mfa

type AdaptiveMFAConfig struct {
	Enabled                bool    `default:"false" json:"enabled"`
	RiskThreshold          float64 `default:"50.0"  json:"risk_threshold"` // 0-100
	FactorLocationChange   bool    `default:"true"  json:"factor_location_change"`
	FactorNewDevice        bool    `default:"true"  json:"factor_new_device"`
	FactorVelocity         bool    `default:"true"  json:"factor_velocity"`
	FactorIPReputation     bool    `default:"false" json:"factor_ip_reputation"`
	RequireStepUpThreshold float64 `default:"75.0"  json:"require_step_up_threshold"`
	LocationChangeRisk     float64 `default:"30.0"  json:"location_change_risk"`
	NewDeviceRisk          float64 `default:"40.0"  json:"new_device_risk"`
	VelocityRisk           float64 `default:"50.0"  json:"velocity_risk"`
}

type AdminBypassRequest struct {
	UserID   xid.ID `json:"userId"`
	Duration int    `json:"duration"` // Bypass duration in seconds
	Reason   string `json:"reason"`   // Reason for bypass
}

type AdminPolicyRequest struct {
	RequiredFactors int      `json:"requiredFactors"` // Number of factors required
	AllowedTypes    []string `json:"allowedTypes"`    // e.g., ["totp", "sms", "email", "webauthn", "backup"]
	GracePeriod     int      `json:"gracePeriod"`     // Grace period in seconds for new users
	Enabled         bool     `json:"enabled"`         // Enable/disable MFA requirement
}

type BackupCodeFactorAdapter struct {
	BaseFactorAdapter
	// contains filtered or unexported fields
}

type BackupCodesConfig struct {
	Enabled    bool   `default:"true"      json:"enabled"`
	Count      int    `default:"10"        json:"count"`
	Length     int    `default:"8"         json:"length"`
	Format     string `default:"XXXX-XXXX" json:"format"` // Code format
	AllowReuse bool   `default:"false"     json:"allow_reuse"`
}

type BaseFactorAdapter struct {
	// contains filtered or unexported fields
}

type Challenge struct {
	ID          xid.ID          `json:"id"`
	UserID      xid.ID          `json:"userId"`
	FactorID    xid.ID          `json:"factorId"`
	Type        FactorType      `json:"type"`
	Status      ChallengeStatus `json:"status"`
	Code        string          `json:"-"` // Hashed verification code
	Metadata    map[string]any  `json:"metadata"`
	Attempts    int             `json:"attempts"`
	MaxAttempts int             `json:"maxAttempts"`
	IPAddress   string          `json:"ipAddress"`
	UserAgent   string          `json:"userAgent"`
	CreatedAt   time.Time       `json:"createdAt"`
	ExpiresAt   time.Time       `json:"expiresAt"`
	VerifiedAt  *time.Time      `json:"verifiedAt,omitempty"`
}

type ChallengeRequest struct {
	UserID      xid.ID         `json:"userId"`
	FactorTypes []FactorType   `json:"factorTypes,omitempty"` // Specific factor types to use
	Context     string         `json:"context,omitempty"`     // "login", "transaction", "step-up"
	Metadata    map[string]any `json:"metadata,omitempty"`
}

type ChallengeResponse struct {
	ChallengeID      xid.ID       `json:"challengeId"`
	SessionID        xid.ID       `json:"sessionId"`
	FactorsRequired  int          `json:"factorsRequired"`
	AvailableFactors []FactorInfo `json:"availableFactors"`
	ExpiresAt        time.Time    `json:"expiresAt"`
}

type ChallengeStatus string

type ChallengeStatusResponse struct {
	SessionID        xid.ID     `json:"sessionId"`
	Status           string     `json:"status"` // pending, completed, expired
	FactorsRequired  int        `json:"factorsRequired"`
	FactorsVerified  int        `json:"factorsVerified"`
	FactorsRemaining int        `json:"factorsRemaining"`
	ExpiresAt        time.Time  `json:"expiresAt"`
	CompletedAt      *time.Time `json:"completedAt,omitempty"`
}

type Config struct {
	// Global settings
	Enabled            bool `default:"true"  json:"enabled"`
	RequireForAllUsers bool `default:"false" json:"require_for_all_users"`
	GracePeriodDays    int  `default:"7"     json:"grace_period_days"`

	// Factor settings
	AllowedFactorTypes  []FactorType `json:"allowed_factor_types"`
	RequiredFactorCount int          `default:"1"                 json:"required_factor_count"`

	// TOTP settings
	TOTP TOTPConfig `json:"totp"`

	// SMS settings
	SMS SMSConfig `json:"sms"`

	// Email settings
	Email EmailConfig `json:"email"`

	// WebAuthn settings
	WebAuthn WebAuthnConfig `json:"webauthn"`

	// Backup codes settings
	BackupCodes BackupCodesConfig `json:"backup_codes"`

	// Trusted device settings
	TrustedDevices TrustedDevicesConfig `json:"trusted_devices"`

	// Challenge settings
	ChallengeExpiryMinutes int `default:"5" json:"challenge_expiry_minutes"`
	MaxAttempts            int `default:"3" json:"max_attempts"`

	// Rate limiting
	RateLimit RateLimitConfig `json:"rate_limit"`

	// Adaptive MFA
	AdaptiveMFA AdaptiveMFAConfig `json:"adaptive_mfa"`

	// Session settings
	SessionExpiryMinutes int `default:"15" json:"session_expiry_minutes"`
}

type DeleteFactorRequest struct {
	// Path parameters
	ID string `description:"Factor ID to delete" path:"id" validate:"required"`
}

type DeviceInfo struct {
	DeviceID string         `json:"deviceId"`
	Name     string         `json:"name,omitempty"`
	Metadata map[string]any `json:"metadata,omitempty"`
}

type DevicesResponse struct {
	Devices any `json:"devices"`
	Count   int `json:"count"`
}

type EmailConfig struct {
	Enabled           bool             `default:"true"              json:"enabled"`
	Provider          string           `json:"provider"` // Email provider
	CodeLength        int              `default:"6"                 json:"code_length"`
	CodeExpiryMinutes int              `default:"10"                json:"code_expiry_minutes"`
	TemplateID        string           `json:"template_id"`
	RateLimit         *RateLimitConfig `json:"rate_limit,omitempty"`
}

type EmailFactorAdapter struct {
	BaseFactorAdapter
	// contains filtered or unexported fields
}

type EnrollFactorRequest struct {
	// Body fields
	Type     FactorType     `` /* 160-byte string literal not displayed */
	Priority FactorPriority `` /* 130-byte string literal not displayed */
	Name     string         `description:"User-friendly name for the factor"       json:"name,omitempty"     validate:"omitempty,min=1,max=100"`
	Metadata map[string]any `description:"Additional factor-specific metadata"     json:"metadata,omitempty"`
}

type ErrorResponse struct {
	Error   string         `description:"Error message"                        json:"error"`
	Code    string         `description:"Error code for programmatic handling" json:"code,omitempty"`
	Details map[string]any `description:"Additional error details"             json:"details,omitempty"`
}

type Factor struct {
	ID         xid.ID         `json:"id"`
	UserID     xid.ID         `json:"userId"`
	Type       FactorType     `json:"type"`
	Status     FactorStatus   `json:"status"`
	Priority   FactorPriority `json:"priority"`
	Name       string         `json:"name"`     // User-friendly name
	Secret     string         `json:"-"`        // Encrypted secret data
	Metadata   map[string]any `json:"metadata"` // Factor-specific metadata
	LastUsedAt *time.Time     `json:"lastUsedAt"`
	VerifiedAt *time.Time     `json:"verifiedAt"`
	CreatedAt  time.Time      `json:"createdAt"`
	UpdatedAt  time.Time      `json:"updatedAt"`
	ExpiresAt  *time.Time     `json:"expiresAt,omitempty"`
}

type FactorAdapter interface {
	// Type returns the factor type this adapter handles
	Type() FactorType

	// Enroll initiates factor enrollment for a user
	// Returns provisioning data needed to complete enrollment
	Enroll(ctx context.Context, userID xid.ID, metadata map[string]any) (*FactorEnrollmentResponse, error)

	// VerifyEnrollment verifies the enrollment (e.g., user scanned QR code and provides first TOTP)
	VerifyEnrollment(ctx context.Context, enrollmentID xid.ID, proof string) error

	// Challenge initiates a verification challenge (sends code, displays options, etc.)
	Challenge(ctx context.Context, factor *Factor, metadata map[string]any) (*Challenge, error)

	// Verify verifies the challenge response
	Verify(ctx context.Context, challenge *Challenge, response string, data map[string]any) (bool, error)

	// IsAvailable checks if this factor type is available/configured
	IsAvailable() bool
}

type FactorAdapterRegistry struct {
	// contains filtered or unexported fields
}

type FactorEnrollmentRequest struct {
	Type     FactorType     `json:"type"`
	Priority FactorPriority `json:"priority,omitempty"`
	Name     string         `json:"name,omitempty"`
	Metadata map[string]any `json:"metadata,omitempty"`
}

type FactorEnrollmentResponse struct {
	FactorID         xid.ID         `json:"factorId"`
	Type             FactorType     `json:"type"`
	Status           FactorStatus   `json:"status"`
	ProvisioningData map[string]any `json:"provisioningData"` // Type-specific setup data

}

type FactorInfo struct {
	FactorID xid.ID         `json:"factorId"`
	Type     FactorType     `json:"type"`
	Name     string         `json:"name"`
	Metadata map[string]any `json:"metadata,omitempty"` // Masked phone, email, etc.
}

type FactorPriority string

type FactorStatus string

type FactorType string

type FactorVerificationRequest struct {
	FactorID xid.ID         `json:"factorId"`
	Code     string         `json:"code,omitempty"` // For OTP-based factors
	Data     map[string]any `json:"data,omitempty"` // For complex factors (WebAuthn, etc.)
}

type FactorsResponse struct {
	Factors any `json:"factors"`
	Count   int `json:"count"`
}

type GetChallengeStatusRequest struct {
	// Path parameters
	ID string `description:"Challenge ID" path:"id" validate:"required"`
}

type GetChallengeStatusResponse struct {
	ChallengeID      xid.ID          `description:"Unique challenge identifier"          json:"challengeId"`
	Status           ChallengeStatus `description:"Current status of the challenge"      json:"status"`
	FactorsRequired  int             `description:"Number of factors required"           json:"factorsRequired"`
	FactorsVerified  int             `description:"Number of factors verified"           json:"factorsVerified"`
	Attempts         int             `description:"Number of verification attempts"      json:"attempts"`
	MaxAttempts      int             `description:"Maximum allowed attempts"             json:"maxAttempts"`
	AvailableFactors []FactorInfo    `description:"Available factors for this challenge" json:"availableFactors"`
}

type GetFactorRequest struct {
	// Path parameters
	ID string `description:"Factor ID" path:"id" validate:"required"`
}

type GetStatusRequest struct {
	// Query parameters
	DeviceID string `description:"Device ID to check trust status" query:"deviceId"`
}

type Handler struct {
	// contains filtered or unexported fields
}

type InitiateChallengeRequest struct {
	// Body fields
	FactorTypes []FactorType   `description:"Specific factor types to use for this challenge"      json:"factorTypes,omitempty"`
	Context     string         `` /* 148-byte string literal not displayed */
	Metadata    map[string]any `description:"Additional context metadata"                          json:"metadata,omitempty"`
}

type LimitResult struct {
	Allowed      bool
	RetryAfter   *time.Duration
	AttemptsLeft int
	LockoutEnds  *time.Time
}

type ListFactorsRequest struct {
	// Query parameters
	ActiveOnly bool `description:"Return only active factors" query:"activeOnly"`
}

type ListFactorsResponse struct {
	Factors []Factor `description:"List of enrolled factors" json:"factors"`
	Count   int      `description:"Total number of factors"  json:"count"`
}

type ListTrustedDevicesResponse struct {
	Devices []TrustedDevice `description:"List of trusted devices"         json:"devices"`
	Count   int             `description:"Total number of trusted devices" json:"count"`
}

type MFABypassResponse struct {
	ID        xid.ID    `json:"id"`
	UserID    xid.ID    `json:"userId"`
	ExpiresAt time.Time `json:"expiresAt"`
	Reason    string    `json:"reason"`
}

type MFAConfigResponse struct {
	Enabled             bool     `json:"enabled"`
	RequiredFactorCount int      `json:"required_factor_count"`
	AllowedFactorTypes  []string `json:"allowed_factor_types"`
}

type MFAPolicy struct {
	ID                     xid.ID       `json:"id"`
	OrganizationID         xid.ID       `json:"organizationId"`
	RequiredFactorCount    int          `json:"requiredFactorCount"` // Number of factors required
	AllowedFactorTypes     []FactorType `json:"allowedFactorTypes"`  // Permitted factor types
	RequiredFactorTypes    []FactorType `json:"requiredFactorTypes"` // Mandatory factor types
	GracePeriodDays        int          `json:"gracePeriodDays"`     // Days before MFA is enforced
	TrustedDeviceDays      int          `json:"trustedDeviceDays"`   // Days device is trusted
	StepUpRequired         bool         `json:"stepUpRequired"`      // Require step-up for sensitive ops
	AdaptiveMFAEnabled     bool         `json:"adaptiveMfaEnabled"`  // Enable risk-based MFA
	MaxFailedAttempts      int          `json:"maxFailedAttempts"`
	LockoutDurationMinutes int          `json:"lockoutDurationMinutes"`
	CreatedAt              time.Time    `json:"createdAt"`
	UpdatedAt              time.Time    `json:"updatedAt"`
}

type MFAPolicyResponse struct {
	ID                  xid.ID   `json:"id"`
	AppID               xid.ID   `json:"appId"`
	OrganizationID      *xid.ID  `json:"organizationId,omitempty"`
	Enabled             bool     `json:"enabled"`
	RequiredFactorCount int      `json:"requiredFactorCount"`
	AllowedFactorTypes  []string `json:"allowedFactorTypes"`
	GracePeriodDays     int      `json:"gracePeriodDays"`
}

type MFASession struct {
	ID              xid.ID         `json:"id"`
	UserID          xid.ID         `json:"userId"`
	SessionToken    string         `json:"sessionToken"`
	FactorsRequired int            `json:"factorsRequired"`
	FactorsVerified int            `json:"factorsVerified"`
	VerifiedFactors []xid.ID       `json:"verifiedFactors"`
	RiskLevel       RiskLevel      `json:"riskLevel"`
	IPAddress       string         `json:"ipAddress"`
	UserAgent       string         `json:"userAgent"`
	Metadata        map[string]any `json:"metadata"`
	CreatedAt       time.Time      `json:"createdAt"`
	ExpiresAt       time.Time      `json:"expiresAt"`
	CompletedAt     *time.Time     `json:"completedAt,omitempty"`
}

type MFAStatus struct {
	Enabled         bool         `json:"enabled"`
	EnrolledFactors []FactorInfo `json:"enrolledFactors"`
	RequiredCount   int          `json:"requiredCount"`
	PolicyActive    bool         `json:"policyActive"`
	GracePeriod     *time.Time   `json:"gracePeriod,omitempty"`
	TrustedDevice   bool         `json:"trustedDevice"`
}

type MessageResponse = responses.MessageResponse

type Plugin struct {
	// contains filtered or unexported fields
}

type PluginOption func(*Plugin)

type RateLimitConfig struct {
	Enabled        bool `default:"true" json:"enabled"`
	MaxAttempts    int  `default:"5"    json:"max_attempts"`
	WindowMinutes  int  `default:"15"   json:"window_minutes"`
	LockoutMinutes int  `default:"30"   json:"lockout_minutes"`
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type ResetUserMFARequest struct {
	// Path parameters
	ID string `description:"User ID whose MFA should be reset" path:"id" validate:"required"`

	// Body fields
	Reason string `description:"Reason for MFA reset (for audit trail)" json:"reason,omitempty" validate:"omitempty,min=1,max=500"`
}

type ResetUserMFAResponse struct {
	Success        bool   `description:"Whether the reset was successful"  json:"success"`
	Message        string `description:"Human-readable message"            json:"message"`
	FactorsReset   int    `description:"Number of factors that were reset" json:"factorsReset"`
	DevicesRevoked int    `description:"Number of trusted devices revoked" json:"devicesRevoked"`
}

type RevokeTrustedDeviceRequest struct {
	// Path parameters
	ID string `description:"Trusted device ID to revoke" path:"id" validate:"required"`
}

type RiskAssessment struct {
	Level       RiskLevel      `json:"level"`
	Score       float64        `json:"score"`       // 0-100
	Factors     []string       `json:"factors"`     // Risk factors identified
	Recommended []FactorType   `json:"recommended"` // Recommended factor types
	Metadata    map[string]any `json:"metadata"`
}

type RiskContext struct {
	UserID    xid.ID
	IPAddress string
	UserAgent string
	Location  string
	DeviceID  string
	Timestamp time.Time
}

type RiskEngine struct {
	// contains filtered or unexported fields
}

type RiskFactor struct {
	Name        string
	Description string
	Score       float64 // 0-100
	Weight      float64 // 0-1
}

type RiskLevel string

type SMSConfig struct {
	Enabled           bool             `default:"true"              json:"enabled"`
	Provider          string           `json:"provider"` // "twilio", "vonage", etc.
	CodeLength        int              `default:"6"                 json:"code_length"`
	CodeExpiryMinutes int              `default:"5"                 json:"code_expiry_minutes"`
	TemplateID        string           `json:"template_id"`
	RateLimit         *RateLimitConfig `json:"rate_limit,omitempty"`
}

type SMSFactorAdapter struct {
	BaseFactorAdapter
	// contains filtered or unexported fields
}

type Service struct {
	// contains filtered or unexported fields
}

type SuccessResponse struct {
	Message string         `description:"Success message"          json:"message"`
	Data    map[string]any `description:"Additional response data" json:"data,omitempty"`
}

type TOTPConfig struct {
	Enabled    bool   `default:"true"     json:"enabled"`
	Issuer     string `default:"AuthSome" json:"issuer"`
	Period     int    `default:"30"       json:"period"` // Seconds
	Digits     int    `default:"6"        json:"digits"`
	Algorithm  string `default:"SHA1"     json:"algorithm"`   // SHA1, SHA256, SHA512
	WindowSize int    `default:"1"        json:"window_size"` // Past/future periods to accept
}

type TOTPFactorAdapter struct {
	BaseFactorAdapter
	// contains filtered or unexported fields
}

type TrustDeviceRequest struct {
	// Body fields
	DeviceID string         `description:"Unique device identifier"            json:"deviceId"           validate:"required"`
	Name     string         `description:"User-friendly device name"           json:"name,omitempty"     validate:"omitempty,min=1,max=100"`
	Metadata map[string]any `description:"Device metadata (OS, browser, etc.)" json:"metadata,omitempty"`
}

type TrustedDevice struct {
	ID         xid.ID         `json:"id"`
	UserID     xid.ID         `json:"userId"`
	DeviceID   string         `json:"deviceId"` // Fingerprint/identifier
	Name       string         `json:"name"`     // User-friendly name
	Metadata   map[string]any `json:"metadata"` // Device info
	IPAddress  string         `json:"ipAddress"`
	UserAgent  string         `json:"userAgent"`
	LastUsedAt *time.Time     `json:"lastUsedAt"`
	CreatedAt  time.Time      `json:"createdAt"`
	ExpiresAt  time.Time      `json:"expiresAt"`
}

type TrustedDevicesConfig struct {
	Enabled           bool `default:"true" json:"enabled"`
	DefaultExpiryDays int  `default:"30"   json:"default_expiry_days"`
	MaxExpiryDays     int  `default:"90"   json:"max_expiry_days"`
	MaxDevicesPerUser int  `default:"5"    json:"max_devices_per_user"`
}

type UpdateFactorRequest struct {
	// Path parameters
	ID string `description:"Factor ID" path:"id" validate:"required"`

	// Body fields
	Name     *string         `description:"New name for the factor"                       json:"name,omitempty"     validate:"omitempty,min=1,max=100"`
	Priority *FactorPriority `` /* 136-byte string literal not displayed */
	Status   *FactorStatus   `` /* 128-byte string literal not displayed */
	Metadata map[string]any  `description:"Updated metadata"                              json:"metadata,omitempty"`
}

type UpdatePolicyRequest struct {
	// Body fields
	RequiredFactorCount    *int         `` /* 142-byte string literal not displayed */
	AllowedFactorTypes     []FactorType `description:"Permitted factor types"                                  json:"allowedFactorTypes,omitempty"`
	RequiredFactorTypes    []FactorType `description:"Mandatory factor types"                                  json:"requiredFactorTypes,omitempty"`
	GracePeriodDays        *int         `` /* 144-byte string literal not displayed */
	TrustedDeviceDays      *int         `` /* 144-byte string literal not displayed */
	StepUpRequired         *bool        `description:"Require step-up authentication for sensitive operations" json:"stepUpRequired,omitempty"`
	AdaptiveMFAEnabled     *bool        `description:"Enable risk-based MFA"                                   json:"adaptiveMfaEnabled,omitempty"`
	MaxFailedAttempts      *int         `` /* 143-byte string literal not displayed */
	LockoutDurationMinutes *int         `` /* 145-byte string literal not displayed */
}

type VerificationRequest struct {
	ChallengeID    xid.ID         `json:"challengeId"`
	FactorID       xid.ID         `json:"factorId"`
	Code           string         `json:"code,omitempty"`
	Data           map[string]any `json:"data,omitempty"`
	RememberDevice bool           `json:"rememberDevice,omitempty"`
	DeviceInfo     *DeviceInfo    `json:"deviceInfo,omitempty"`
}

type VerificationResponse struct {
	Success          bool       `json:"success"`
	SessionComplete  bool       `json:"sessionComplete"`
	FactorsRemaining int        `json:"factorsRemaining,omitempty"`
	Token            string     `json:"token,omitempty"` // MFA completion token
	ExpiresAt        *time.Time `json:"expiresAt,omitempty"`
}

type VerifyChallengeRequest struct {
	// Body fields
	ChallengeID    xid.ID         `description:"ID of the challenge to verify"           json:"challengeId"              validate:"required"`
	FactorID       xid.ID         `description:"ID of the factor being used"             json:"factorId"                 validate:"required"`
	Code           string         `description:"Verification code for OTP-based factors" json:"code,omitempty"           validate:"required_without=Data"`
	Data           map[string]any `description:"Verification data for complex factors"   json:"data,omitempty"`
	RememberDevice bool           `description:"Whether to trust this device"            json:"rememberDevice,omitempty"`
	DeviceInfo     *DeviceInfo    `description:"Device identification information"       json:"deviceInfo,omitempty"`
}

type VerifyEnrolledFactorRequest struct {
	// Path parameters
	ID string `description:"Factor ID to verify" path:"id" validate:"required"`

	// Body fields
	Code string         `description:"Verification code for OTP-based factors"                json:"code,omitempty" validate:"required_without=Data"`
	Data map[string]any `description:"Verification data for complex factors (WebAuthn, etc.)" json:"data,omitempty"`
}

type WebAuthnConfig struct {
	Enabled                bool     `default:"true"     json:"enabled"`
	RPDisplayName          string   `default:"AuthSome" json:"rp_display_name"`
	RPID                   string   `json:"rp_id"`                                     // e.g., "example.com"
	RPOrigins              []string `json:"rp_origins"`                                // Allowed origins
	AttestationPreference  string   `default:"none"     json:"attestation_preference"` // none, indirect, direct
	AuthenticatorSelection struct {
		RequireResidentKey     bool   `default:"false"     json:"require_resident_key"`
		ResidentKeyRequirement string `default:"preferred" json:"resident_key_requirement"` // discouraged, preferred, required
		UserVerification       string `default:"preferred" json:"user_verification"`        // discouraged, preferred, required
	} `json:"authenticator_selection"`
	Timeout int `default:"60000" json:"timeout"` // Milliseconds
}

type WebAuthnFactorAdapter struct {
	BaseFactorAdapter
	// contains filtered or unexported fields
}