service

type AuthAttemptService interface {
	// Create and store a new auth attempt.
	//
	// If input.SessionID is set, the existing session's verified checks are copied
	// into the attempt for step-up authentication against an existing session.
	//
	// If input.RequiredChecks are nil, the project's default required checks are used.
	//
	// errors: domain.ErrAuthAttemptInvalidRequest, domain.ErrInternal
	Create(ctx context.Context, input CreateAuthAttemptInput) (*domain.AuthAttempt, error)

	// GetByID retrieves an auth attempt including all factors and challenges by its ID.
	//
	// errors: domain.ErrAuthAttemptNotFound, domain.ErrInternal
	GetByID(ctx context.Context, projectID, attemptID string) (*domain.AuthAttempt, error)

	// IssueChallenge creates and returns a new challenge for the given check type.
	// An existing challenge of the same type will be overwritten.
	//
	// For passkey challenges, the user check must already be verified, so the user ID is known
	// for retrieving registered credentials.
	//
	// errors: domain.ErrAuthAttemptNotFound, domain.ErrAuthAttemptInvalidRequest, domain.ErrAuthAttemptInvalidState, domain.ErrAuthAttemptAlreadyCompleted, domain.ErrInternal
	IssueChallenge(ctx context.Context, input IssueChallengeInput) (*domain.AuthAttempt, error)

	// VerifyProof verifies the submitted proof against the challenge identified by ChallengeID.
	//
	// On success, it persists the verification and marks the attempt complete if all
	// required checks are now satisfied.
	//
	// On failure, it records the failed attempt for rate-limiting purposes.
	//
	// The ChallengeID must match the ID returned by IssueChallenge to prevent use of
	// stale proofs after a challenge is re-issued.
	//
	// errors: domain.ErrAuthAttemptNotFound, domain.ErrAuthAttemptStaleChallenge, domain.ErrAuthAttemptInvalidRequest, domain.ErrAuthAttemptProofRejected, domain.ErrAuthAttemptInvalidState, domain.ErrAuthAttemptAlreadyCompleted, domain.ErrInternal
	VerifyProof(ctx context.Context, input VerifyProofInput) (*domain.AuthAttempt, error)

	// Handoff mints a single-use handoff token for a completed attempt.
	//
	// The client exchanges the token at POST /sessions/exchange to create
	// a new session or add factors to an existing session.
	//
	// The attempt must be in a completed state and not expired.
	//
	// errors: domain.ErrAuthAttemptNotFound, domain.ErrAuthAttemptInvalidState, domain.ErrAuthAttemptNotCompleted, domain.ErrInternal
	Handoff(ctx context.Context, input HandoffInput) (*domain.AuthAttempt, error)

	// RegisterCreatedUser registers a newly-created user's ID as a verified user
	// factor directly on the auth attempt, bypassing the challenge/proof cycle.
	// Used after on_success: create_user and passkey registration so the session
	// receives user_id after exchange.
	RegisterCreatedUser(ctx context.Context, projectID, attemptID, userID string) error
}

type BeginRegistrationInput struct {
	ProjectID   string
	UserID      string
	Username    string
	DisplayName string
	RPID        string
	RPOrigins   []string
}

type BeginRegistrationOutput struct {
	RegistrationID string
	Options        []byte // PublicKeyCredentialCreationOptions JSON
}

type BuiltinSchemaProvider interface {
	GetBuiltinSchema(uri string) (*jsonschema.Schema, error)
	LatestSchemaURI(kind domain.KnownSchemaKind) (string, error)
}

type Challenge interface {
	ChallengeCheckType() domain.AuthCheckType
}

type CreateAuthAttemptInput struct {
	ProjectID string
	// SessionID is set for step-up auth against an existing session.
	SessionID *string
	// RequiredChecks overrides the project's default policy.
	// Used by the OIDC adapter (acr_values) and flow engine.
	// If nil the project's DefaultRequiredChecks are used.
	RequiredChecks []domain.AuthCheckType
}

type CreateSchemaByURLInput struct {
	ProjectID string
	TeamID    string
	URL       url.URL
}

type CreateSchemaInput struct {
	ProjectID string
	TeamID    string
	Schema    []byte
}

type CreateSessionInput struct {
	ProjectID string
	UserAgent *domain.UserAgent
}

type CreateTeamInput struct {
	ProjectID string
}

type CreateUserAction struct {
	CreateUserInput

	CreateUser *domain.CreateUser
	// contains filtered or unexported fields
}

type CreateUserInput struct {
	ProjectID string
	TeamID    *string
	User      map[string]any
}

type DeleteSessionInput struct {
	ProjectID string
	SessionID string
}

type ExchangeInput struct {
	ProjectID      string
	HandoffToken   string
	IdempotencyKey *string
	// TTL is optional; nil uses the configured default.
	TTL *time.Duration
}

type FinishRegistrationInput struct {
	ProjectID      string
	RegistrationID string
	Attestation    []byte
}

type FlowAuthAttemptAdapter struct {
	// contains filtered or unexported fields
}

type FlowCreateUserForPasskeyHandler struct {
	// contains filtered or unexported fields
}

type FlowCreateUserWithPasswordHandler struct {
	// contains filtered or unexported fields
}

type FlowDefinitionRequest struct {
	FlowDefinitionID string
	ProjectID        string
	Name             string
	Status           string
	SchemaVersion    string // todo (grvijayan): currently empty as the request does not contain schema version
	FlowSchemaURI    string // todo (grvijayan): schema_version (semver) stored in the db vs schema_uri needed for validation
	UserSchema       string
	Purposes         map[string]string
	Audience         domain.FlowDefinitionAudience
	Steps            []domain.FlowDefinitionStep
}

type FlowDefinitionService interface {
	Create(ctx context.Context, req FlowDefinitionRequest) (*domain.FlowDefinition, error)
	Update(ctx context.Context, req FlowDefinitionRequest) (*domain.FlowDefinition, error)
	Get(ctx context.Context, projectID, id string) (*domain.FlowDefinition, error)
	List(ctx context.Context, req ListFlowDefinitionsRequest) ([]*domain.FlowDefinition, error)
	Delete(ctx context.Context, projectID string, id string) error
}

type FlowPasskeyRegistrationAdapter struct {
	// contains filtered or unexported fields
}

type FlowService interface {
	// Resolve returns the [domain.FlowDefinition] to run. Direct lookup
	// when Name is set; audience match otherwise.
	Resolve(ctx context.Context, req ResolveFlowRequest) (*domain.FlowDefinition, error)
	// Start mints a fresh flow on the resolved definition.
	Start(ctx context.Context, req StartFlowRequest) (domain.FlowStepResult, error)
	// Submit advances the state machine. Re-fetches the definition
	// from FlowState.DefinitionID.
	Submit(ctx context.Context, req SubmitFlowRequest) (domain.FlowStepResult, error)
	// GetStep re-emits the current step without advancing.
	GetStep(ctx context.Context, req GetFlowStepRequest) (domain.FlowStepResult, error)
}

type GetFlowStepRequest struct {
	State *domain.FlowState
}

type GetMyUserInput struct {
	SessionToken string
}

type GetSessionInput struct {
	ProjectID string
	SessionID string
}

type GetUserInput struct {
	ProjectID string
	TeamID    *string
	UserID    string
}

type HandoffInput struct {
	ProjectID      string
	AttemptID      string
	IdempotencyKey *string
}

type IssueChallengeInput struct {
	ProjectID string
	AttemptID string
	// Challenge is a discriminated union — use one of the Challenge* types below.
	Challenge Challenge
}

type LazyUserAction struct {
	// contains filtered or unexported fields
}

type ListFlowDefinitionsRequest struct {
	ProjectID string
	Purpose   string
	Limit     int
	PageToken string
}

type ListSessionInput struct {
	ProjectID string
}

type PasskeyChallenge struct {
	UserVerification string
	RPID             string
	RPOrigins        []url.URL
}

type PasskeyProof struct {
	AssertionResponse []byte
}

type PasskeyRegistrationService struct {
	// contains filtered or unexported fields
}

type PasswordChallenge struct{}

type PasswordProof struct {
	Password string
}

type ProjectLoader interface {
	Get(ctx context.Context, client database.QueryExecutor, id string) (*domain.Project, error)
}

type ProjectService interface {
	// Create generates a new project with server-minted secrets and persists it.
	// Returns the stored project including timestamps.
	Create(ctx context.Context, previewOrigins []string) (*domain.Project, error)

	// Get retrieves a project by ID.
	// Returns [database.NoRowFoundError] when no project with the given ID exists.
	Get(ctx context.Context, id string) (*domain.Project, error)
}

type Proof interface {
	// contains filtered or unexported methods
}

type ResolveFlowHint struct {
	AppID        *string
	TeamID       *string
	UserSchemaID *string
}

type ResolveFlowRequest struct {
	ProjectID     string
	Purpose       domain.FlowDefinitionPurpose
	Name          *string // direct-lookup slug
	SchemaVersion *string // nil = latest active
	AuthRequestID *string
	// Hint is plumbed through but not yet honored — see TODO on resolveByAudience.
	Hint ResolveFlowHint
}

type SchemaGetter interface {
	GetSchema(ctx context.Context, projectID string, teamID string, schemaID string) (*domain.JSONSchema, error)
}

type SchemaService struct {
	// contains filtered or unexported fields
}

type SessionConfig struct {
	DefaultTTL time.Duration `mapstructure:"default_ttl"`
	MaxTTL     time.Duration `mapstructure:"max_ttl"`
}

type SessionResolver interface {
	Get(ctx context.Context, q database.QueryExecutor, projectID, sessionID string) (*domain.Session, error)
}

type SessionService interface {
	Create(ctx context.Context, input CreateSessionInput) (*domain.Session, error)
	Exchange(ctx context.Context, input ExchangeInput) (*domain.Session, error)
	Get(ctx context.Context, input GetSessionInput) (*domain.Session, error)
	List(ctx context.Context, input ListSessionInput) ([]*domain.Session, error)
	Delete(ctx context.Context, input DeleteSessionInput) error
}

type SetPasswordInput struct {
	ProjectID                string
	UserID                   string
	Password                 string
	IsPasswordChangeRequired bool
}

type SetPasswordUserAction struct {
	SetPasswordInput
	// contains filtered or unexported fields
}

type StartFlowRequest struct {
	Definition    *domain.FlowDefinition
	Purpose       domain.FlowDefinitionPurpose
	RedirectURI   *string
	AuthRequestID *string
	SessionID     *string
}

type SubmitFlowRequest struct {
	State         *domain.FlowState
	Action        string
	Fields        map[string]any
	GateProofs    map[string]string
	SSOProviderID *string
	// ChallengeResponse carries the client's answer to a pending ceremony
	// (e.g. a passkey assertion). Nil unless the step issued a challenge.
	ChallengeResponse *domain.FlowChallengeResponse
	// PasskeyRP carries the WebAuthn relying-party params derived from the
	// request, needed when issuing a passkey challenge.
	PasskeyRP *domain.FlowPasskeyRP
}

type TeamService struct {
	// contains filtered or unexported fields
}

type UserAction interface {
	Prepare(ctx context.Context, db database.QueryExecutor) error
	Apply(ctx context.Context, db database.QueryExecutor) error
}

type UserActionFactory = func(ctx context.Context, db database.QueryExecutor) (UserAction, error)

type UserChallenge struct{}

type UserLookup interface {
	Get(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.User, error)
	ProjectIDCondition(projectID string) database.Condition
	IDCondition(id string) database.Condition
	AttributesCondition(attributes []domain.Attribute) database.Condition
}

type UserPasskeys interface {
	Get(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.UserPasskey, error)
	List(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) ([]*domain.UserPasskey, error)
	Update(ctx context.Context, client database.QueryExecutor, condition database.Condition, changes ...database.Change) error
	// contains filtered or unexported methods
}

type UserPasswords interface {
	Get(ctx context.Context, client database.QueryExecutor, opts ...database.QueryOption) (*domain.UserPassword, error)
	UserIDCondition(userID string) database.Condition
	ProjectIDCondition(pid string) database.Condition
}

type UserProof struct {
	AttributeName string
	LoginName     string
}

type UserService struct {
	// contains filtered or unexported fields
}

type VerifyProofInput struct {
	ProjectID string
	AttemptID string
	// ChallengeID must match the ID returned by IssueChallenge.
	// Prevents use of stale proofs after a challenge is re-issued.
	ChallengeID string
	// Proof is a discriminated union — use one of the Proof* types below.
	Proof Proof
}