// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * WebAuthn/Passkey Authentication Type Definitions
 *
 * Defines types, interfaces, and Zod schemas for WebAuthn credential management,
 * registration, and authentication flows.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
export const authenticatorTransportSchema = z.enum([
    'usb',
    'ble',
    'nfc',
    'internal',
    'cable',
    'hybrid',
    'smart-card',
]);
export const webAuthnCredentialSchema = z.object({
    id: z.string().uuid(),
    credentialId: z.string().min(1),
    publicKey: z.string().min(1),
    counter: z.number().int().min(0),
    transports: z.array(authenticatorTransportSchema).optional(),
    createdAt: z.date(),
    lastUsedAt: z.date().nullable(),
    name: z.string().min(1).max(255),
    userId: z.string().min(1),
    deviceType: z.string().optional(),
    backedUp: z.boolean().optional(),
    aaguid: z.string().optional(),
});
export const generateRegistrationOptionsInputSchema = z.object({
    userId: z.string().min(1),
    userName: z.string().min(1).max(255),
    userDisplayName: z.string().min(1).max(255).optional(),
    authenticatorType: z.enum(['platform', 'cross-platform']).optional(),
    requireUserVerification: z.boolean().optional(),
});
export const registrationOptionsSchema = z.object({
    options: z.any(), // PublicKeyCredentialCreationOptionsJSON is complex
    challenge: z.string().min(1),
});
export const verifyRegistrationInputSchema = z.object({
    userId: z.string().min(1),
    response: z.any(), // RegistrationResponseJSON is complex
    credentialName: z.string().min(1).max(255).optional(),
});
/**
 * Registration error codes
 */
export const RegistrationErrorCode = {
    /** Challenge not found or expired */
    CHALLENGE_NOT_FOUND: 'CHALLENGE_NOT_FOUND',
    /** Challenge has expired */
    CHALLENGE_EXPIRED: 'CHALLENGE_EXPIRED',
    /** Verification failed */
    VERIFICATION_FAILED: 'VERIFICATION_FAILED',
    /** Credential already exists */
    CREDENTIAL_EXISTS: 'CREDENTIAL_EXISTS',
    /** Invalid response format */
    INVALID_RESPONSE: 'INVALID_RESPONSE',
    /** User not found */
    USER_NOT_FOUND: 'USER_NOT_FOUND',
};
export const registrationResultSchema = z.object({
    verified: z.boolean(),
    credential: webAuthnCredentialSchema.optional(),
    error: z.string().optional(),
    errorCode: z.nativeEnum(RegistrationErrorCode).optional(),
});
export const generateAuthenticationOptionsInputSchema = z.object({
    userId: z.string().min(1).optional(),
    requireUserVerification: z.boolean().optional(),
});
export const authenticationOptionsSchema = z.object({
    options: z.any(), // PublicKeyCredentialRequestOptionsJSON is complex
    challenge: z.string().min(1),
});
export const verifyAuthenticationInputSchema = z.object({
    userId: z.string().min(1),
    response: z.any(), // AuthenticationResponseJSON is complex
});
/**
 * Authentication error codes
 */
export const AuthenticationErrorCode = {
    /** Challenge not found or expired */
    CHALLENGE_NOT_FOUND: 'CHALLENGE_NOT_FOUND',
    /** Challenge has expired */
    CHALLENGE_EXPIRED: 'CHALLENGE_EXPIRED',
    /** Credential not found */
    CREDENTIAL_NOT_FOUND: 'CREDENTIAL_NOT_FOUND',
    /** Verification failed */
    VERIFICATION_FAILED: 'VERIFICATION_FAILED',
    /** Counter rollback detected (potential cloned authenticator) */
    COUNTER_ROLLBACK: 'COUNTER_ROLLBACK',
    /** User has no credentials */
    NO_CREDENTIALS: 'NO_CREDENTIALS',
    /** Invalid response format */
    INVALID_RESPONSE: 'INVALID_RESPONSE',
    /** User not found */
    USER_NOT_FOUND: 'USER_NOT_FOUND',
};
export const authenticationResultSchema = z.object({
    verified: z.boolean(),
    credential: webAuthnCredentialSchema.optional(),
    userId: z.string().optional(),
    error: z.string().optional(),
    errorCode: z.nativeEnum(AuthenticationErrorCode).optional(),
});
export const webAuthnConfigSchema = z.object({
    rpName: z.string().min(1).max(255),
    rpId: z.string().min(1),
    origin: z.union([z.string().url(), z.array(z.string().url())]),
    attestation: z.enum(['none', 'direct', 'enterprise']),
    userVerification: z.enum(['required', 'preferred', 'discouraged']),
    timeout: z.number().int().positive().max(600000),
    authenticatorAttachment: z.enum(['platform', 'cross-platform']).optional(),
    residentKey: z.enum(['required', 'preferred', 'discouraged']),
    challengeTTL: z.number().int().positive().max(600000),
    supportedAlgorithms: z.array(z.number().int()),
});
/**
 * Default WebAuthn configuration
 */
export const DEFAULT_WEBAUTHN_CONFIG = {
    rpName: 'Vorion Platform',
    rpId: 'localhost',
    origin: 'http://localhost:3000',
    attestation: 'none',
    userVerification: 'preferred',
    timeout: 60000,
    residentKey: 'preferred',
    challengeTTL: 300000, // 5 minutes
    supportedAlgorithms: [-7, -257], // ES256 and RS256
};
export const listCredentialsInputSchema = z.object({
    userId: z.string().min(1),
    limit: z.number().int().min(1).max(100).default(50),
    offset: z.number().int().min(0).default(0),
});
export const renameCredentialInputSchema = z.object({
    userId: z.string().min(1),
    credentialId: z.string().uuid(),
    name: z.string().min(1).max(255),
});
export const deleteCredentialInputSchema = z.object({
    userId: z.string().min(1),
    credentialId: z.string().uuid(),
});
// =============================================================================
// AUDIT EVENT TYPES
// =============================================================================
/**
 * Audit event types for WebAuthn operations
 */
export const WebAuthnAuditEventType = {
    REGISTRATION_OPTIONS_GENERATED: 'webauthn.registration_options_generated',
    REGISTRATION_COMPLETED: 'webauthn.registration_completed',
    REGISTRATION_FAILED: 'webauthn.registration_failed',
    AUTHENTICATION_OPTIONS_GENERATED: 'webauthn.authentication_options_generated',
    AUTHENTICATION_COMPLETED: 'webauthn.authentication_completed',
    AUTHENTICATION_FAILED: 'webauthn.authentication_failed',
    COUNTER_ROLLBACK_DETECTED: 'webauthn.counter_rollback_detected',
    CREDENTIAL_DELETED: 'webauthn.credential_deleted',
    CREDENTIAL_RENAMED: 'webauthn.credential_renamed',
};
export const challengeEntrySchema = z.object({
    challenge: z.string().min(1),
    userId: z.string().min(1),
    type: z.enum(['registration', 'authentication']),
    expiresAt: z.number().int().positive(),
    createdAt: z.date(),
});
//# sourceMappingURL=types.js.map