flow

type Attacher interface {
	Attach(ctx context.Context, ident any, identifier, secret string) error
}

type BcryptHasher struct {
	Cost int
}

type ClaimMapper func(claims map[string]any) identity.JSON

type ConfigurableRateLimiter struct {
	// contains filtered or unexported fields
}

type ContextKey string

type CredentialSource interface {
	GetCredentials() []identity.Credential
	SetCredentials([]identity.Credential)
}

type FixedWindowRateLimiter struct {
	// contains filtered or unexported fields
}

type Flow struct {
	ID        uuid.UUID `json:"id"`
	Type      FlowType  `json:"type"`
	ExpiresAt time.Time `json:"expires_at"`
	Active    bool      `json:"active"`
	IssuedAt  time.Time `json:"issued_at"`

	// Methods could be "password", "oidc", etc.
	Methods []string `json:"methods"`
}

type FlowIdentity interface {
	GetID() any
	SetID(any)
}

type FlowType string

type Hook func(ctx context.Context, ident any) error

type IdentityRepository = domain.IdentityStorage

type Initiator interface {
	Initiate(ctx context.Context, identifier string) (any, error)
}

type Linker interface {
	// FindExisting searches for an identity that matches the provided traits.
	// Typically checks for verified emails or phone numbers.
	FindExisting(ctx context.Context, traits identity.JSON) (any, error)

	// Link attaches a new authentication method to an existing identity.
	Link(ctx context.Context, ident any, method string, identifier, secret string) error
}

type LockoutConfig struct {
	// MaxFailures is the number of failures before lockout (e.g. 5)
	MaxFailures int

	// LockoutDuration is how long to lock the account (e.g. 15 minutes)
	LockoutDuration time.Duration

	// FailureWindow is how long failures are remembered (e.g. 15 minutes)
	FailureWindow time.Duration

	// FailOpen determines behavior when store errors occur.
	// If true, allow requests when store fails. If false (default), deny.
	FailOpen bool

	// Hooks for customizing behavior.
	Hooks LockoutHooks
}

type LockoutHooks struct {
	// OnFailure is called when an authentication failure is recorded.
	// Receives the current failure count. Return error to override default behavior.
	OnFailure func(ctx context.Context, info *LockoutInfo) error

	// OnLocked is called when an account becomes locked.
	// Use for alerting, logging, or custom actions.
	OnLocked func(ctx context.Context, info *LockoutInfo)

	// OnUnlocked is called when an account is unlocked (on successful login).
	OnUnlocked func(ctx context.Context, identifier string)

	// OnLockoutCheck is called before checking if account is locked.
	// Return true, time.Time, nil to override with custom lock status.
	// Return false, _, nil to use default behavior.
	OnLockoutCheck func(ctx context.Context, identifier string) (locked bool, until time.Time, handled bool)

	// CreateLockError allows customizing the error when locked.
	CreateLockError func(info *LockoutInfo) error

	// KeyFunc extracts the lockout key from the identifier.
	// Useful for grouping by IP, tenant, etc.
	KeyFunc func(ctx context.Context, identifier string) string

	// ShouldRecordFailure determines if a failure should be counted.
	// Return false to skip recording (e.g., for certain error types).
	ShouldRecordFailure func(ctx context.Context, identifier string, err error) bool

	// ShouldClearOnSuccess determines if failures should clear on success.
	// Default is true. Set to false for accumulating counters.
	ShouldClearOnSuccess func(ctx context.Context, identifier string) bool
}

type LockoutInfo struct {
	Identifier      string
	FailureCount    int
	MaxFailures     int
	LockedUntil     time.Time
	LockoutDuration time.Duration
}

type LockoutStore interface {
	// RecordFailure increments the failure count for the identifier.
	// ttl defines how long this failure record should be kept.
	RecordFailure(ctx context.Context, identifier string, ttl time.Duration) (int, error)

	// ClearFailures resets the failure count for the identifier.
	ClearFailures(ctx context.Context, identifier string) error

	// Lock manually locks the identifier for the given duration.
	Lock(ctx context.Context, identifier string, duration time.Duration) error

	// IsLocked checks if the identifier is currently locked.
	// Returns true and the expiry time if locked.
	IsLocked(ctx context.Context, identifier string) (bool, time.Time, error)
}

type LockoutStrategy struct {
	// contains filtered or unexported fields
}

type LoginManager struct {
	// contains filtered or unexported fields
}

type LoginStrategy interface {
	ID() string
	Authenticate(ctx context.Context, identifier, secret string) (any, error)
}

type MagicLinkStrategy struct {
	// contains filtered or unexported fields
}

type MemoryLockoutStore struct {
	// contains filtered or unexported fields
}

type MemoryRateLimiter struct {
	// contains filtered or unexported fields
}

type MemoryStepUpStore struct {
	// contains filtered or unexported fields
}

type MemoryWebAuthnSessionStore struct {
	// contains filtered or unexported fields
}

type OIDCManager struct {
	// contains filtered or unexported fields
}

type OIDCProviderData struct {
	Provider    *oidc.Provider
	OAuthConfig *oauth2.Config
}

type OTPOption func(*OTPStrategy)

type OTPSender interface {
	Send(ctx context.Context, recipient, code string) error
}

type OTPStrategy struct {
	// contains filtered or unexported fields
}

type PasswordStrategy struct {
	// contains filtered or unexported fields
}

type RateLimitConfig struct {
	// Limit is the maximum number of requests allowed in the window.
	Limit int

	// Window is the time window for the rate limit.
	Window time.Duration

	// KeyFunc extracts the rate limit key from the identifier.
	// If nil, the identifier itself is used as the key.
	// Receives context for access to request metadata.
	KeyFunc func(ctx context.Context, identifier string) string

	// DynamicLimit allows per-request limit customization.
	// If set, overrides the static Limit value.
	// Useful for tiered rate limits (e.g., premium users get higher limits).
	DynamicLimit func(ctx context.Context, identifier string) (limit int, window time.Duration)

	// SkipFunc determines if rate limiting should be skipped for this request.
	// Return true to bypass rate limiting entirely.
	SkipFunc func(ctx context.Context, identifier string) bool

	// FailOpen determines behavior when rate limiter errors occur.
	// If true, allow requests when rate limiter fails.
	// If false (default), deny requests when rate limiter fails.
	FailOpen bool

	// Hooks for customizing behavior at various points.
	Hooks RateLimitHooks
}

type RateLimitError struct {
	RetryAfter time.Duration
	Remaining  int
	Message    string // Custom message (optional)
}

type RateLimitHooks struct {
	// OnAllow is called when a request is allowed.
	// Return error to reject the request even if the rate limiter allowed it.
	OnAllow func(ctx context.Context, info *RateLimitInfo) error

	// OnDeny is called when a request is denied by rate limiting.
	// This is informational - the request will still be denied.
	// Use to log, alert, or perform custom actions.
	OnDeny func(ctx context.Context, info *RateLimitInfo)

	// OnError is called when the rate limiter encounters an error.
	// Return a new error to override the default behavior.
	// Return nil to fail open (allow the request despite error).
	OnError func(ctx context.Context, err error, info *RateLimitInfo) error

	// CreateError allows customizing the error returned when rate limited.
	// If nil, returns RateLimitError.
	CreateError func(info *RateLimitInfo) error
}

type RateLimitInfo struct {
	Key        string
	Identifier string
	Limit      int
	Window     time.Duration
	Remaining  int
	Allowed    bool
	RetryAfter time.Duration
}

type RateLimitStrategy struct {
	// contains filtered or unexported fields
}

type RateLimiter interface {
	// Allow checks if the request should be allowed based on the key and rate limit.
	// Returns true if allowed, false if rate limited.
	// remaining indicates how many requests are left in the current window.
	Allow(ctx context.Context, key string, limit int, window time.Duration) (allowed bool, remaining int, err error)

	// Reset clears the rate limit counter for the given key.
	Reset(ctx context.Context, key string) error
}

type RecoveryManager struct {
	// contains filtered or unexported fields
}

type RedisLockoutStore struct {
	// contains filtered or unexported fields
}

type RedisRateLimiter struct {
	// contains filtered or unexported fields
}

type RedisWebAuthnSessionStore struct {
	// contains filtered or unexported fields
}

type RegistrationManager struct {
	PreventPasswordCapture bool
	// contains filtered or unexported fields
}

type RegistrationStrategy interface {
	ID() string
	Register(ctx context.Context, traits identity.JSON, secret string) (any, error)
}

type StepUpLevel string

type StepUpManager struct {
	// contains filtered or unexported fields
}

type StepUpManagerOption func(*StepUpManager)

type StepUpPolicy interface {
	RequiredLevel(ctx context.Context, action string, resource any) StepUpLevel
}

type StepUpRecord struct {
	SessionID   string      `json:"session_id"`
	Level       StepUpLevel `json:"level"`
	CompletedAt time.Time   `json:"completed_at"`
}

type StepUpResult struct {
	// Allowed is true if the current session meets the required level.
	Allowed bool `json:"allowed"`
	// RequiredLevel is the level required for the action.
	RequiredLevel StepUpLevel `json:"required_level"`
	// CurrentLevel is the highest level the session currently has.
	CurrentLevel StepUpLevel `json:"current_level"`
	// ChallengeType suggests which authentication method to use if not allowed.
	ChallengeType string `json:"challenge_type,omitempty"`
}

type StepUpStore interface {
	SaveStepUp(ctx context.Context, record *StepUpRecord) error
	GetStepUp(ctx context.Context, sessionID string) (*StepUpRecord, error)
	DeleteStepUp(ctx context.Context, sessionID string) error
}

type StrategyFactory func(config *domain.StrategyConfig) (LoginStrategy, error)

type StrategyRegistry struct {
	// contains filtered or unexported fields
}

type TOTPStrategy struct{}

type TokenBucketRateLimiter struct {
	// contains filtered or unexported fields
}

type TraitSource interface {
	GetTraits() identity.JSON
	SetTraits(identity.JSON)
}

type VerificationManager struct {
	// contains filtered or unexported fields
}

type WebAuthnConfig struct {
	RPDisplayName string   // Relying Party display name (e.g., "Kayan Auth")
	RPID          string   // Relying Party ID (e.g., "example.com")
	RPOrigins     []string // Allowed origins (e.g., ["https://example.com"])

	// SessionTTL is how long WebAuthn sessions are valid (default: 5 minutes)
	SessionTTL time.Duration

	// Hooks for customizing behavior
	Hooks WebAuthnHooks
}

type WebAuthnCredentialData struct {
	CredentialID    []byte `json:"credential_id"`
	PublicKey       []byte `json:"public_key"`
	AttestationType string `json:"attestation_type"`
	AAGUID          []byte `json:"aaguid"`
	SignCount       uint32 `json:"sign_count"`
	CloneWarning    bool   `json:"clone_warning"`
	BackupEligible  bool   `json:"backup_eligible"`
	BackupState     bool   `json:"backup_state"`
}

type WebAuthnHooks struct {
	// BeforeBeginRegistration is called before starting registration.
	// Return error to prevent registration from starting.
	BeforeBeginRegistration func(ctx context.Context, ident any, userName string) error

	// AfterBeginRegistration is called after registration options are created.
	// Can be used for logging or modifying options.
	AfterBeginRegistration func(ctx context.Context, ident any, sessionID string) error

	// BeforeFinishRegistration is called before completing registration.
	BeforeFinishRegistration func(ctx context.Context, ident any, sessionID string) error

	// AfterFinishRegistration is called after credential is created.
	// Receives the new credential for additional processing.
	AfterFinishRegistration func(ctx context.Context, ident any, cred *identity.Credential) error

	// BeforeBeginLogin is called before starting login ceremony.
	BeforeBeginLogin func(ctx context.Context, identifier string) error

	// AfterBeginLogin is called after login options are created.
	AfterBeginLogin func(ctx context.Context, identifier string, sessionID string) error

	// BeforeFinishLogin is called before completing login.
	BeforeFinishLogin func(ctx context.Context, identifier string, sessionID string) error

	// AfterFinishLogin is called after successful login.
	// Receives the authenticated identity.
	AfterFinishLogin func(ctx context.Context, ident any) error

	// OnCloneWarning is called when a potential credential cloning is detected.
	// This is a security event - log it and consider action.
	OnCloneWarning func(ctx context.Context, ident any, credentialID string)

	// CredentialFilter allows filtering which credentials to use.
	// Return true to include the credential, false to exclude.
	CredentialFilter func(cred *identity.Credential) bool

	// CreateSessionID allows custom session ID generation.
	// If nil, uses default random generation.
	CreateSessionID func() string

	// UserLoader allows custom identity loading for login.
	// If set, bypasses the default identifier-based lookup.
	UserLoader func(ctx context.Context, identifier string) (any, error)

	// CredentialSaver allows custom credential storage.
	// If set, handles credential persistence instead of default behavior.
	CredentialSaver func(ctx context.Context, ident any, cred *identity.Credential) error
}

type WebAuthnSessionData struct {
	Challenge        string    `json:"challenge"`
	UserID           []byte    `json:"user_id"`
	AllowedCredIDs   [][]byte  `json:"allowed_cred_ids,omitempty"`
	UserVerification string    `json:"user_verification"`
	ExpiresAt        time.Time `json:"expires_at"`
}

type WebAuthnSessionStore interface {
	SaveSession(ctx context.Context, sessionID string, data *WebAuthnSessionData) error
	GetSession(ctx context.Context, sessionID string) (*WebAuthnSessionData, error)
	DeleteSession(ctx context.Context, sessionID string) error
}

type WebAuthnStrategy struct {
	// contains filtered or unexported fields
}

type WebAuthnUser struct {
	// contains filtered or unexported fields
}