anode

type AdminLock struct {
	// IsPasswordLocked indicates whether the password is locked.
	// This can be set to true in two scenarios:
	// 1. The admin manually sets this value to true when managing the user account.
	// 2. The password is empty or the account requires a password reset.
	IsPasswordLocked bool `json:"isPasswordLocked,omitempty"`

	// Date is the actual date when the account was locked.
	Date *time.Time `json:"lockedDate,omitempty"`

	// Message provides the reason for the account lock.
	Message string `json:"message,omitempty"`

	// RequestResetPassword is the date when the admin requested the user to create/reset the password.
	// If this is set, the user is forced to set the password on login, regardless of the IsPasswordLocked value.
	// If IsPasswordLocked is true and RequestResetPassword is valid, the password can only be reset via an email link,
	// whether initiated by the admin or through the forgot-login process.
	RequestResetPassword *time.Time `json:"requestResetPassword,omitempty"`
}

type JWTUserToken struct {
	AccessToken  string `json:"accessToken,omitempty"`  // Access tokens are expected to be JWT.
	RefreshToken string `json:"refreshToken,omitempty"` // Refresh tokens are expected to be JWT.
	// contains filtered or unexported fields
}

type RoboCredential struct {
	PublicKey        acrypt.CryptKeyBase64 `json:"publicKey,omitempty"`    // Subscriber's public key
	PrivateKey       acrypt.SecretsValue   `json:"privateKey"`             // Secure storage for private key
	AccessToken      string                `json:"accessToken,omitempty"`  // JWT Access Token
	RefreshToken     string                `json:"refreshToken,omitempty"` // JWT Refresh Token
	TokenExpiresAt   time.Time             `json:"-"`                      // Expiration time for the access token
	RefreshExpiresAt time.Time             `json:"-"`                      // Expiration time for the refresh token
	IsTokenValid     bool                  `json:"-"`                      // Tracks token validity
	// contains filtered or unexported fields
}

type UserAccount struct {
	// IsDeactivated indicates whether the user account is deactivated.
	IsDeactivated bool `json:"isDeactivated"`

	// MFA contains Multi-Factor Authentication settings.
	MFA struct {
		// TOTP holds the current TOTP (Time-based One-Time Password) configuration.
		TOTP UserAccountIsOnMFA `json:"totp,omitempty"`
		// TOTPNew holds the new TOTP configuration when regenerating a TOTP key.
		// This keeps the original TOTP in place to prevent a security leak.
		TOTPNew *UserAccountIsOnMFA `json:"totpNew,omitempty"`
	} `json:"mfa,omitempty"`

	// Email is required.
	// Depending on the site operation, email could parallel the username.
	// For Username, see UserVault.Credentials.Username.
	Email aemail.EmailAddress `json:"email,omitempty"`

	// Phone is optional but could be required based on the system implementing this struct.
	// Depending on the site operation, email could parallel the username.
	Phone acontact.Phone `json:"phone,omitempty"`

	// Logins holds the history of login sessions.
	Logins asessions.LoginSessionDeviceDates `json:"logins,omitempty"`

	// LDS holds the legal document signatures.
	LDS alegal.LegalDocSignatures `json:"lds"`

	// Roles holds the roles assigned to the user.
	Roles asessions.Roles `json:"roles"`

	// AdminLock holds the admin lock status of the account.
	AdminLock AdminLock `json:"adminLock,omitempty"`
}

type UserAccountIsOnMFA struct {
	// IsOn indicates whether MFA is enabled for the user account.
	IsOn bool `json:"isOn,omitempty"`

	// Created is the timestamp when MFA was enabled.
	Created *time.Time `json:"created,omitempty"`

	// Verified is the timestamp when MFA was verified.
	Verified *time.Time `json:"verified,omitempty"`
}

type UserBase struct {
	// UID is the primary user ID for the node.
	UID auser.UID `json:"uid,omitempty"`

	// LanguageType defines the language that should be displayed for this user.
	// LanguageType logic is as follows:
	// 1. If the user is unknown, check if the existing session has a LanguageType:
	//    a. If yes, then use it.
	//    b. If no, then use the LanguageType from the client-browser.
	// 2. If the user is known, then get the preferred language from the saved user:
	//    a. If the preferred language is empty, then use the existing session language.
	//    b. If both preferred language and existing session language are unknown, then use the LanguageType from the client-browser.
	// Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language
	LanguageType autils.LanguageType `json:"langType"`

	// LastAccess is optional and can be used in different ways.
	// For example, LastAccess may represent:
	// 1. The last "profile/domain switch" of the user (reasonable).
	// 2. It could be updated each time an action was performed on the account (heavier CPU).
	// 3. It is the same as the loginDate (not recommended as it could be confused with #1).
	LastAccess *time.Time `json:"lastAccess,omitempty"`
}

type UserCredential struct {
	JWTUserToken
	Username auser.Username `json:"username,omitempty"`
	Password string         `json:"password,omitempty"` // Password is a hashed password using Argon2id.

	// AuthName is optionally used as the name of the
	// connection adapter, link or id used for authentication.
	// Implementation depends on the calling program.
	AuthName string `json:"authName"`

	WhitelistIPs []string `json:"whitelistIPs,omitempty"`
	// contains filtered or unexported fields
}

type UserVault struct {
	// Credential holds the user's credentials.
	Credential UserCredential `json:"credential,omitempty"`

	// TOTP holds the current TOTP (Time-based One-Time Password) configuration.
	TOTP acrypt.TOTP `json:"totp,omitempty"`

	// TOTPNew holds the new TOTP configuration, if any.
	TOTPNew *acrypt.TOTP `json:"totpNew,omitempty"`

	// TokenBackups holds the backup tokens for the user.
	TokenBackupsDate *time.Time             `json:"tokenBackupsDate,omitempty"`
	TokenBackups     acrypt.MiniRandomCodes `json:"tokenBackups,omitempty"`

	// Support contains the support pin used to verify a user instead of a social security number.
	Support struct {
		Pin acrypt.IdBrief `json:"pin,omitempty"`
	} `json:"support,omitempty"`
}