iam

type APIKey struct {
	ID          string     `json:"id"`        // the key's id: APIKeyIdentity(ID), verify Claims.APIKeyID
	LookupID    string     `json:"lookup_id"` // the public lookup id embedded in the token
	GroupID     string     `json:"group_id"`
	Name        string     `json:"name"`
	Role        Role       `json:"role"`
	Permissions []Perm     `json:"permissions"`
	CreatedBy   *string    `json:"created_by"` // nil = issued by the system
	CreatedAt   time.Time  `json:"created_at"`
	LastUsedAt  *time.Time `json:"last_used_at"`
	ExpiresAt   *time.Time `json:"expires_at"`
	RevokedAt   *time.Time `json:"revoked_at"`
}

type APIKeyCreated struct {
	APIKey APIKey `json:"api_key"`
	Secret string `json:"secret"`
}

type AccessTokenOptions struct {
	SessionID string
	TTL       time.Duration // 0 = the configured access-token lifetime
	Claims    map[string]any
}

type AccountSessionRevocation struct {
	// Issuers is the exact issuer scope covered, this deployment's first.
	Issuers []string `json:"issuers"`
	// RevokedSessions counts revoked refresh sessions per covered issuer.
	RevokedSessions map[string]int `json:"revoked_sessions"`
	// RevokedDeviceKeys counts revoked device keys; they are not issuer-bound.
	RevokedDeviceKeys int `json:"revoked_device_keys"`
	// UnlistedIssuerSessions counts live sessions left under issuers outside
	// Issuers; nonzero means the account issuer configuration is incomplete.
	UnlistedIssuerSessions int `json:"unlisted_issuer_sessions"`
}

type AppRef struct {
	// contains filtered or unexported fields
}

type ApplicationTrustRoot string

type Ban struct {
	Reason       string
	Until        *time.Time
	KeepExisting bool
}

type BanState struct {
	At     time.Time  `json:"at" yaml:"at"`
	Until  *time.Time `json:"until" yaml:"until"`
	Reason *string    `json:"reason" yaml:"reason"`
	By     *string    `json:"by" yaml:"by"`
}

type BootstrapManifest struct {
	Users              []BootstrapManifestUser              `json:"users" yaml:"users"`
	RemoteApplications []BootstrapManifestRemoteApplication `json:"remote_applications" yaml:"remote_applications"`
}

type BootstrapManifestRemoteApplication struct {
	Issuer     string                 `json:"issuer" yaml:"issuer"`
	JWKSURI    string                 `json:"jwks_uri" yaml:"jwks_uri"`
	PublicKeys []RemoteApplicationKey `json:"public_keys" yaml:"public_keys"`
	Enabled    *bool                  `json:"enabled" yaml:"enabled"`
	RootRole   Role                   `json:"root_role" yaml:"root_role"`
}

type BootstrapManifestUser struct {
	Username      string `json:"username" yaml:"username"`
	Email         string `json:"email" yaml:"email"`
	Phone         string `json:"phone_number" yaml:"phone_number"`
	EmailVerified bool   `json:"email_verified" yaml:"email_verified"`
	PhoneVerified bool   `json:"phone_verified" yaml:"phone_verified"`
	// Ban bans a new account from now: only Until and Reason may be set.
	Ban *BanState `json:"ban" yaml:"ban"`
	// PublicMetadata is a new account's public metadata (iam.PublicUser).
	PublicMetadata map[string]any         `json:"public_metadata" yaml:"public_metadata"`
	Password       *BootstrapUserPassword `json:"password" yaml:"password"`
	// RootRole is the account's root role (`root:admin`). The root owner role
	// is seeded only while the root group has no usable owner.
	RootRole Role `json:"root_role" yaml:"root_role"`
}

type BootstrapOptions struct {
	// DryRun validates and counts without writing.
	DryRun bool
	// StartupOnly applies the manifest at most once per database schema; leave
	// it false for host or CLI applies.
	StartupOnly bool
	// Name labels the StartupOnly receipt ("" is "default"). Another name does
	// not rerun genesis.
	Name string
}

type BootstrapResult struct {
	DryRun                     bool `json:"dry_run"`
	AlreadyApplied             bool `json:"already_applied"`
	UsersCreated               int  `json:"users_created"`
	UsersMatched               int  `json:"users_matched"`
	PasswordsSet               int  `json:"passwords_set"`
	PasswordsKept              int  `json:"passwords_kept"`
	RootRoleAssignments        int  `json:"root_role_assignments"`
	RemoteApplications         int  `json:"remote_applications"`
	RemoteApplicationRootRoles int  `json:"remote_application_root_roles"`
}

type BootstrapUserPassword struct {
	Plaintext    string `json:"plaintext" yaml:"plaintext"`
	PasswordHash `yaml:",inline"`
	// ResetRequired stores a password that never verifies: the account must
	// reset it.
	ResetRequired bool `json:"reset_required" yaml:"reset_required"`
	// Enforce re-asserts the password on every apply. Without it the password
	// is set only when the account is created, so a rotated password is never
	// reverted. It cannot be combined with ResetRequired.
	Enforce bool `json:"enforce" yaml:"enforce"`
}

type ContactChange struct {
	Field ContactField
	// NewValue is the replacement address as stored.
	NewValue string
}

type ContactField string

type CredentialState struct {
	// contains filtered or unexported fields
}

type DeviceKey struct {
	ID         string            `json:"id"`
	Label      *string           `json:"label"`
	PublicKey  ed25519.PublicKey `json:"public_key"`
	CreatedAt  time.Time         `json:"created_at"`
	LastUsedAt *time.Time        `json:"last_used_at"`
	RevokedAt  *time.Time        `json:"revoked_at"`
	Current    bool              `json:"current"`
}

type DeviceKeyNotice struct {
	Label     string
	CreatedAt time.Time
}

type EmailMessage struct {
	Kind MessageKind
	To   string
	// Username is the account's username, "" when it has none.
	Username string
	// Language is a two-letter code: the account's preferred language, else
	// the request's, else the configured default.
	Language      string
	Code          string
	Link          string
	Purpose       VerificationPurpose
	ContactChange *ContactChange
	DeviceKey     *DeviceKeyNotice
}

type Error interface {
	error
	// Code is the stable snake_case wire code (internal_error for a server
	// failure; empty for a decoded response that is not an AuthKit error).
	Code() string
	// Status is the HTTP status the catalog fixes for the code.
	Status() int
	// Param names the offending request field, when there is one.
	Param() string
	// Metadata is machine-readable context, such as next_rename_at.
	Metadata() map[string]any
}

type ErrorEnvelope struct {
	Error ErrorObject `json:"error"`
}

type ErrorObject struct {
	Type     string         `json:"type"`
	Code     string         `json:"code"`
	Message  string         `json:"message"`
	Param    *string        `json:"param"`
	Metadata map[string]any `json:"metadata"`
}

type Event struct {
	// ID is the same on every delivery: the host's idempotency key.
	ID         string    `json:"id"`
	Kind       EventKind `json:"kind"`
	OccurredAt time.Time `json:"occurred_at"`
	// Who made the change (docs/identity.md): the account whose authority
	// it used (SubjectKind, SubjectID), who acted (InvokerIssuer, InvokerID)
	// and how it was proven (CredentialKind, CredentialID). Your own code
	// is CredentialKind "system" with no subject. All are empty for a change
	// AuthKit made on its own: the end of a recovery window, or a role
	// retired with its grantor's cover.
	SubjectKind    auth.SubjectKind    `json:"subject_kind"`
	SubjectID      string              `json:"subject_id"`
	InvokerIssuer  string              `json:"invoker_issuer"`
	InvokerID      string              `json:"invoker_id"`
	CredentialKind auth.CredentialKind `json:"credential_kind"`
	CredentialID   string              `json:"credential_id"`
	// UserID is the account of a user event and the user subject of a role
	// event.
	UserID string `json:"user_id"`
	// GroupID and Persona name the group of a group or role event.
	GroupID string  `json:"group_id"`
	Persona Persona `json:"persona"`
	// ApplicationID is the remote-application subject of a role event.
	ApplicationID string `json:"application_id"`
	// Previous and Current are the changed value before and after: the
	// email, phone or username, or the role (`channel:moderator`); "" when
	// none.
	Previous string `json:"previous"`
	Current  string `json:"current"`
	// Reason and Until describe a ban; Until is nil for an indefinite one.
	Reason string     `json:"reason"`
	Until  *time.Time `json:"until"`
}

type EventKind string

type Grant interface {
	// contains filtered or unexported methods
}

type Group struct {
	ID        string    `json:"id"`
	Persona   Persona   `json:"persona"`
	CreatedAt time.Time `json:"created_at"`
	// DeletedAt is set on a soft-deleted group.
	DeletedAt *time.Time `json:"deleted_at"`
}

type GroupMember struct {
	Subject Subject     `json:"subject"`
	Role    Role        `json:"role"`
	User    *PublicUser `json:"user"`
}

type GroupQuery struct {
	Persona        Persona
	IncludeDeleted bool
	Ownerless      bool
	Page           PageRequest
}

type GroupRef struct {
	// contains filtered or unexported fields
}

type HashAlgo string

type ImportConflict string

type ImportMatch string

type ImportOptions struct {
	OnConflict ImportConflict
}

type ImportReason string

type ImportResult struct {
	Rows     []ImportRow `json:"rows"`
	Inserted int         `json:"inserted"`
	Skipped  int         `json:"skipped"`
	Merged   int         `json:"merged"`
	Rejected int         `json:"rejected"`
}

type ImportRow struct {
	Index     int          `json:"index"`
	UserID    string       `json:"user_id"`
	MatchedBy ImportMatch  `json:"matched_by"`
	Status    ImportStatus `json:"status"`
	Reason    ImportReason `json:"reason"`
}

type ImportSolanaLink struct {
	UserID          string
	Address         string
	Source          string
	SourceID        string
	SourceCreatedAt *time.Time
}

type ImportSolanaLinkRow struct {
	Index   int          `json:"index"`
	UserID  string       `json:"user_id"`
	Address string       `json:"address"`
	Status  ImportStatus `json:"status"`
	Reason  ImportReason `json:"reason"`
}

type ImportSolanaLinksResult struct {
	Rows     []ImportSolanaLinkRow `json:"rows"`
	Inserted int                   `json:"inserted"`
	Skipped  int                   `json:"skipped"`
	Rejected int                   `json:"rejected"`
}

type ImportStatus string

type ImportUser struct {
	// ID, when set, is the new account's id, or the existing account a Merge
	// updates. It must be a UUID.
	ID string
	// Email and Phone import unverified: another system's "verified" is not
	// proof (someone may have confirmed another person's address there). The
	// account is unproven until it proves one here (a code, at its first
	// sign-in where registration requires verification, or a reset link): it
	// adds no login method or address, and its first proof retires the
	// imported credentials and other addresses. The password survives only a
	// proof by its holder: the code its password sign-in sent, confirmed with
	// that sign-in's password proof, or a session that signed in with it.
	Email    string
	Phone    string
	Username string
	// PasswordHash is validated before it is stored; HashLegacyResetRequired
	// keeps any value and makes the account reset its password.
	PasswordHash *PasswordHash
	// Ban imports a ban as it stood: At is required, By (the banning
	// account) is optional.
	Ban *BanState
	// PublicMetadata is the account's public metadata (iam.PublicUser):
	// anyone may read it, so import only public fields.
	PublicMetadata map[string]any
	CreatedAt      *time.Time
	UpdatedAt      *time.Time
	LastLogin      *time.Time
	// PreferredLanguage is validated as UpdateUser validates it.
	PreferredLanguage string
	// DeletedAt, not in the future, imports the account as the system's
	// DeleteUsers at that time would have left it: the 30-day recovery window
	// runs from DeletedAt (RestoreUsers restores it, signing in does not), and
	// once the window has passed the account is purged after Deps.OnPurge.
	// Such rows need River, as DeleteUsers does.
	DeletedAt *time.Time
	// Providers are external identities the account signs in with, linked as
	// LinkProvider links them, at most one per issuer; Solana wallets import
	// only through ImportSolanaLinks. A row naming an identity another account
	// holds, or an earlier row of the batch names, is rejected with
	// "provider_already_linked".
	Providers []ProviderLink
}

type Invitation struct {
	ID         string     `json:"id"`
	GroupID    string     `json:"group_id"`
	Role       Role       `json:"role"`
	Email      *string    `json:"email"`      // nil = a link, not an email invitation
	CreatedBy  *string    `json:"created_by"` // nil = issued by the system
	CreatedAt  time.Time  `json:"created_at"`
	ExpiresAt  *time.Time `json:"expires_at"`
	RedeemedAt *time.Time `json:"redeemed_at"`
	RevokedAt  *time.Time `json:"revoked_at"`
}

type InvitationCreated struct {
	Invitation Invitation `json:"invitation"`
	Code       string     `json:"code"`
	URL        string     `json:"url"`
}

type JWK struct {
	Kty string `json:"kty"`
	Use string `json:"use,omitempty"`
	Kid string `json:"kid,omitempty"`
	Alg string `json:"alg,omitempty"`
	// RSA
	N string `json:"n,omitempty"`
	E string `json:"e,omitempty"`
	// EC / OKP
	Crv string `json:"crv,omitempty"`
	X   string `json:"x,omitempty"`
	Y   string `json:"y,omitempty"`
}

type ListPage[T any] struct {
	Items []T
	Next  string
	Total *int
}

type MemberQuery struct {
	Kinds     []SubjectKind
	Roles     []Role
	LiveOnly  bool
	WithUsers bool
	Page      PageRequest
}

type Membership struct {
	Group Group `json:"group"`
	Role  Role  `json:"role"`
}

type MessageKind string

type NameAdmissionRequest struct {
	UserID string // Empty only before a new account is created.
	// SubjectID is the account making the change: the user, or staff.
	SubjectID     string
	CurrentName   string
	RequestedName string
	Operation     NameOperation
}

type NameOperation string

type NameResolution struct {
	ID             string     `json:"id"`
	CanonicalName  string     `json:"canonical_name"`
	IsAlias        bool       `json:"is_alias"`
	AliasExpiresAt *time.Time `json:"alias_expires_at,omitempty"`
}

type NewAPIKey struct {
	Name      string
	Role      Role
	ExpiresAt *time.Time
}

type NewGroup struct {
	ID      string
	Persona Persona
	Owner   *Subject
}

type NewInvitation struct {
	Role      Role
	Email     string
	ExpiresAt *time.Time
}

type NewUser struct {
	Email, Phone, Username, Password string
	EmailVerified, PhoneVerified     bool
}

type OAuthAssertion struct {
	// Subject (sub) is the workload as it names itself.
	Subject string
	// ID (jti) redeems once per key.
	ID string
	// IssuedAt (iat) is zero when absent.
	IssuedAt  time.Time
	ExpiresAt time.Time
	// Claims are its claims AuthKit does not define, raw JSON by name; nil
	// when there are none.
	Claims map[string]json.RawMessage
}

type OAuthCapability struct {
	// ID (jti) redeems once per device key: one token per capability.
	ID string
	// IssuedAt (iat) is zero when absent.
	IssuedAt  time.Time
	ExpiresAt time.Time
	// Claims are its claims AuthKit does not define (a run id, say), raw
	// JSON by name; nil when there are none.
	Claims map[string]json.RawMessage
}

type OAuthGrantAuthorizer func(context.Context, OAuthGrantRequest) (OAuthGrantDecision, error)

type OAuthGrantDecision struct {
	// AuthorizationDetails is what the token carries (RFC 9396), in the
	// access token and the token response; nil keeps the capability's. It
	// may only narrow: each entry must equal one of the capability's.
	AuthorizationDetails json.RawMessage
	// MaxLifetime caps the token from the token request; it only shortens
	// the capability's lifetime. 0 adds no cap.
	MaxLifetime time.Duration
	// Claims are added to the access token. Each name must be
	// collision-resistant: an absolute URI ("https://hub.example.com/run").
	Claims map[string]any
	// Invoker names the workload acting for the user (act.sub,
	// verify.Claims.Invoker); empty is the workload key's JWKThumbprint.
	Invoker string
}

type OAuthGrantKind string

type OAuthGrantRequest struct {
	Kind     OAuthGrantKind
	ClientID string
	// UserID is the user the capability is for; DeviceKeyID the live device
	// key that signed it.
	UserID      string
	DeviceKeyID string
	Resource    string
	// AuthorizationDetails is the capability's RFC 9396
	// authorization_details array.
	AuthorizationDetails json.RawMessage
	// JWKThumbprint is the workload key (RFC 7638 thumbprint) that signed
	// Assertion and proved itself with DPoP.
	JWKThumbprint string
	// Assertion and Capability are the grant's, verified.
	Assertion  *OAuthAssertion
	Capability *OAuthCapability
}

type OpResult struct {
	ID  string
	Err error
}

type PageRequest struct {
	Cursor string
	Limit  int
}

type Passkey struct {
	ID                      string     `json:"id"`
	Label                   *string    `json:"label"`
	Transports              []string   `json:"transports"`
	AuthenticatorAttachment *string    `json:"authenticator_attachment"`
	BackupEligible          bool       `json:"backup_eligible"`
	BackupState             bool       `json:"backup_state"`
	CreatedAt               time.Time  `json:"created_at"`
	LastUsedAt              *time.Time `json:"last_used_at"`
}

type PasswordHash struct {
	Hash string   `json:"hash" yaml:"hash"`
	Algo HashAlgo `json:"algo" yaml:"algo"`
}

type Perm struct {
	// contains filtered or unexported fields
}

type Persona struct {
	// contains filtered or unexported fields
}

type ProviderLink struct {
	Issuer   string
	Subject  string
	Provider string
	Email    string
}

type ProvisioningTarget struct {
	Name string `json:"name"`
	// SyncedAt is when the initial sync queued every account; nil until then.
	SyncedAt *time.Time `json:"synced_at"`
	// ReconciledAt is when the target's users were last compared with the
	// accounts.
	ReconciledAt *time.Time `json:"reconciled_at"`
	// LastSuccessAt is when a run last delivered everything it sent.
	LastSuccessAt *time.Time `json:"last_success_at"`
	// FailingSince is when deliveries began failing; nil while none is.
	FailingSince *time.Time `json:"failing_since"`
	LastError    *string    `json:"last_error"`
	// Backlog is how many users wait to be sent, retries included.
	Backlog int `json:"backlog"`
}

type PublicUser struct {
	ID       string `json:"id"`
	Username string `json:"username"`
	// CreatedAt is when the account was created: its "member since".
	CreatedAt *time.Time `json:"created_at"`
	Deleted   bool       `json:"deleted"`
	// PublicMetadata is the JSON object only the host writes
	// (Client.PatchPublicMetadata, ImportUsers) and anyone may read: GET /me,
	// GET /users and every PublicUser carry it whole. It is the place for a
	// profile's public fields (an avatar URL, a biography); keep anything
	// private in your own tables, keyed by the account id.
	PublicMetadata map[string]any `json:"public_metadata"`
}

type RegistrationMode string

type RegistrationVerificationPolicy string

type RemoteApplication struct {
	ID string `json:"id"`
	// GroupID is the controlling group. Registration takes it from the group
	// the application is registered in, never from this field.
	GroupID string `json:"group_id"`
	Issuer  string `json:"issuer"`   // OIDC iss
	JWKSURI string `json:"jwks_uri"` // OIDC jwks_uri (jwks mode only)
	// Mode is the trust source; empty infers static from PublicKeys, else jwks.
	Mode RemoteApplicationMode `json:"mode"`
	// PublicKeys is the static-mode key list (empty in jwks mode).
	PublicKeys []RemoteApplicationKey `json:"public_keys"`
	Enabled    bool                   `json:"enabled"`
	// TrustRoot is what may change the application's keys: the system
	// (manual) or a credentials manager of its controlling group (user).
	// Never the keypair alone.
	TrustRoot   ApplicationTrustRoot `json:"trust_root"`
	Role        Role                 `json:"role"`
	Permissions []Perm               `json:"permissions"`
	CreatedAt   time.Time            `json:"created_at"`
	UpdatedAt   time.Time            `json:"updated_at"`
}

type RemoteApplicationKey struct {
	KID          string `json:"kid,omitempty" yaml:"kid,omitempty"`
	PublicKeyPEM string `json:"public_key_pem" yaml:"public_key_pem"`
	JWK          *JWK   `json:"jwk,omitempty" yaml:"jwk,omitempty"`
}

type RemoteApplicationMode string

type ResolvedAPIKey struct {
	ID          string     `json:"id"`
	LookupID    string     `json:"lookup_id"`
	Group       Group      `json:"group"`
	Issuer      string     `json:"issuer"` // the issuer of the AuthKit deployment holding the key
	Role        Role       `json:"role"`
	Permissions []Perm     `json:"permissions"`
	ExpiresAt   *time.Time `json:"expires_at"`
}

type Role struct {
	// contains filtered or unexported fields
}

type Route struct {
	Method     string
	Path       string
	Group      RouteGroup
	Auth       RouteAuthTier
	Permission string // `<persona>` stands for the group's persona
}

type RouteAuthTier string

type RouteGroup string

type SMSMessage struct {
	Kind MessageKind
	To   string
	// Language is a two-letter code, chosen as for EmailMessage.
	Language      string
	Code          string
	Link          string
	Purpose       VerificationPurpose
	ContactChange *ContactChange
}

type Session struct {
	ID         string     `json:"id"`
	CreatedAt  time.Time  `json:"created_at"`
	LastUsedAt time.Time  `json:"last_used_at"`
	ExpiresAt  *time.Time `json:"expires_at"`
	UserAgent  *string    `json:"user_agent"`
	IP         *string    `json:"ip"`
	Current    bool       `json:"current"`
}

type SessionEvent struct {
	Kind       SessionEventKind `json:"kind"`
	OccurredAt time.Time        `json:"occurred_at"`
	Issuer     string           `json:"issuer"`
	SessionID  *string          `json:"session_id"`
	Method     *string          `json:"method"`
	Reason     *string          `json:"reason"`
	IP         *string          `json:"ip"`
	UserAgent  *string          `json:"user_agent"`
}

type SessionEventKind string

type SessionEventQuery struct {
	Kinds []SessionEventKind
	Page  PageRequest
}

type SessionRef struct {
	SessionID   string
	DeviceKeyID string
}

type SolanaNetwork string

type Subject struct {
	ID   string      `json:"id"`
	Kind SubjectKind `json:"kind"`
}

type SubjectKind string

type Token struct {
	Value     string    `json:"value"`
	ExpiresAt time.Time `json:"expires_at"`
}

type TokenSet struct {
	AccessToken  string  `json:"access_token"`
	TokenType    string  `json:"token_type"`
	ExpiresIn    int64   `json:"expires_in"`
	RefreshToken *string `json:"refresh_token"`
}

type TwoFactorMethod string

type TwoFactorMode string

type User struct {
	ID                string     `json:"id"`
	Email             *string    `json:"email"`
	Phone             *string    `json:"phone_number"`
	Username          string     `json:"username"`
	EmailVerified     bool       `json:"email_verified"`
	PhoneVerified     bool       `json:"phone_verified"`
	PreferredLanguage *string    `json:"preferred_language"`
	CreatedAt         time.Time  `json:"created_at"`
	UpdatedAt         time.Time  `json:"updated_at"`
	LastLogin         *time.Time `json:"last_login"`
	DeletedAt         *time.Time `json:"deleted_at"`
	// Ban is nil when no ban is in force.
	Ban *BanState `json:"ban"`
	// ExpiredBan is the stored ban once its Until has passed and no unban
	// cleared it; nil otherwise. At most one of Ban and ExpiredBan is set.
	ExpiredBan *BanState `json:"expired_ban"`
	// PublicMetadata is the account's public metadata (see PublicUser).
	PublicMetadata map[string]any `json:"public_metadata"`
}

type UserDeletion struct {
	ID        string
	UserID    string
	DeletedAt time.Time
	PurgeAt   time.Time
}

type UserEntry struct {
	User
	RootRole     *Role    `json:"root_role"`
	Entitlements []string `json:"entitlements"`
}

type UserKey string

type UserQuery struct {
	Search           string
	Status           UserStatus
	RootRole         Role
	Entitlement      string
	Sort             UserSort
	Desc             bool
	Total            bool
	WithEntitlements bool
	Page             PageRequest
}

type UserRef struct {
	// contains filtered or unexported fields
}

type UserSort string

type UserStatus string

type UserUpdate struct {
	Email, Phone, Username, PreferredLanguage, Password *string
	EmailVerified, PhoneVerified                        *bool
	PasswordHash                                        *PasswordHash
}

type VerificationPurpose string