passkey

type AssertionResponse struct {
	ID       string `json:"id"`    // Credential ID
	Type     string `json:"type"`  // Must be "public-key"
	RawID    string `json:"rawId"` // Base64url-encoded credential ID
	Response struct {
		AuthenticatorData string `json:"authenticatorData"` // Base64url-encoded authenticator data
		ClientDataJSON    string `json:"clientDataJSON"`    // Base64url-encoded client data JSON
		Signature         string `json:"signature"`         // Base64url-encoded signature
		UserHandle        string `json:"userHandle"`        // Optional base64url-encoded user handle
	} `json:"response"`
}

type AttestationObject struct {
	Format               string         `cbor:"fmt"`      // Format specifies the attestation format (e.g., "packed", "fido-u2f").
	AuthData             []byte         `cbor:"authData"` // AuthData contains authenticator data, including the credential public key and metadata.
	AttestationStatement map[string]any `cbor:"attStmt"`  // AttestationStatement includes the attestation statement specific to the format.
}

type AuthenticatorSelection struct {
	UserVerification string `json:"userVerification"`      // Requirement level for user verification ("required", "preferred", "discouraged").
	ResidentKey      string `json:"residentKey,omitempty"` // Optional: whether a resident key is required.
}

type ClientData struct {
	Type      string `json:"type"`      // Operation type: "webauthn.create" or "webauthn.get"
	Challenge string `json:"challenge"` // Base64url-encoded challenge string
	Origin    string `json:"origin"`    // Origin of the request (e.g., "https://example.com")
}

type CreateOptionsParams struct {
	RPID             string
	RPName           string
	UserID           []byte // raw user ID (will be base64url-encoded internally)
	UserName         string
	DisplayName      string
	Challenge        string
	Attestation      string // "none", "direct", etc.
	UserVerification string // "preferred", etc.
	ResidentKey      string // optional
	TimeoutMs        int    // optional
}

type ParsedAssertion struct {
	Raw        AssertionResponse
	AuthData   []byte
	ClientData []byte
	Signature  []byte
	UserHandle []byte // may be nil
}

type ParsedAuthData struct {
	RPIDHash  []byte      // SHA-256 hash of the relying party ID.
	Flags     byte        // Flags indicating the state of the authenticator data.
	SignCount uint32      // Signature counter, used to detect cloned authenticators.
	AAGUID    []byte      // Authenticator Attestation GUID (globally unique identifier).
	CredID    []byte      // Credential ID assigned by the authenticator.
	PublicKey map[int]any // Parsed COSE public key.
}

type PasskeyError struct {
	Code       string // e.g. "E1001"
	Message    string // human-readable message
	HTTPStatus int    // HTTP status code to return
	Field      string // optional: field name for validation errors
}

type PublicKeyCredentialCreationOptions struct {
	Challenge              string                          `json:"challenge"`                        // A unique, random challenge generated by the server.
	RP                     RelyingPartyEntity              `json:"rp"`                               // Information about the relying party (server).
	User                   UserEntity                      `json:"user"`                             // Information about the user creating the credential.
	PubKeyCredParams       []PublicKeyCredentialParameters `json:"pubKeyCredParams"`                 // List of supported public key credential parameters.
	Timeout                int                             `json:"timeout,omitempty"`                // Optional timeout in milliseconds for the credential creation.
	Attestation            string                          `json:"attestation,omitempty"`            // Attestation preference ("none", "indirect", "direct").
	AuthenticatorSelection AuthenticatorSelection          `json:"authenticatorSelection,omitempty"` // Preferences for selecting an authenticator.
}

type PublicKeyCredentialParameters struct {
	Type string `json:"type"` // Credential type, typically "public-key".
	Alg  int    `json:"alg"`  // Cryptographic algorithm identifier (-7: ES256, -257: RS256).
}

type PublicKeyRecord struct {
	Key *ecdsa.PublicKey // ECDSA public key used for authentication.
}

type RelyingPartyEntity struct {
	Name string `json:"name"` // Human-readable name of the relying party.
	ID   string `json:"id"`   // Relying party identifier (usually the domain).
}

type UserEntity struct {
	ID          string `json:"id"`          // User identifier (must be base64url-encoded binary ID).
	Name        string `json:"name"`        // User handle, typically the username.
	DisplayName string `json:"displayName"` // User's display name.
}