iam

type APIKey struct {
	ID          string     `json:"id"`        // the key's identity: APIKeyActor(ID), verify Claims.APIKeyID
	LookupID    string     `json:"lookup_id"` // the public lookup id embedded in the token
	GroupID     string     `json:"group_id"`
	Name        string     `json:"name"`
	Role        Role       `json:"role"`
	Permissions []Perm     `json:"permissions"`
	CreatedBy   *string    `json:"created_by"` // nil = issued by the system
	CreatedAt   time.Time  `json:"created_at"`
	LastUsedAt  *time.Time `json:"last_used_at"`
	ExpiresAt   *time.Time `json:"expires_at"`
	RevokedAt   *time.Time `json:"revoked_at"`
}

type APIKeyCreated struct {
	APIKey APIKey `json:"api_key"`
	Secret string `json:"secret"`
}

type APIKeyPrincipal struct {
	ID          string     `json:"id"`
	LookupID    string     `json:"lookup_id"`
	Group       Group      `json:"group"`
	Issuer      string     `json:"issuer"` // the issuer of the AuthKit deployment holding the key
	Role        Role       `json:"role"`
	Permissions []Perm     `json:"permissions"`
	ExpiresAt   *time.Time `json:"expires_at"`
}

type AccessTokenOptions struct {
	SessionID string
	TTL       time.Duration // 0 = the configured access-token lifetime
	Claims    map[string]any
}

type AccountSessionRevocation struct {
	// Issuers is the exact issuer scope covered, this deployment's first.
	Issuers []string `json:"issuers"`
	// RevokedSessions counts revoked refresh sessions per covered issuer.
	RevokedSessions map[string]int `json:"revoked_sessions"`
	// RevokedDeviceKeys counts revoked device keys; they are not issuer-bound.
	RevokedDeviceKeys int `json:"revoked_device_keys"`
	// UnlistedIssuerSessions counts live sessions left under issuers outside
	// Issuers; nonzero means the account issuer configuration is incomplete.
	UnlistedIssuerSessions int `json:"unlisted_issuer_sessions"`
}

type Actor struct {
	// contains filtered or unexported fields
}

type ActorKind string

type AppRef struct {
	// contains filtered or unexported fields
}

type ApplicationTrustRoot string

type Ban struct {
	Reason       string
	Until        *time.Time
	KeepExisting bool
}

type BanState struct {
	At     time.Time  `json:"at" yaml:"at"`
	Until  *time.Time `json:"until" yaml:"until"`
	Reason *string    `json:"reason" yaml:"reason"`
	By     *string    `json:"by" yaml:"by"`
}

type BootstrapManifest struct {
	Users              []BootstrapManifestUser              `json:"users" yaml:"users"`
	RemoteApplications []BootstrapManifestRemoteApplication `json:"remote_applications" yaml:"remote_applications"`
}

type BootstrapManifestRemoteApplication struct {
	Issuer     string                 `json:"issuer" yaml:"issuer"`
	JWKSURI    string                 `json:"jwks_uri" yaml:"jwks_uri"`
	PublicKeys []RemoteApplicationKey `json:"public_keys" yaml:"public_keys"`
	Enabled    *bool                  `json:"enabled" yaml:"enabled"`
	RootRole   Role                   `json:"root_role" yaml:"root_role"`
}

type BootstrapManifestUser struct {
	Username      string `json:"username" yaml:"username"`
	Email         string `json:"email" yaml:"email"`
	Phone         string `json:"phone_number" yaml:"phone_number"`
	EmailVerified bool   `json:"email_verified" yaml:"email_verified"`
	PhoneVerified bool   `json:"phone_verified" yaml:"phone_verified"`
	// Ban bans a new account from now: only Until and Reason may be set.
	Ban      *BanState              `json:"ban" yaml:"ban"`
	Metadata map[string]any         `json:"metadata" yaml:"metadata"`
	Password *BootstrapUserPassword `json:"password" yaml:"password"`
	// RootRole is the account's root role (`root:admin`). The root owner role
	// is seeded only while the root group has no usable owner.
	RootRole Role `json:"root_role" yaml:"root_role"`
}

type BootstrapOptions struct {
	// DryRun validates and counts without writing.
	DryRun bool
	// StartupOnly applies the manifest at most once per database schema; leave
	// it false for host or CLI applies.
	StartupOnly bool
	// Name labels the StartupOnly receipt ("" is "default"). Another name does
	// not rerun genesis.
	Name string
}

type BootstrapResult struct {
	DryRun                     bool `json:"dry_run"`
	AlreadyApplied             bool `json:"already_applied"`
	UsersCreated               int  `json:"users_created"`
	UsersMatched               int  `json:"users_matched"`
	PasswordsSet               int  `json:"passwords_set"`
	PasswordsKept              int  `json:"passwords_kept"`
	RootRoleAssignments        int  `json:"root_role_assignments"`
	RemoteApplications         int  `json:"remote_applications"`
	RemoteApplicationRootRoles int  `json:"remote_application_root_roles"`
}

type BootstrapUserPassword struct {
	Plaintext    string `json:"plaintext" yaml:"plaintext"`
	PasswordHash `yaml:",inline"`
	// ResetRequired stores a password that never verifies: the account must
	// reset it.
	ResetRequired bool `json:"reset_required" yaml:"reset_required"`
	// Enforce re-asserts the password on every apply. Without it the password
	// is set only when the account is created, so a rotated password is never
	// reverted. It cannot be combined with ResetRequired.
	Enforce bool `json:"enforce" yaml:"enforce"`
}

type ContactChange struct {
	Field ContactField
	// NewValue is the replacement address as stored.
	NewValue string
}

type ContactField string

type DelegatedAccess struct {
	// Subject becomes delegated_sub. A user actor mints only for itself (empty
	// means the actor); the system must name the subject.
	Subject string
	// Audiences becomes aud: the resource APIs the token is for.
	Audiences []string
	// Permissions becomes the permissions claim. A permission in an AuthKit
	// persona's namespace must be held live by the subject on the root group;
	// the host's own vocabulary is the host's decision.
	Permissions []string
	// Attributes carries app-specific JSON; AuthKit assigns no key a meaning.
	Attributes map[string]any
	// TTL is clamped to the Config.Delegated bounds (default 15m, at most 1h).
	TTL time.Duration
	// JTI becomes jti; empty mints a fresh one.
	JTI       string
	NotBefore time.Time
	// CertificateThumbprint binds the token to an X.509 certificate (RFC 8705
	// cnf.x5t#S256), JWKThumbprint to a DPoP key (RFC 9449 cnf.jkt), each the
	// unpadded base64url SHA-256. At most one; neither mints a bearer token.
	CertificateThumbprint string
	JWKThumbprint         string
}

type DelegatedGrant struct {
	Issuer  string
	Subject string // delegated_sub
	// Permissions are always a ceiling.
	Permissions []Perm
	// RemoteApplicationID is set when the token is bound to an application.
	RemoteApplicationID string
	// GroupID is that application's controlling group.
	GroupID string
}

type DelegationAuthorizer func(context.Context, DelegationRequest) (DelegationGrant, error)

type DelegationGrant struct {
	Permissions []string
	Attributes  map[string]any
}

type DelegationRequest struct {
	UserID    string
	Audiences []string
	TTL       time.Duration
	// DelegateCertificate is the delegate's X.509 leaf (DER) and
	// CertificateThumbprint its x5t#S256; both empty on the DPoP path.
	DelegateCertificate   []byte
	CertificateThumbprint string
	// JWKThumbprint is the DPoP key's jkt; empty on the certificate path.
	JWKThumbprint  string
	RequestedGrant json.RawMessage
}

type DeviceKey struct {
	ID         string            `json:"id"`
	Label      *string           `json:"label"`
	PublicKey  ed25519.PublicKey `json:"public_key"`
	CreatedAt  time.Time         `json:"created_at"`
	LastUsedAt *time.Time        `json:"last_used_at"`
	RevokedAt  *time.Time        `json:"revoked_at"`
	Current    bool              `json:"current"`
}

type DeviceKeyNotice struct {
	Label     string
	CreatedAt time.Time
}

type EmailMessage struct {
	Kind MessageKind
	To   string
	// Username is the account's username, "" when it has none.
	Username string
	// Language is a two-letter code: the account's preferred language, else
	// the request's, else the configured default.
	Language      string
	Code          string
	Link          string
	Purpose       VerificationPurpose
	ContactChange *ContactChange
	DeviceKey     *DeviceKeyNotice
}

type Error interface {
	error
	// Code is the stable snake_case wire code (internal_error for a server
	// failure; empty for a decoded response that is not an AuthKit error).
	Code() string
	// Status is the HTTP status the catalog fixes for the code.
	Status() int
	// Param names the offending request field, when there is one.
	Param() string
	// Metadata is machine-readable context, such as next_rename_at.
	Metadata() map[string]any
}

type ErrorEnvelope struct {
	Error ErrorObject `json:"error"`
}

type ErrorObject struct {
	Type     string         `json:"type"`
	Code     string         `json:"code"`
	Message  string         `json:"message"`
	Param    *string        `json:"param"`
	Metadata map[string]any `json:"metadata"`
}

type Event struct {
	// ID is the same on every delivery: the host's idempotency key.
	ID         string    `json:"id"`
	Kind       EventKind `json:"kind"`
	OccurredAt time.Time `json:"occurred_at"`
	// ActorKind and ActorID name who made the change (ActorID is empty for
	// the system). Both are empty for a change AuthKit made on its own: the
	// end of a recovery window, or a role retired with its grantor's cover.
	ActorKind ActorKind `json:"actor_kind"`
	ActorID   string    `json:"actor_id"`
	// UserID is the account of a user event and the user subject of a role
	// event.
	UserID string `json:"user_id"`
	// GroupID and Persona name the group of a group or role event.
	GroupID string  `json:"group_id"`
	Persona Persona `json:"persona"`
	// ApplicationID is the remote-application subject of a role event.
	ApplicationID string `json:"application_id"`
	// Previous and Current are the changed value before and after: the
	// email, phone or username, or the role (`channel:moderator`); "" when
	// none.
	Previous string `json:"previous"`
	Current  string `json:"current"`
	// Reason and Until describe a ban; Until is nil for an indefinite one.
	Reason string     `json:"reason"`
	Until  *time.Time `json:"until"`
}

type EventKind string

type Grant interface {
	// contains filtered or unexported methods
}

type Group struct {
	ID        string    `json:"id"`
	Persona   Persona   `json:"persona"`
	CreatedAt time.Time `json:"created_at"`
	// DeletedAt is set on a soft-deleted group.
	DeletedAt *time.Time `json:"deleted_at"`
}

type GroupMember struct {
	Subject Subject     `json:"subject"`
	Role    Role        `json:"role"`
	User    *PublicUser `json:"user"`
}

type GroupQuery struct {
	Persona        Persona
	IncludeDeleted bool
	Ownerless      bool
	Page           PageRequest
}

type GroupRef struct {
	// contains filtered or unexported fields
}

type HashAlgo string

type ImportConflict string

type ImportMatch string

type ImportOptions struct {
	OnConflict ImportConflict
}

type ImportReason string

type ImportResult struct {
	Rows     []ImportRow `json:"rows"`
	Inserted int         `json:"inserted"`
	Skipped  int         `json:"skipped"`
	Merged   int         `json:"merged"`
	Rejected int         `json:"rejected"`
}

type ImportRow struct {
	Index     int          `json:"index"`
	UserID    string       `json:"user_id"`
	MatchedBy ImportMatch  `json:"matched_by"`
	Status    ImportStatus `json:"status"`
	Reason    ImportReason `json:"reason"`
}

type ImportSolanaLink struct {
	UserID          string
	Address         string
	Source          string
	SourceID        string
	SourceCreatedAt *time.Time
}

type ImportSolanaLinkRow struct {
	Index   int          `json:"index"`
	UserID  string       `json:"user_id"`
	Address string       `json:"address"`
	Status  ImportStatus `json:"status"`
	Reason  ImportReason `json:"reason"`
}

type ImportSolanaLinksResult struct {
	Rows     []ImportSolanaLinkRow `json:"rows"`
	Inserted int                   `json:"inserted"`
	Skipped  int                   `json:"skipped"`
	Rejected int                   `json:"rejected"`
}

type ImportStatus string

type ImportUser struct {
	// ID, when set, is the new account's id, or the existing account a Merge
	// updates. It must be a UUID.
	ID            string
	Email         string
	Phone         string
	Username      string
	EmailVerified bool
	PhoneVerified bool
	// PasswordHash is validated before it is stored; HashLegacyResetRequired
	// keeps any value and makes the account reset its password.
	PasswordHash *PasswordHash
	// Ban imports a ban as it stood: At is required, By (the banning
	// account) is optional.
	Ban       *BanState
	Metadata  map[string]any
	CreatedAt *time.Time
	UpdatedAt *time.Time
	LastLogin *time.Time
	// PreferredLanguage and AvatarURL are validated as UpdateUser validates them.
	PreferredLanguage string
	AvatarURL         string
	// DeletedAt, not in the future, imports the account as the system's
	// DeleteUsers at that time would have left it: the 30-day recovery window
	// runs from DeletedAt (RestoreUsers restores it, signing in does not), and
	// once the window has passed the account is purged after Deps.OnPurge.
	// Such rows need River, as DeleteUsers does.
	DeletedAt *time.Time
	// Providers are external identities the account signs in with, linked as
	// LinkProvider links them, at most one per issuer; Solana wallets import
	// only through ImportSolanaLinks. A row naming an identity another account
	// holds, or an earlier row of the batch names, is rejected with
	// "provider_already_linked".
	Providers []ProviderLink
}

type Invitation struct {
	ID         string     `json:"id"`
	GroupID    string     `json:"group_id"`
	Role       Role       `json:"role"`
	Email      *string    `json:"email"`      // nil = a link, not an email invitation
	CreatedBy  *string    `json:"created_by"` // nil = issued by the system
	CreatedAt  time.Time  `json:"created_at"`
	ExpiresAt  *time.Time `json:"expires_at"`
	RedeemedAt *time.Time `json:"redeemed_at"`
	RevokedAt  *time.Time `json:"revoked_at"`
}

type InvitationCreated struct {
	Invitation Invitation `json:"invitation"`
	Code       string     `json:"code"`
	URL        string     `json:"url"`
}

type ListPage[T any] struct {
	Items []T
	Next  string
	Total *int
}

type MemberQuery struct {
	Kinds     []SubjectKind
	Roles     []Role
	LiveOnly  bool
	WithUsers bool
	Page      PageRequest
}

type Membership struct {
	Group Group `json:"group"`
	Role  Role  `json:"role"`
}

type MessageKind string

type NameAdmissionRequest struct {
	UserID        string // Empty only before a new account is created.
	ActorID       string
	CurrentName   string
	RequestedName string
	Operation     NameOperation
}

type NameOperation string

type NameResolution struct {
	ID             string     `json:"id"`
	CanonicalName  string     `json:"canonical_name"`
	IsAlias        bool       `json:"is_alias"`
	AliasExpiresAt *time.Time `json:"alias_expires_at,omitempty"`
}

type NewAPIKey struct {
	Name      string
	Role      Role
	ExpiresAt *time.Time
}

type NewGroup struct {
	ID      string
	Persona Persona
	Owner   *Subject
}

type NewInvitation struct {
	Role      Role
	Email     string
	ExpiresAt *time.Time
}

type NewUser struct {
	Email, Phone, Username, Password string
	EmailVerified, PhoneVerified     bool
}

type OpResult struct {
	ID  string
	Err error
}

type PageRequest struct {
	Cursor string
	Limit  int
}

type Passkey struct {
	ID                      string     `json:"id"`
	Label                   *string    `json:"label"`
	Transports              []string   `json:"transports"`
	AuthenticatorAttachment *string    `json:"authenticator_attachment"`
	BackupEligible          bool       `json:"backup_eligible"`
	BackupState             bool       `json:"backup_state"`
	CreatedAt               time.Time  `json:"created_at"`
	LastUsedAt              *time.Time `json:"last_used_at"`
}

type PasswordHash struct {
	Hash string   `json:"hash" yaml:"hash"`
	Algo HashAlgo `json:"algo" yaml:"algo"`
}

type Perm struct {
	// contains filtered or unexported fields
}

type Persona struct {
	// contains filtered or unexported fields
}

type ProviderLink struct {
	Issuer   string
	Subject  string
	Provider string
	Email    string
}

type PublicUser struct {
	ID        string  `json:"id"`
	Username  string  `json:"username"`
	AvatarURL *string `json:"avatar_url"`
	Deleted   bool    `json:"deleted"`
	// Metadata holds the account's metadata keys the host made public
	// (Config.PublicUserMetadata), and no others.
	Metadata map[string]any `json:"metadata"`
}

type RegistrationMode string

type RegistrationVerificationPolicy string

type RemoteApplication struct {
	ID string `json:"id"`
	// GroupID is the controlling group. Registration takes it from the group
	// the application is registered in, never from this field.
	GroupID string `json:"group_id"`
	Issuer  string `json:"issuer"`   // OIDC iss
	JWKSURI string `json:"jwks_uri"` // OIDC jwks_uri (jwks mode only)
	// Mode is the trust source; empty infers static from PublicKeys, else jwks.
	Mode RemoteApplicationMode `json:"mode"`
	// PublicKeys is the static-mode key list (empty in jwks mode).
	PublicKeys []RemoteApplicationKey `json:"public_keys"`
	Enabled    bool                   `json:"enabled"`
	// TrustRoot is what may change the application's keys: the system
	// (manual) or a credentials manager of its controlling group (user).
	// Never the keypair alone.
	TrustRoot   ApplicationTrustRoot `json:"trust_root"`
	Role        Role                 `json:"role"`
	Permissions []Perm               `json:"permissions"`
	CreatedAt   time.Time            `json:"created_at"`
	UpdatedAt   time.Time            `json:"updated_at"`
}

type RemoteApplicationKey struct {
	KID          string `json:"kid,omitempty" yaml:"kid,omitempty"`
	PublicKeyPEM string `json:"public_key_pem" yaml:"public_key_pem"`
}

type RemoteApplicationMode string

type Role struct {
	// contains filtered or unexported fields
}

type Route struct {
	Method     string
	Path       string
	Group      RouteGroup
	Auth       RouteAuthTier
	Permission string // `<persona>` stands for the group's persona
}

type RouteAuthTier string

type RouteGroup string

type SMSMessage struct {
	Kind MessageKind
	To   string
	// Language is a two-letter code, chosen as for EmailMessage.
	Language      string
	Code          string
	Link          string
	Purpose       VerificationPurpose
	ContactChange *ContactChange
}

type ServiceJWT struct {
	Subject     string
	Audiences   []string
	Permissions []string
	// TTL defaults to, and is capped at, DefaultServiceJWTLifetime.
	TTL       time.Duration
	NotBefore time.Time
	IssuedAt  time.Time
	JTI       string
}

type ServiceJWTClaims struct {
	Issuer      string    `json:"issuer"`
	Subject     string    `json:"subject"`
	Audiences   []string  `json:"audiences"`
	IssuedAt    time.Time `json:"issued_at"`
	NotBefore   time.Time `json:"not_before"`
	ExpiresAt   time.Time `json:"expires_at"`
	JTI         string    `json:"jti"`
	TokenUse    string    `json:"token_use"`
	Permissions []string  `json:"permissions"`
}

type Session struct {
	ID         string     `json:"id"`
	CreatedAt  time.Time  `json:"created_at"`
	LastUsedAt time.Time  `json:"last_used_at"`
	ExpiresAt  *time.Time `json:"expires_at"`
	UserAgent  *string    `json:"user_agent"`
	IP         *string    `json:"ip"`
	Current    bool       `json:"current"`
}

type SessionEvent struct {
	Kind       SessionEventKind `json:"kind"`
	OccurredAt time.Time        `json:"occurred_at"`
	Issuer     string           `json:"issuer"`
	SessionID  *string          `json:"session_id"`
	Method     *string          `json:"method"`
	Reason     *string          `json:"reason"`
	IP         *string          `json:"ip"`
	UserAgent  *string          `json:"user_agent"`
}

type SessionEventKind string

type SessionEventQuery struct {
	Kinds []SessionEventKind
	Page  PageRequest
}

type SessionRef struct {
	SessionID   string
	DeviceKeyID string
}

type SolanaNetwork string

type Subject struct {
	ID   string      `json:"id"`
	Kind SubjectKind `json:"kind"`
}

type SubjectKind string

type Token struct {
	Value     string    `json:"value"`
	ExpiresAt time.Time `json:"expires_at"`
}

type TokenSet struct {
	AccessToken  string  `json:"access_token"`
	TokenType    string  `json:"token_type"`
	ExpiresIn    int64   `json:"expires_in"`
	RefreshToken *string `json:"refresh_token"`
}

type TwoFactorMethod string

type TwoFactorMode string

type User struct {
	ID                string     `json:"id"`
	Email             *string    `json:"email"`
	Phone             *string    `json:"phone_number"`
	Username          string     `json:"username"`
	EmailVerified     bool       `json:"email_verified"`
	PhoneVerified     bool       `json:"phone_verified"`
	PreferredLanguage *string    `json:"preferred_language"`
	AvatarURL         *string    `json:"avatar_url"`
	CreatedAt         time.Time  `json:"created_at"`
	UpdatedAt         time.Time  `json:"updated_at"`
	LastLogin         *time.Time `json:"last_login"`
	DeletedAt         *time.Time `json:"deleted_at"`
	// Ban is nil when no ban is in force.
	Ban *BanState `json:"ban"`
}

type UserDeletion struct {
	ID        string
	UserID    string
	DeletedAt time.Time
	PurgeAt   time.Time
}

type UserEntry struct {
	User
	RootRole     *Role    `json:"root_role"`
	Entitlements []string `json:"entitlements"`
}

type UserKey string

type UserQuery struct {
	Search           string
	Status           UserStatus
	RootRole         Role
	Entitlement      string
	Sort             UserSort
	Desc             bool
	Total            bool
	WithEntitlements bool
	Page             PageRequest
}

type UserRef struct {
	// contains filtered or unexported fields
}

type UserSort string

type UserStatus string

type UserUpdate struct {
	Email, Phone, Username, AvatarURL, PreferredLanguage, Password *string
	EmailVerified, PhoneVerified                                   *bool
	PasswordHash                                                   *PasswordHash
}

type VerificationPurpose string