challenge

type Address struct {
	Namespace keyspace.Namespace
	Provider  auth.ProviderName
	Model     string
	Purpose   Kind
}

type Backend interface {
	// Issue locks the subject, prepares its binding and replaces the previous token in one
	// transaction without retries.
	Issue(context.Context, Address, model.Identity, Digest, time.Duration, func(context.Context, *database.Tx) (Binding, error)) (Record, error)
	// Consume locks and rechecks a live token, applies the action and removes the token in
	// the same transaction. An absent or expired token is omitted.
	Consume(context.Context, Address, Digest, func(context.Context, *database.Tx, Record) error) (value.Optional[Record], error)
	// Revoke removes the subject's challenge and reports whether one existed.
	Revoke(context.Context, Address, model.Identity) (bool, error)
	// Prune removes up to the supplied limit of expired challenges in the address.
	Prune(context.Context, Address, int) (uint64, error)
}

type Binding struct {
	// contains filtered or unexported fields
}

type Config struct {
	Namespace     keyspace.Namespace
	MaxConcurrent int
	Timeout       time.Duration
}

type Digest struct {
	// contains filtered or unexported fields
}

type EmailVerification struct{}

type Flow[M model.Identifiable, K any, P Purpose] struct {
	// contains filtered or unexported fields
}

type Issued[M any, P Purpose] struct {
	// contains filtered or unexported fields
}

type Issuer[M model.Identifiable, K any, P Purpose] interface {
	// Validate checks that the issuer is configured.
	Validate() error
	// Issue creates a model-bound challenge for the supplied reference.
	Issue(context.Context, model.Reference[M, K]) (Issued[M, P], error)
}

type Kind string

type Model[M model.Identifiable, K any] struct {
	Lock    func(context.Context, *database.Tx, K) (value.Optional[M], error)
	Binding func(M) (Binding, error)
	// Eligible optionally replaces the provider's login eligibility for this
	// flow, for example so email verification works before a provider that
	// requires verified addresses admits the account. Identity checks remain.
	// False rejects like a stale link. Omit it to reuse provider eligibility.
	Eligible func(context.Context, M) (bool, error)
}

type PasswordReset struct{}

type Purpose interface {
	PasswordReset | EmailVerification
}

type Record struct {
	Address   Address
	Subject   model.Identity
	Hash      Digest
	Binding   Binding
	CreatedAt temporal.DateTime
	ExpiresAt temporal.DateTime
}

type RequestCallbacks[M model.Identifiable, K, I any, P Purpose] struct {
	Lookup  func(context.Context, I) (value.Optional[model.Reference[M, K]], error)
	Deliver func(context.Context, Issued[M, P]) error
}

type Requests[M model.Identifiable, K, I any, P Purpose] struct {
	// contains filtered or unexported fields
}

type Revision[M any] = model.ID[RevisionOwner[M]]

type RevisionOwner[M any] struct {
	// contains filtered or unexported fields
}

type Store struct {
	// contains filtered or unexported fields
}

type Token[M any, P Purpose] struct {
	// contains filtered or unexported fields
}