types

type Credential struct {
	UserID  string
	Secret  string
	Enabled bool
}

type DisableRequest struct {
	Code string `json:"code"`
}

type EnableRequest struct {
	Code string `json:"code"`
}

type EnableResponse struct {
	RecoveryCodes []string `json:"recovery_codes"`
}

type RegenerateRequest struct {
	Code string `json:"code"`
}

type SetupResponse struct {
	Secret string `json:"secret"`
	URL    string `json:"otpauth_url"`
}

type StatusResponse struct {
	Enabled  bool `json:"enabled"`
	Verified bool `json:"verified"`
}

type Store interface {
	// GetCredential returns the user's TOTP credential. Secret is empty when
	// enrollment has not started. Returns a not-found error for unknown users.
	GetCredential(ctx context.Context, userID string) (Credential, error)

	// SetCredential writes the credential. A nil secret clears the stored
	// secret (disable); enabled flips the trusted flag.
	SetCredential(ctx context.Context, userID string, secret *string, enabled bool) error

	// MarkSessionVerified records that sessionID completed second-factor
	// verification for userID at the given time.
	MarkSessionVerified(ctx context.Context, sessionID, userID string, at time.Time) error

	// IsSessionVerified reports whether sessionID was verified after since.
	IsSessionVerified(ctx context.Context, sessionID, userID string, since time.Time) (bool, error)

	// DeleteUserSessionVerifications clears every session verification for a
	// user (used when TOTP is disabled).
	DeleteUserSessionVerifications(ctx context.Context, userID string) error

	// DeleteSessionVerification clears one session's verification.
	DeleteSessionVerification(ctx context.Context, sessionID string) error
}

type VerifyRequest struct {
	Code     string `json:"code"`
	Recovery bool   `json:"recovery"`
}