| | | 1 | | using ArturRios.Mediator.Command; |
| | | 2 | | |
| | | 3 | | namespace ArturRios.Heimdall.Command.Output; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// Result of <see cref="Input.LoginCommand" /> (UC-11): either the issued authentication token |
| | | 7 | | /// and when it expires (FR-AU-03), or — AF-11g, when the person has active two-factor |
| | | 8 | | /// authentication — a short-lived challenge token and the second-factor methods available, |
| | | 9 | | /// leaving <see cref="Token" />/<see cref="ExpiresAt" /> unset. <see cref="RequiresTwoFactor" /> |
| | | 10 | | /// tells a caller which shape they got. The full token's own claims carry the person's and |
| | | 11 | | /// scopes' <c>PublicId</c>s (FR-AU-04); the only thing about the person repeated here is |
| | | 12 | | /// <see cref="EmailVerified" />, which no claim carries. |
| | | 13 | | /// </summary> |
| | | 14 | | public class LoginCommandOutput : CommandOutput |
| | | 15 | | { |
| | | 16 | | /// <summary>The signed authentication token, to be sent as a bearer token. Null when <see cref="RequiresTwoFactor" |
| | 247 | 17 | | public string? Token { get; set; } |
| | | 18 | | |
| | | 19 | | /// <summary>When the token expires, in UTC. Null when <see cref="RequiresTwoFactor" /> is true.</summary> |
| | 217 | 20 | | public DateTime? ExpiresAt { get; set; } |
| | | 21 | | |
| | | 22 | | /// <summary> |
| | | 23 | | /// Whether the authenticated person's email address is verified (FR-EV-05), so a caller |
| | | 24 | | /// knows whether to prompt them and offer <c>POST /api/auth/resend-verification</c> (UC-15). |
| | | 25 | | /// Null when <see cref="RequiresTwoFactor" /> is true: the caller has passed only the first |
| | | 26 | | /// factor and is not authenticated yet, so this response tells them nothing about the |
| | | 27 | | /// account. They receive it from <c>POST /api/auth/2fa/verify</c> instead (UC-38). |
| | | 28 | | /// </summary> |
| | 221 | 29 | | public bool? EmailVerified { get; set; } |
| | | 30 | | |
| | | 31 | | /// <summary> |
| | | 32 | | /// AF-11g (FR-2F-07): true when the person has active two-factor authentication, so this |
| | | 33 | | /// response carries a challenge token instead of a full one — see UC-38. |
| | | 34 | | /// </summary> |
| | 202 | 35 | | public bool RequiresTwoFactor { get; set; } |
| | | 36 | | |
| | | 37 | | /// <summary> |
| | | 38 | | /// The short-lived UC-38 challenge token (NFR-17), present only when |
| | | 39 | | /// <see cref="RequiresTwoFactor" /> is true. Submitted to <c>POST /api/auth/2fa/verify</c> as |
| | | 40 | | /// a request body field — never as a bearer credential (FR-2F-10). |
| | | 41 | | /// </summary> |
| | 217 | 42 | | public string? ChallengeToken { get; set; } |
| | | 43 | | |
| | | 44 | | /// <summary> |
| | | 45 | | /// The second-factor methods available to the person — <c>["App"]</c>, <c>["Email"]</c>, or |
| | | 46 | | /// both — present only when <see cref="RequiresTwoFactor" /> is true. |
| | | 47 | | /// </summary> |
| | 187 | 48 | | public IReadOnlyCollection<string>? AvailableMethods { get; set; } |
| | | 49 | | |
| | | 50 | | /// <summary> |
| | | 51 | | /// True when processing of the identity is restricted (NFR-24), so <see cref="Token" /> is a |
| | | 52 | | /// subject-rights-only token: it is accepted only where the subject exports, erases, restricts, |
| | | 53 | | /// or lifts their own restriction (UC-41, UC-42, UC-44, UC-45), and refused everywhere else. |
| | | 54 | | /// A client should offer those actions — lifting the restriction above all — and ask the |
| | | 55 | | /// subject to sign in again once it is lifted, for a full token. |
| | | 56 | | /// </summary> |
| | 168 | 57 | | public bool ProcessingRestricted { get; set; } |
| | | 58 | | } |