webauthn

type Authenticator interface {
	WebAuthID() []byte
	WebAuthCredentialID() []byte
	WebAuthPublicKey() []byte
	WebAuthAAGUID() []byte
	WebAuthSignCount() uint32
}

type AuthenticatorStore interface {
	// AddAuthenticator should add the given authenticator to a user. The authenticator's type should not be depended
	// on; it is constructed by this package. All information should be stored in a way such that it is retrievable
	// in the future using GetAuthenticator and GetAuthenticators.
	AddAuthenticator(user User, authenticator Authenticator) error
	// GetAuthenticator gets a single Authenticator by the given id, as returned by Authenticator.WebAuthID.
	GetAuthenticator(id []byte) (Authenticator, error)
	// GetAuthenticators gets a list of all registered authenticators for this user. It might be the case that the user
	// has been constructed by this package and the only non-empty value is the WebAuthID. In this case, the store
	// should still return the authenticators as specified by the ID.
	GetAuthenticators(user User) ([]Authenticator, error)
}

type Config struct {
	// RelyingPartyName is a human-palatable identifier for the Relying Party, intended only for display. For example,
	// "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".
	RelyingPartyName string
	// RelyingPartyID is a unique identifier for the Relying Party entity. It must be a valid domain string that
	// identifies the Relying Party on whose behalf a registration or login is being performed. A public key credential
	// can only be used for authentication with the same RP ID it was registered with.
	// By default, it is set to the caller's origin effective domain. It may be overridden, as long as the RP ID is
	// a registrable domain suffix or is equal to the caller's effective domain.
	// For example, given a Relying Party whose origin is https://login.example.com:1337, then the following RP IDs
	// are valid: login.example.com (default) and example.com, but not m.login.example.com and not com.
	// In production, this value should be set. If it is not set, the implementation is INSECURE and the RP ID hash
	// supplied by the authenticator will not be checked.
	RelyingPartyID string
	// RelyingPartyOrigin is the RP origin that an authenticator response will be compared with. If it is empty,
	// the value will be ignored. However, this is INSECURE and should not be used in production.
	// For example, given a Relying Party whose origin is https://login.example.com:1337, this value should be set
	// to "https://login.example.com:1337".
	RelyingPartyOrigin string

	// AuthenticatorStore will be used to store authenticators of a user.
	AuthenticatorStore AuthenticatorStore

	// SessionKeyPrefixChallenge holds the prefix of the key of the challenge in the session. If it is not set, it will
	// be set to "webauthn.challenge".
	SessionKeyPrefixChallenge string
	// SessionKeyPrefixUserID holds the prefix of the key of the user ID in the session. If it is not set, it will be
	// set to "webauthn.user.id".
	SessionKeyPrefixUserID string

	// Timeout is the amount of time in milliseconds the user will be permitted to authenticate with their device on
	// registration and login. The default is 30000, i.e. 30 seconds.
	Timeout uint

	// Debug sets a few settings related to ease of debugging, such as sharing more error information to clients.
	Debug bool
}

type Session interface {
	Set(name string, value interface{}) error
	Get(name string) (interface{}, error)
	Delete(name string) error
}

type User interface {
	// WebAuthID should return the ID of the user. This could for example be the binary encoding of an int.
	WebAuthID() []byte
	// WebAuthName should return the name of the user.
	WebAuthName() string
	// WebAuthDisplayName should return the display name of the user.
	WebAuthDisplayName() string
}

type WebAuthn struct {
	Config *Config
}