). Per-identifier and branch-specific buckets stay in the
	// handler.
	Bucket string
	// MountedWhen is the configuration the route needs.
	MountedWhen Feature
	// StepUp: the caller must have signed in recently (a step-up, MFA-fresh
	// when enrolled), checked after the session (M7).
	StepUp bool
	// MFAEnrollmentExempt marks the 2FA enroll/challenge/verify surface a
	// forced-enrollment-gated user must still reach (#243).
	MFAEnrollmentExempt bool
	// Query, Request: the query string and the JSON body (zero values; nil
	// for none). Responses: every success outcome.
	Query     any
	Request   any
	Responses []Reply

	// Handler is the mounted handler, set by APIRoutes and OIDCBrowserRoutes.
	Handler http.Handler
	// contains filtered or unexported fields
}

type SecondFactorStep struct {
	UserID    string            `json:"user_id"`
	Challenge string            `json:"challenge"`
	Factor    TwoFactorFactor   `json:"factor"`
	Factors   []TwoFactorFactor `json:"factors"`
}

type Service struct {
	// contains filtered or unexported fields
}

type SessionEventQuery struct {
	PageQuery
	Kind []string `query:"kind"`
}

type SignInKey struct {
	ID         string        `json:"id"`
	Kind       SignInKeyKind `json:"kind"`
	Label      *string       `json:"label"`
	CreatedAt  time.Time     `json:"created_at"`
	LastUsedAt *time.Time    `json:"last_used_at"`
	Current    bool          `json:"current"`
}

type SignInKeyKind string

type SolanaAccount struct {
	Address   string `json:"address"`
	PublicKey string `json:"publicKey"`
}

type SolanaCapabilities struct {
	Login bool `json:"login"`
}

type SolanaChallenge struct {
	Nonce    string    `json:"nonce"`
	IssuedAt time.Time `json:"issued_at"`
	// Message is the Sign-In-With-Solana text the wallet signs.
	Message string `json:"message"`
}

type SolanaChallengeRequest struct {
	Address  string `json:"address"`
	Username string `json:"username"`
}

type SolanaSignInOutput struct {
	Account       SolanaAccount `json:"account"`
	Signature     string        `json:"signature"`
	SignedMessage string        `json:"signedMessage"`
}

type SolanaSignInRequest struct {
	Output SolanaSignInOutput `json:"output"`
}

type Surface string

type TokenRefreshRequest struct {
	GrantType string `json:"grant_type"`
	// RefreshToken is empty on cookie mounts, where the cookie carries it.
	RefreshToken string `json:"refresh_token"`
}

type TokenRequest struct {
	Token string `json:"token"`
}

type TwoFactorCapabilities struct {
	Mode    iam.TwoFactorMode     `json:"mode"`
	Methods []iam.TwoFactorMethod `json:"methods"`
}

type TwoFactorChallengeRequest struct {
	UserID    string `json:"user_id"`
	Challenge string `json:"challenge"`
	FactorID  string `json:"factor_id"`
}

type TwoFactorFactor struct {
	ID          string  `json:"id"`
	Method      string  `json:"method"`
	IsDefault   bool    `json:"is_default"`
	Destination *string `json:"destination"`
}

type TwoFactorFactorCreateRequest struct {
	Method      string  `json:"method"`
	Code        string  `json:"code"`
	PhoneNumber *string `json:"phone_number"`
	Default     bool    `json:"default"`
}

type TwoFactorFactorCreated struct {
	Factor      TwoFactorFactor `json:"factor"`
	BackupCodes []string        `json:"backup_codes"`
	Auth        *AuthResult     `json:"auth"`
}

type TwoFactorFactorUpdateRequest struct {
	Default bool `json:"default"`
}

type TwoFactorRequired struct {
	Method string `json:"method"`
}

type TwoFactorSendRequest struct {
	Method string `json:"method"`
}

type TwoFactorSetup struct {
	Method      string  `json:"method"`
	Destination *string `json:"destination"`
	Secret      *string `json:"secret"`
	OTPAuthURI  *string `json:"otpauth_uri"`
}

type TwoFactorSetupRequest struct {
	Method      string  `json:"method"`
	PhoneNumber *string `json:"phone_number"`
}

type TwoFactorStatus struct {
	Enabled              bool                  `json:"enabled"`
	Factors              []TwoFactorFactor     `json:"factors"`
	AllowedMethods       []iam.TwoFactorMethod `json:"allowed_methods"`
	BackupCodesRemaining int                   `json:"backup_codes_remaining"`
}

type TwoFactorStepUpRequest struct {
	Code       string `json:"code"`
	Method     string `json:"method"`
	BackupCode bool   `json:"backup_code"`
}

type TwoFactorVerifyRequest struct {
	UserID     string `json:"user_id"`
	Code       string `json:"code"`
	Challenge  string `json:"challenge"`
	FactorID   string `json:"factor_id"`
	BackupCode bool   `json:"backup_code"`
}

type UserListQuery struct {
	PageQuery
	Search      string `query:"search"`
	RootRole    string `query:"root_role"`
	Status      string `query:"status"`
	Sort        string `query:"sort"`
	Order       string `query:"order"`
	Entitlement string `query:"entitlement"`
}

type UserProfile = authflow.UserProfile

type UserSecurity = authflow.UserSecurity

type UsernameCapabilities struct {
	MinLength             int               `json:"min_length"`
	MaxLength             int               `json:"max_length"`
	Pattern               string            `json:"pattern"`
	Renames               bool              `json:"renames"`
	RenameIntervalSeconds int64             `json:"rename_interval_seconds"`
	FormerNames           naming.PolicyInfo `json:"former_names"`
}

type UsersQuery struct {
	IDs      string `query:"ids"`
	Username string `query:"username"`
}

type VerificationCapabilities struct {
	Registration string `json:"registration"`
}

type VerificationStep struct {
	Identifier string `json:"identifier"`
	Channel    string `json:"channel"`
}

type WebAuthnCredential = json.RawMessage

type WireField struct {
	Name string
	Type reflect.Type
	// Optional marks an omitempty member, absent when zero: only protocol
	// documents (JWKS) have them.
	Optional bool
	// Tag is the field's full json tag.
	Tag string
}

type WireKind int