| | | 1 | | using ArturRios.Mediator.Command; |
| | | 2 | | |
| | | 3 | | namespace ArturRios.Heimdall.Command.Output; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// Result of <see cref="Input.GoogleSignInCommand" /> (UC-25): the issued authentication token |
| | | 7 | | /// and when it expires. The same shape as <see cref="LoginCommandOutput" />, because a Google |
| | | 8 | | /// User ends up holding the same kind of token a password login yields — the claims carry the |
| | | 9 | | /// Google User's and the scope's <c>PublicId</c>s (NFR-15), so nothing about the account is |
| | | 10 | | /// repeated here. |
| | | 11 | | /// </summary> |
| | | 12 | | /// <remarks> |
| | | 13 | | /// Says nothing about whether this call signed the account up or signed it in. UC-25 specifies |
| | | 14 | | /// one response for both, and a caller has no use for the distinction: either way they are |
| | | 15 | | /// authenticated, and the Google User row exists. |
| | | 16 | | /// </remarks> |
| | | 17 | | public class GoogleSignInCommandOutput : CommandOutput |
| | | 18 | | { |
| | | 19 | | /// <summary>The signed authentication token, to be sent as a bearer token.</summary> |
| | 128 | 20 | | public string Token { get; set; } = string.Empty; |
| | | 21 | | |
| | | 22 | | /// <summary>When the token expires, in UTC.</summary> |
| | 69 | 23 | | public DateTime ExpiresAt { get; set; } |
| | | 24 | | |
| | | 25 | | /// <summary> |
| | | 26 | | /// Whether the account's email address is verified (FR-EV-05): the Google User's stored |
| | | 27 | | /// flag, refreshed from the ID token verified in this same request whenever that token |
| | | 28 | | /// carried an <c>email_verified</c> claim (FR-GO-19). The token is the fresher of the two |
| | | 29 | | /// when it speaks; when it is silent the stored value stands, so the field always has an |
| | | 30 | | /// answer. |
| | | 31 | | /// </summary> |
| | 75 | 32 | | public bool EmailVerified { get; set; } |
| | | 33 | | |
| | | 34 | | /// <summary> |
| | | 35 | | /// True when processing of the identity is restricted (NFR-24), so <see cref="Token" /> is a |
| | | 36 | | /// subject-rights-only token: it is accepted only where the subject exports, erases, restricts, |
| | | 37 | | /// or lifts their own restriction (UC-41, UC-42, UC-44, UC-45), and refused everywhere else. |
| | | 38 | | /// A client should offer those actions — lifting the restriction above all — and ask the |
| | | 39 | | /// subject to sign in again once it is lifted, for a full token. |
| | | 40 | | /// </summary> |
| | 38 | 41 | | public bool ProcessingRestricted { get; set; } |
| | | 42 | | } |