| | | 1 | | using ArturRios.Mediator.Command; |
| | | 2 | | |
| | | 3 | | namespace ArturRios.Heimdall.Command.Output; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// Result of <see cref="Input.VerifyTwoFactorAuthCommand" /> (UC-38): the full authentication |
| | | 7 | | /// token issued once a second factor checked out (FR-2F-09) — the same shape |
| | | 8 | | /// <see cref="LoginCommandOutput" />'s direct-login success case returns, since a UC-38 login |
| | | 9 | | /// ends exactly like an ungated one. |
| | | 10 | | /// </summary> |
| | | 11 | | public class VerifyTwoFactorAuthCommandOutput : CommandOutput |
| | | 12 | | { |
| | | 13 | | /// <summary>The signed authentication token, to be sent as a bearer token.</summary> |
| | 145 | 14 | | public string Token { get; set; } = string.Empty; |
| | | 15 | | |
| | | 16 | | /// <summary>When the token expires, in UTC.</summary> |
| | 74 | 17 | | public DateTime ExpiresAt { get; set; } |
| | | 18 | | |
| | | 19 | | /// <summary> |
| | | 20 | | /// Whether the authenticated person's email address is verified (FR-EV-05), reported here |
| | | 21 | | /// rather than on UC-11's challenge response — the same value a direct login returns, since a |
| | | 22 | | /// UC-38 login ends exactly like an ungated one. |
| | | 23 | | /// </summary> |
| | 75 | 24 | | public bool EmailVerified { get; set; } |
| | | 25 | | |
| | | 26 | | /// <summary> |
| | | 27 | | /// True when processing of the identity is restricted (NFR-24), so <see cref="Token" /> is a |
| | | 28 | | /// subject-rights-only token: it is accepted only where the subject exports, erases, restricts, |
| | | 29 | | /// or lifts their own restriction (UC-41, UC-42, UC-44, UC-45), and refused everywhere else. |
| | | 30 | | /// A client should offer those actions — lifting the restriction above all — and ask the |
| | | 31 | | /// subject to sign in again once it is lifted, for a full token. |
| | | 32 | | /// </summary> |
| | 49 | 33 | | public bool ProcessingRestricted { get; set; } |
| | | 34 | | } |