token

type Address struct {
	Namespace keyspace.Namespace
	Guard     auth.GuardName
	Provider  auth.ProviderName
	Model     string
}

type Backend interface {
	// Create atomically creates a token under the subject's capacity policy.
	Create(context.Context, Address, Creation) (Record, error)
	// Lookup resolves a live token by digest, optionally recording activity.
	Lookup(context.Context, Address, Digest, bool) (value.Optional[Record], error)
	// Refresh atomically consumes a refresh generation and creates its successor; reuse
	// revokes the family and returns omission.
	Refresh(context.Context, Address, Digest, Digest, Digest) (value.Optional[Record], error)
	// Revoke removes the token family identified by its credential digest and reports
	// whether it existed.
	Revoke(context.Context, Address, Digest) (bool, error)
	// RevokeID removes the subject's identified token family and reports whether it
	// existed.
	RevokeID(context.Context, Address, model.Identity, model.ID[Record]) (bool, error)
	// RevokeAll removes all of the subject's token families, serializing with creation.
	RevokeAll(context.Context, Address, model.Identity) (uint64, error)
	// List returns a bounded page of the subject's token records.
	List(context.Context, Address, model.Identity, int) ([]Record, error)
	// Prune removes a bounded batch of expired token families.
	Prune(context.Context, Address, int) (uint64, error)
}

type CheckedBackend interface {
	// CreateChecked runs the proof check before credential locks and creates the token in
	// the same transaction.
	CreateChecked(context.Context, Address, Creation, func(context.Context, *database.Tx) error) (Record, error)
}

type CompletionBackend interface {
	CheckedBackend
	// ConsumePendingIn locks, revalidates and provisionally deletes the exact pending-MFA
	// credential in the caller's transaction.
	ConsumePendingIn(context.Context, *database.Tx, Address, Record) error
	// CreateBefore performs checked creation and rechecks the pending deadline before
	// commit, rolling back joined writes on expiry.
	CreateBefore(context.Context, Address, Creation, temporal.DateTime, func(context.Context, *database.Tx) error) (Record, error)
}

type Config struct {
	Namespace            keyspace.Namespace
	Personal             Lifetime
	Renewable            Lifetime
	Challenge            Lifetime
	MaxPerSubject        int
	MaxPendingPerSubject int
	Limit                auth.LimitPolicy
	MaxRotations         int
	AccessGrace          time.Duration
	Prefix               string
	MaxConcurrent        int
	Timeout              time.Duration
	TicketLifetime       time.Duration
	MaxTicketsPerFamily  int
}

type Creation struct {
	ID             model.ID[Record]
	Subject        model.Identity
	Name           string
	Scopes         []auth.AccessScopeName
	Mode           Mode
	Assurance      auth.Assurance
	AccessHash     Digest
	RefreshHash    value.Optional[Digest]
	Lifetime       Lifetime
	RotationLimit  uint32
	Maximum        int
	PendingMaximum int
	Limit          auth.LimitPolicy
	Device         auth.Device
}

type Digest struct {
	// contains filtered or unexported fields
}

type GraceBackend interface {
	// LookupWithin accepts the current access generation or its immediate predecessor
	// within grace and its own access expiry.
	LookupWithin(context.Context, Address, Digest, time.Duration) (value.Optional[Record], error)
}

type ID[M any] struct {
	// contains filtered or unexported fields
}

type Info[M, K any] struct {
	// contains filtered or unexported fields
}

type IssueOptions[M any] struct {
	Name    string
	Scopes  auth.AccessScopes[M]
	Refresh bool
}

type Issued[M, K any] struct {
	// contains filtered or unexported fields
}

type Lifetime struct{ Access, RefreshIdle, Absolute time.Duration }

type Lifetimes struct{ Personal, Renewable, Challenge Lifetime }

type Mode uint8

type Option func(*options) error

type Record struct {
	ID               model.ID[Record]
	Address          Address
	Subject          model.Identity
	Name             string
	Scopes           []auth.AccessScopeName
	Mode             Mode
	Assurance        auth.Assurance
	AccessHash       Digest
	RefreshHash      value.Optional[Digest]
	Lifetime         Lifetime
	RotationLimit    uint32
	Generation       uint32
	CreatedAt        temporal.DateTime
	IssuedAt         temporal.DateTime
	LastSeenAt       temporal.DateTime
	AccessExpiresAt  temporal.DateTime
	RefreshExpiresAt value.Optional[temporal.DateTime]
	ExpiresAt        temporal.DateTime
	Device           auth.Device
	// SupersededAt is set only when Lookup returns the generation immediately
	// before the family's current one: the successor's issue time. Its access
	// secret authenticates only within Config.AccessGrace of that time.
	SupersededAt value.Optional[temporal.DateTime] `json:",omitzero"`
}

type RefreshRevocationBackend interface {
	// RevokeRefresh removes the family matching a current or consumed refresh digest and
	// returns its subject, omitting unknown families.
	RevokeRefresh(context.Context, Address, Digest) (value.Optional[model.Identity], error)
}

type SelectiveBackend interface {
	// RevokeOthers removes every token family of the subject except keep, returning the
	// count.
	RevokeOthers(context.Context, Address, model.Identity, model.ID[Record]) (uint64, error)
}

type Store struct {
	// contains filtered or unexported fields
}

type Ticket[M, K any] struct {
	// contains filtered or unexported fields
}

type TicketBackend interface {
	// IssueTicket stores a bounded single-use ticket for a live family and returns its
	// expiry, omitting families that are no longer live.
	IssueTicket(context.Context, Address, model.Identity, model.ID[Record], Digest, time.Duration, int) (value.Optional[temporal.DateTime], error)
	// RedeemTicket atomically deletes and reads a ticket, omitting unknown or expired
	// tickets.
	RedeemTicket(context.Context, Address, Digest) (value.Optional[TicketRecord], error)
	// LookupFamily returns a live family's current generation for revalidation.
	LookupFamily(context.Context, Address, model.Identity, model.ID[Record]) (value.Optional[Record], error)
	// PruneTickets removes at most limit expired tickets in the address.
	PruneTickets(context.Context, Address, int) (uint64, error)
}

type TicketRecord struct {
	Family    model.ID[Record]
	Subject   model.Identity
	ExpiresAt temporal.DateTime
}

type Tokens[M model.Identifiable, K any] struct {
	// contains filtered or unexported fields
}

type TransactionalBackend interface {
	// RevokeAllIn removes the subject's token families within the caller-owned
	// transaction, without committing or retrying.
	RevokeAllIn(context.Context, *database.Tx, Address, model.Identity) (uint64, error)
}