auth

const (
	// AvEOL (0x0000) marks end of AV_PAIR list.
	// Every TargetInfo MUST end with this terminator.
	AvEOL AvID = 0x0000

	// AvNbComputerName (0x0001) contains the server's NetBIOS name.
	// Example: "FILESERVER"
	AvNbComputerName AvID = 0x0001

	// AvNbDomainName (0x0002) contains the NetBIOS domain name.
	// Example: "CORP" or "WORKGROUP" for standalone servers
	AvNbDomainName AvID = 0x0002

	// AvDnsComputerName (0x0003) contains the server's DNS hostname.
	// Example: "fileserver.corp.com"
	AvDnsComputerName AvID = 0x0003

	// AvDnsDomainName (0x0004) contains the DNS domain name.
	// Example: "corp.com"
	AvDnsDomainName AvID = 0x0004

	// AvTimestamp (0x0007) contains the server's FILETIME timestamp.
	// Used by NTLMv2 for replay protection.
	AvTimestamp AvID = 0x0007
)

const (
	// ErrMessageTooShort is returned when the buffer is too small for the message type.
	ErrMessageTooShort Error = "ntlm: message too short"

	// ErrInvalidSignature is returned when the NTLMSSP signature is missing or invalid.
	ErrInvalidSignature Error = "ntlm: invalid signature"

	// ErrWrongMessageType is returned when parsing a message of unexpected type.
	ErrWrongMessageType Error = "ntlm: wrong message type"

	// ErrAuthenticationFailed is returned when NTLMv2 validation fails.
	ErrAuthenticationFailed Error = "ntlm: authentication failed"

	// ErrResponseTooShort is returned when NT response is too short.
	ErrResponseTooShort Error = "ntlm: response too short"
)

const (
	// Negotiate (Type 1) is sent by the client to initiate authentication.
	// Contains client capabilities and optional domain/workstation names.
	Negotiate MessageType = 1

	// Challenge (Type 2) is sent by the server in response to Type 1.
	// Contains the server challenge and negotiated flags.
	Challenge MessageType = 2

	// Authenticate (Type 3) is sent by the client to complete authentication.
	// Contains the challenge response computed from user credentials.
	Authenticate MessageType = 3
)

const (
	// NegStateAcceptCompleted indicates successful authentication.
	NegStateAcceptCompleted NegState = 0

	// NegStateAcceptIncomplete indicates more tokens are needed.
	NegStateAcceptIncomplete NegState = 1

	// NegStateReject indicates authentication was rejected.
	NegStateReject NegState = 2

	// NegStateRequestMIC indicates a MIC is required.
	NegStateRequestMIC NegState = 3
)

const (
	// FlagUnicode (bit A) indicates Unicode character set encoding.
	// When set, strings are encoded as UTF-16LE.
	FlagUnicode NegotiateFlag = 0x00000001

	// FlagOEM (bit B) indicates OEM character set encoding.
	// When set, strings use the OEM code page.
	FlagOEM NegotiateFlag = 0x00000002

	// FlagRequestTarget (bit C) requests the server's authentication realm.
	// Server responds with TargetName in Type 2 message.
	FlagRequestTarget NegotiateFlag = 0x00000004

	// FlagSign (bit D) indicates message integrity support.
	// Enables MAC generation for signed messages.
	FlagSign NegotiateFlag = 0x00000010

	// FlagSeal (bit E) indicates message confidentiality support.
	// Enables encryption for sealed messages.
	FlagSeal NegotiateFlag = 0x00000020

	// FlagLMKey (bit G) indicates LAN Manager session key computation.
	// Deprecated; should not be used with NTLMv2.
	FlagLMKey NegotiateFlag = 0x00000080

	// FlagNTLM (bit I) indicates NTLM v1 authentication support.
	// Required for compatibility with older clients.
	FlagNTLM NegotiateFlag = 0x00000200

	// FlagAnonymous (bit K) indicates anonymous authentication.
	// Used when client has no credentials.
	FlagAnonymous NegotiateFlag = 0x00000800

	// FlagDomainSupplied (bit L) indicates domain name is present.
	// Set when Type 1 message contains domain name.
	FlagDomainSupplied NegotiateFlag = 0x00001000

	// FlagWorkstationSupplied (bit M) indicates workstation name is present.
	// Set when Type 1 message contains workstation name.
	FlagWorkstationSupplied NegotiateFlag = 0x00002000

	// FlagAlwaysSign (bit O) requires signing for all messages.
	// Even if signing is not negotiated, dummy signature is included.
	FlagAlwaysSign NegotiateFlag = 0x00008000

	// FlagTargetTypeDomain (bit P) indicates target is a domain.
	// Mutually exclusive with FlagTargetTypeServer.
	FlagTargetTypeDomain NegotiateFlag = 0x00010000

	// FlagTargetTypeServer (bit Q) indicates target is a server.
	// Mutually exclusive with FlagTargetTypeDomain.
	FlagTargetTypeServer NegotiateFlag = 0x00020000

	// FlagExtendedSecurity (bit S) indicates extended session security.
	// Enables NTLMv2 session security.
	FlagExtendedSecurity NegotiateFlag = 0x00080000

	// FlagTargetInfo (bit W) indicates TargetInfo is present.
	// Type 2 message includes AV_PAIR list.
	FlagTargetInfo NegotiateFlag = 0x00800000

	// FlagVersion (bit Y) indicates version field is present.
	// Includes OS version information.
	FlagVersion NegotiateFlag = 0x02000000

	// Flag128 (bit Z) indicates 128-bit encryption support.
	// Required for strong encryption.
	Flag128 NegotiateFlag = 0x20000000

	// FlagKeyExch (bit V) indicates key exchange support.
	// When set, the client generates a random session key (ExportedSessionKey)
	// and encrypts it with RC4 using the SessionBaseKey. The encrypted key
	// is sent in the EncryptedRandomSessionKey field of the AUTHENTICATE message.
	// The ExportedSessionKey becomes the SigningKey instead of SessionBaseKey.
	FlagKeyExch NegotiateFlag = 0x40000000

	// Flag56 (bit AA) indicates 56-bit encryption support.
	// Legacy; 128-bit is preferred.
	Flag56 NegotiateFlag = 0x80000000
)

const (
	// TokenTypeInit is a NegTokenInit (client's first message).
	TokenTypeInit TokenType = iota

	// TokenTypeResp is a NegTokenResp (server response or subsequent client message).
	TokenTypeResp
)