authflow

type AccountRecoveryConfirmation struct {
	Token     string    `json:"token"`
	ExpiresAt time.Time `json:"expires_at"`
	PurgeAt   time.Time `json:"purge_at"`
}

type ActionAvailability = errmodel.ActionAvailability

type Assertion struct {
	JKT        string
	Subject    string
	ID         string
	IssuedAt   time.Time
	ExpiresAt  time.Time
	Claims     map[string]json.RawMessage
	Capability string
}

type AuthSessionEvent struct {
	OccurredAt time.Time
	Issuer     string
	UserID     string
	SessionID  string
	Event      iam.SessionEventKind
	Method     *string
	Reason     *string
	IPAddr     *string
	UserAgent  *string
}

type Capability struct {
	UserID               string
	DeviceKeyID          string
	Audience             string
	JKT                  string
	AuthorizationDetails json.RawMessage
	ID                   string
	IssuedAt             time.Time
	ExpiresAt            time.Time
	Claims               map[string]json.RawMessage
}

type DeviceChallenge struct {
	Challenge   string
	Channel     string
	Destination string
	Channels    []string
}

type DeviceKeyAuthResult struct {
	UserID      string
	AccessToken string
	ExpiresAt   time.Time
	DeviceKey   iam.DeviceKey
}

type DeviceKeyChallenge struct {
	ID        string
	Challenge string
	ExpiresAt time.Time
}

type DeviceKeySecondFactorRequired struct{ Method string }

type DeviceVerificationInput struct {
	UserID    string
	Challenge string
	Code      string
	UserAgent string
	IP        string
}

type ExternalIdentity struct {
	Provider          string // provider slug (the configured name)
	Issuer            string
	Subject           string
	Email             string
	EmailVerified     bool
	PreferredUsername string
	DisplayName       string
}

type ExternalLinkAuthorization struct {
	UserID          string
	SessionID       string
	AuthenticatedAt time.Time
}

type ExternalLoginInput struct {
	Identity ExternalIdentity
	// Link authorizes a provider mutation only; it never creates a session.
	Link               *ExternalLinkAuthorization
	AccountInviteToken string
	// ReturnTo is where the browser flow began; the sign-in's continuations
	// carry it to their AuthResult.
	ReturnTo  string
	Event     string // session-created audit event, e.g. "oidc_login"
	UserAgent string
	IP        string
}

type FactorEnrollmentMode string

type FreshAuth struct {
	LastAuthenticatedAt               *time.Time `json:"last_authenticated_at"`
	StepUpRequiredForSensitiveActions bool       `json:"step_up_required_for_sensitive_actions"`
	StepUpRequiredInSeconds           int64      `json:"step_up_required_in_seconds"`
	AuthMethods                       []string   `json:"auth_methods"`
}

type InviteRedemption struct {
	GroupID string
	Persona iam.Persona
	Role    iam.Role
}

type IssuedSession struct {
	SessionID       string
	RefreshToken    string
	AccessToken     string
	AccessExpiresAt time.Time
}

type LinkedProvider struct {
	Provider string    `json:"provider"`
	Email    *string   `json:"email"`
	LinkedAt time.Time `json:"linked_at"`
}

type LoginChallengeInput struct {
	UserID     string
	Challenge  string
	FactorID   string
	Code       string
	BackupCode bool
	UserAgent  string
	IP         string
}

type LoginOutcome struct {
	Recovery       *AccountRecoveryConfirmation
	Enrollment     *iam.TokenSet
	AllowedMethods []iam.TwoFactorMethod
	ReturnTo       string
	Created        bool
	Kind           LoginOutcomeKind
	UserID         string
	Reason         error
	Session        *IssuedSession
	Verification   *VerificationRequired
	Challenge      *TwoFactorChallenge
	Device         *DeviceChallenge
}

type LoginOutcomeKind string

type MFAContinuationRequiredError struct {
	UserID    string
	SessionID string
	Reason    error
}

type MFAFactor struct {
	ID          string
	UserID      string
	Method      string
	PhoneNumber *string
	// Email is the address an email factor was proven for; its codes go
	// there, never to the account's current address.
	Email        *string
	TOTPSecret   []byte
	LastTOTPStep *int64
	IsDefault    bool
	Enabled      bool
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type MFAStatus struct {
	Enabled        bool
	Satisfied      bool
	AllowedMethods []iam.TwoFactorMethod
}

type OAuthApprover struct {
	UserID      string
	SessionID   string
	DeviceKeyID string
	AuthTime    int64
	AMR         []string
	ACR         string
}

type OAuthAuthorization struct {
	ClientID      string   `json:"client_id"`
	RedirectURI   string   `json:"redirect_uri"`
	State         string   `json:"state,omitempty"`
	Nonce         string   `json:"nonce,omitempty"`
	Scopes        []string `json:"scopes"`
	Resource      string   `json:"resource,omitempty"`
	CodeChallenge string   `json:"code_challenge"`
	Prompt        []string `json:"prompt,omitempty"`
	MaxAge        *int64   `json:"max_age,omitempty"`
	LoginHint     string   `json:"login_hint,omitempty"`
	// DPoPJKT binds the code to a DPoP key (RFC 9449 §10): its redemption
	// must prove that key.
	DPoPJKT string `json:"dpop_jkt,omitempty"`
	// AuthorizationDetails is the request's RFC 9396 authorization_details.
	AuthorizationDetails json.RawMessage `json:"authorization_details,omitempty"`
	CreatedAt            time.Time       `json:"created_at"`
	ExpiresAt            time.Time       `json:"expires_at"`
}

type OAuthClientCredentials struct {
	ClientID             string
	Resource             string
	Scopes               []string
	JKT                  string
	AuthorizationDetails json.RawMessage
}

type OAuthCodeExchange struct {
	ClientID     string
	Code         string
	RedirectURI  string
	CodeVerifier string
	// Resource is the request's resource parameter; "" takes the authorized
	// one.
	Resource string
	// JKT is the thumbprint of the request's DPoP proof key; "" without
	// DPoP. The tokens are bound to it.
	JKT string
}

type OAuthEndSession struct {
	IDTokenHint           string
	ClientID              string
	PostLogoutRedirectURI string
	State                 string
}

type OAuthError struct {
	Code        string
	Description string
	// Status is the HTTP status for a direct (non-redirect) answer; 0 means
	// 400.
	Status int
	// Reason is a stable machine-readable cause beside Code ("reason"),
	// which the jwt-bearer grant sets.
	Reason string
}

type OAuthGrant struct {
	ClientID      string   `json:"client_id"`
	RedirectURI   string   `json:"redirect_uri"`
	CodeChallenge string   `json:"code_challenge"`
	Nonce         string   `json:"nonce,omitempty"`
	Scopes        []string `json:"scopes"`
	Resource      string   `json:"resource,omitempty"`
	UserID        string   `json:"user_id"`
	SessionID     string   `json:"session_id"`
	DeviceKeyID   string   `json:"device_key_id,omitempty"`
	AuthTime      int64    `json:"auth_time"`
	AMR           []string `json:"amr"`
	ACR           string   `json:"acr"`
	DPoPJKT       string   `json:"dpop_jkt,omitempty"`
	// GrantID names the consented grant through its refreshes; Offline
	// grants outlive the sign-in, until the account's credentials change
	// (CredentialVersion). Decision is the host authorizer's at consent (nil
	// without one).
	GrantID           string              `json:"grant_id"`
	ApprovedAt        time.Time           `json:"approved_at"`
	Offline           bool                `json:"offline,omitempty"`
	CredentialVersion int64               `json:"credential_version,omitempty"`
	Decision          *OAuthGrantDecision `json:"decision,omitempty"`
}

type OAuthGrantDecision struct {
	Permissions          []string        `json:"permissions,omitempty"`
	AuthorizationDetails json.RawMessage `json:"authorization_details,omitempty"`
	MaxLifetime          time.Duration   `json:"max_lifetime,omitempty"`
	Claims               map[string]any  `json:"claims,omitempty"`
	Invoker              string          `json:"invoker,omitempty"`
}

type OAuthJWTBearer struct {
	ClientID  string
	Assertion string
	Resource  string
	Scopes    []string
	JKT       string
}

type OAuthRefresh struct {
	ClientID     string
	RefreshToken string
	// Scopes narrows the family's scopes; nil keeps them.
	Scopes   []string
	Resource string
	JKT      string
}

type OAuthTokenExchange struct {
	ClientID           string
	SubjectToken       string
	SubjectTokenType   string
	RequestedTokenType string
	Resource           string
	Scopes             []string
	JKT                string
	// AuthorizationDetails is the request's RFC 9396 authorization_details.
	AuthorizationDetails json.RawMessage
}

type OAuthTokens struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int64  `json:"expires_in"`
	Scope        string `json:"scope,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
	RefreshToken string `json:"refresh_token,omitempty"`
	// IssuedTokenType answers a token exchange (RFC 8693 §2.2.1).
	IssuedTokenType string `json:"issued_token_type,omitempty"`
	// AuthorizationDetails is what the access token was granted (RFC 9396
	// §7.1).
	AuthorizationDetails json.RawMessage `json:"authorization_details,omitempty"`
}

type PasswordLoginInput struct {
	Identifier string
	Password   string
	UserAgent  string
	IP         string
}

type PasswordlessLoginInput struct {
	Identifier string
	Code       string
	Token      string
	UserAgent  string
	IP         string
}

type PasswordlessStartRequest struct {
	Identifier         string
	Mode               string
	ReturnTo           string
	PreferredLanguage  string
	AccountInviteToken string
}

type PasswordlessStartResult struct {
	Sent    bool
	Channel string
	Code    string
	LinkURL string
}

type PendingRegistration struct {
	Email             string
	Username          string
	PasswordHash      string
	PreferredLanguage string
}

type ProfileInput struct {
	UserID          string
	ClaimsUsername  string // fallback when the row carries no username
	AuthTime        time.Time
	StepUpSatisfied bool     // the presented token is fresh enough for sensitive actions
	AuthMethods     []string // the presented token's authentication methods (amr)
}

type RegisterInput struct {
	Identifier         string
	Username           string
	Password           string
	PreferredLanguage  string
	AccountInviteToken string
	UserAgent          string
	IP                 string
}

type RegisterOutcome struct {
	Login    *LoginOutcome
	Kind     RegisterOutcomeKind
	Username string
	Email    *string
	Phone    *string
}

type RegisterOutcomeKind string

type RemovedMFARoleAssignment struct {
	PermissionGroupID string
	Persona           iam.Persona
	Role              iam.Role
	RemovedAt         time.Time
}

type SessionFreshness struct {
	LastAuthenticatedAt           time.Time
	TimeUntilStepUpRequired       time.Duration
	StepUpRequiredForSensitiveOps bool
	AuthMethods                   []string
	// MFAAuthenticatedAt is when the session last proved a second factor.
	MFAAuthenticatedAt time.Time
}

type SessionRevokeReason string

type SignInDevice struct {
	// ID is "cookie:<hash>" for a browser's device cookie, else
	// "ip:<address>" (an IPv6 /64). Empty: unknown, and not limited.
	ID string `json:"id,omitempty"`
	// Issued is the device cookie this response sets ("cookie:<hash>")
	// beside an ip ID: the browser presents it next time.
	Issued string `json:"issued,omitempty"`
}

type SolanaLinkedAccount struct {
	Provider            string     `json:"provider"`
	Issuer              string     `json:"issuer"`
	Address             string     `json:"address"`
	Verified            bool       `json:"verified"`
	VerifiedAt          *time.Time `json:"verified_at"`
	PrimarySNSName      *string    `json:"primary_sns_name"`
	SNSResolutionStatus string     `json:"sns_resolution_status"`
	SNSResolvedAt       *time.Time `json:"sns_resolved_at"`
	SNSStale            bool       `json:"sns_stale"`
	SNSError            *string    `json:"sns_error"`
}

type StepUpCredentials struct {
	Password     bool
	SecondFactor bool // an enabled second factor
	Passkey      bool
	Email, SMS   bool // a proven address a code can reach now
	Solana       bool // a linked wallet
	// Providers are the linked providers that prove a fresh sign-in.
	Providers []string
}

type StepUpRequired struct {
	StepUpMethods []string          `json:"step_up_methods"`
	MaxAgeSeconds int64             `json:"max_age_seconds"`
	Factors       []TwoFactorFactor `json:"factors"`
}

type TwoFactorChallenge struct {
	Method      string
	Destination string // where the code went (email/phone), unmasked
	Challenge   string
	Factor      MFAFactor
	Factors     []MFAFactor
}

type TwoFactorEnrollInput struct {
	LoginChallenge string
	// SessionID is the caller's session; a confirmed code marks it 2FA-verified.
	SessionID   string
	UserAgent   string
	IP          string
	UserID      string
	Mode        FactorEnrollmentMode
	Method      string // "email" | "sms" | "totp"
	Code        string // email/SMS setup code or TOTP code; empty starts the method's setup
	PhoneNumber string
	MakeDefault bool
}

type TwoFactorEnrollKind string

type TwoFactorEnrollOutcome struct {
	Login           *LoginOutcome
	Kind            TwoFactorEnrollKind
	Method          string
	Destination     string
	Secret          string
	OTPAuthURI      string
	Factor          MFAFactor
	BackupCodes     []string
	SessionVerified bool
}

type TwoFactorEnrollmentScope struct {
	Mode       FactorEnrollmentMode
	HasFactors bool
}

type TwoFactorFactor struct {
	ID          string  `json:"id"`
	Method      string  `json:"method"`
	IsDefault   bool    `json:"is_default"`
	Destination *string `json:"destination"`
}

type TwoFactorSettings struct {
	UserID       string
	Enabled      bool
	Method       string // "email", "sms", or "totp"
	PhoneNumber  *string
	TOTPSecret   []byte
	LastTOTPStep *int64
	BackupCodes  []string // Hashed backup codes
	Factors      []MFAFactor
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type TwoFactorStatus struct {
	Enabled              bool                  `json:"enabled"`
	Factors              []TwoFactorFactor     `json:"factors"`
	AllowedMethods       []iam.TwoFactorMethod `json:"allowed_methods"`
	BackupCodesRemaining int                   `json:"backup_codes_remaining"`
}

type UserProfile struct {
	iam.User
	RootRole     *iam.Role            `json:"root_role"`
	Entitlements []string             `json:"entitlements"`
	HasPassword  bool                 `json:"has_password"`
	Providers    []LinkedProvider     `json:"providers"`
	SolanaWallet *SolanaLinkedAccount `json:"solana_wallet"`
	Naming       naming.State         `json:"naming"`
}

type UserSecurity struct {
	FreshAuth
	StepUpMethods []string        `json:"step_up_methods"`
	TwoFactor     TwoFactorStatus `json:"two_factor"`
}

type VerificationInput struct {
	Identifier    string
	Code          string
	Token         string
	PasswordProof string
	UserID        string
	SessionID     string
	UserAgent     string
	IP            string
}

type VerificationRequired struct {
	Identifier    string
	Channel       string // "email" | "phone"
	PasswordProof string
}