auth

type OIDCAuthState struct {
	State         string `json:"state"`
	Nonce         string `json:"nonce"`
	CodeVerifier  string `json:"code_verifier"`
	ProviderID    string `json:"provider_id"`
	ClientIP      string `json:"client_ip"`
	RedirectAfter string `json:"redirect_after"`
	// BindingHash is the SHA-256 (hex) of a per-flow token set as an HttpOnly
	// cookie at /start; the callback must present the matching cookie. This
	// binds the round trip to the initiating browser (login-CSRF defense), the
	// spec-intended role of `state`. Only the hash is persisted.
	BindingHash string    `json:"binding_hash"`
	CreatedAt   time.Time `json:"created_at"`
	ExpiresAt   time.Time `json:"expires_at"`
}

type Session struct {
	ID        string
	ActorID   string
	CSRFToken string
	// Epoch records the user's SecurityEpoch at the instant this session was
	// minted. principalFromRequest rejects a session whose Epoch is older than
	// the user's current SecurityEpoch, so a privilege-reducing event (2FA
	// disable, password change, admin revoke) invalidates all prior sessions.
	Epoch     uint64
	CreatedAt time.Time
	ExpiresAt time.Time
	Revoked   bool
}

type TOTPChallenge struct {
	ID        string
	UserID    string
	ClientIP  string
	CreatedAt time.Time
	ExpiresAt time.Time
	Used      bool
	// Attempts counts failed second-factor submissions; the store burns the
	// challenge once it reaches the per-challenge cap.
	Attempts int
}

type WebAuthnChallenge struct {
	ID string `json:"id"`
	// UserID is the owning user for a registration ceremony. It is empty for a
	// usernameless (discoverable) login, where the user is only resolved at finish
	// from the authenticator's user handle.
	UserID string `json:"user_id,omitempty"`
	// ClientIP binds the challenge to the requesting client, exactly like
	// TOTPChallenge, so a challenge captured on one network cannot be completed
	// from another.
	ClientIP string `json:"client_ip"`
	// Purpose is one of WebAuthnPurpose*. The finish handler refuses a challenge
	// minted for the other ceremony.
	Purpose string `json:"purpose"`
	// SessionData is the JSON-encoded webauthn.SessionData for this ceremony.
	SessionData []byte    `json:"session_data"`
	CreatedAt   time.Time `json:"created_at"`
	ExpiresAt   time.Time `json:"expires_at"`
	Used        bool      `json:"used"`
}

type WebAuthnCredential struct {
	// ID is the opaque store record id (id.New("wacred")). It is the handle the
	// management UI uses to rename/delete; it is NOT the WebAuthn credential id.
	ID     string `json:"id"`
	UserID string `json:"user_id"`
	// Name is an operator-editable label, defaulted at creation from the
	// authenticator/User-Agent so a user with several passkeys can tell them apart.
	Name string `json:"name"`
	// CredentialID is the raw WebAuthn credential id (the authenticator's handle
	// for this key). Unique per credential; used to look a credential up on login.
	CredentialID []byte `json:"credential_id"`
	// PublicKey is the COSE-encoded public key used to verify assertions.
	PublicKey []byte `json:"public_key"`
	// AAGUID identifies the authenticator model (all-zero for many platform
	// authenticators, including Apple's). Advisory only.
	AAGUID []byte `json:"aaguid,omitempty"`
	// SignCount is the last observed authenticator signature counter. Synced
	// passkeys (e.g. Apple's, in iCloud Keychain) always report 0; a regression
	// from a previously non-zero value is a clone signal, logged but not fatal.
	SignCount uint32 `json:"sign_count"`
	// Transports are the hints the authenticator advertised ("internal", "hybrid",
	// "usb", …); passed back to the browser to speed up future prompts.
	Transports []string `json:"transports,omitempty"`
	// BackupEligible (BE) reports whether the credential can be backed up/synced.
	// It is fixed for the life of the credential.
	BackupEligible bool `json:"backup_eligible"`
	// BackupState (BS) reports whether the credential is currently backed
	// up/synced. It can change over time and is refreshed on every login.
	BackupState bool      `json:"backup_state"`
	CreatedAt   time.Time `json:"created_at"`
	LastUsedAt  time.Time `json:"last_used_at,omitempty"`
}