// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * MFA (Multi-Factor Authentication) Types
 *
 * Type definitions for the MFA system including TOTP authentication,
 * backup codes, and challenge/verification flows.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
// =============================================================================
// Enums and Constants
// =============================================================================
/**
 * MFA methods supported by the system
 */
export const MfaMethod = {
    TOTP: 'totp',
    BACKUP_CODES: 'backup_codes',
};
export const mfaMethodSchema = z.enum(['totp', 'backup_codes']);
/**
 * MFA enrollment and activation status
 */
export const MfaStatus = {
    PENDING: 'pending',
    ACTIVE: 'active',
    DISABLED: 'disabled',
};
export const mfaStatusSchema = z.enum(['pending', 'active', 'disabled']);
/**
 * Default configuration values
 */
export const MFA_DEFAULTS = {
    /** Number of backup codes to generate */
    BACKUP_CODE_COUNT: 10,
    /** Enrollment session expiry in milliseconds (15 minutes) */
    ENROLLMENT_EXPIRY_MS: 15 * 60 * 1000,
    /** Challenge expiry in milliseconds (5 minutes) */
    CHALLENGE_EXPIRY_MS: 5 * 60 * 1000,
    /** Maximum verification attempts before lockout */
    MAX_ATTEMPTS: 5,
    /** Grace period after enabling MFA in milliseconds (24 hours) */
    GRACE_PERIOD_MS: 24 * 60 * 60 * 1000,
};
export const createUserMfaInputSchema = z.object({
    userId: z.string().uuid(),
    tenantId: z.string().uuid(),
    totpSecret: z.string().min(1),
    totpSecretEncrypted: z.boolean().optional().default(true),
});
export const createChallengeInputSchema = z.object({
    userId: z.string().uuid(),
    sessionId: z.string().min(1),
    expiresAt: z.date(),
    maxAttempts: z.number().int().positive().optional(),
});
export const mfaEnrollmentResponseSchema = z.object({
    secret: z.string(),
    otpauthUrl: z.string(),
    qrCode: z.string(),
    expiresAt: z.string().datetime(),
});
export const mfaEnrollmentCompleteResponseSchema = z.object({
    backupCodes: z.array(z.string()),
    backupCodeCount: z.number().int().positive(),
    enabledAt: z.string().datetime(),
    gracePeriodEndsAt: z.string().datetime(),
});
export const mfaStatusResponseSchema = z.object({
    enabled: z.boolean(),
    status: mfaStatusSchema,
    enabledAt: z.string().datetime().nullable(),
    enrollmentPending: z.boolean(),
    backupCodesRemaining: z.number().int().nonnegative(),
    inGracePeriod: z.boolean(),
    gracePeriodEndsAt: z.string().datetime().nullable(),
});
export const mfaChallengeResponseSchema = z.object({
    challengeToken: z.string(),
    expiresAt: z.string().datetime(),
    attemptsRemaining: z.number().int().nonnegative(),
});
export const mfaVerifyResponseSchema = z.object({
    verified: z.boolean(),
    method: mfaMethodSchema.nullable(),
    attemptsRemaining: z.number().int().nonnegative().optional(),
    error: z.string().optional(),
});
export const mfaBackupCodesResponseSchema = z.object({
    backupCodes: z.array(z.string()),
    backupCodeCount: z.number().int().positive(),
    generatedAt: z.string().datetime(),
});
// =============================================================================
// Request Schemas
// =============================================================================
/**
 * Enrollment verification request
 */
export const mfaEnrollVerifyRequestSchema = z.object({
    code: z.string().length(6).regex(/^\d+$/, 'Code must be 6 digits'),
});
/**
 * Challenge verification request
 */
export const mfaChallengeVerifyRequestSchema = z.object({
    challengeToken: z.string().min(1),
    code: z.string().min(1),
});
export const mfaServiceConfigSchema = z.object({
    issuer: z.string().default('Vorion'),
    backupCodeCount: z.number().int().positive().default(MFA_DEFAULTS.BACKUP_CODE_COUNT),
    enrollmentExpiryMs: z.number().int().positive().default(MFA_DEFAULTS.ENROLLMENT_EXPIRY_MS),
    challengeExpiryMs: z.number().int().positive().default(MFA_DEFAULTS.CHALLENGE_EXPIRY_MS),
    maxAttempts: z.number().int().positive().default(MFA_DEFAULTS.MAX_ATTEMPTS),
    gracePeriodMs: z.number().int().positive().default(MFA_DEFAULTS.GRACE_PERIOD_MS),
    encryptSecrets: z.boolean().default(true),
});
export const mfaMiddlewareOptionsSchema = z.object({
    allowGracePeriod: z.boolean().optional().default(true),
    skipPaths: z.array(z.string()).optional(),
});
//# sourceMappingURL=types.js.map