eric / rustwarden

//! SeaORM entity for `fediverse_auth_challenges` (RFC 0006).
//!
//! State machine row backing the AP-native authentication flow on the
//! client (`b.tld`) side.

use chrono::{DateTime, Utc};
use sea_orm::entity::prelude::*;
use serde::{Deserialize, Serialize};
use uuid::Uuid;

/// Persistent record of one in-flight authentication challenge.
#[derive(Clone, Debug, Serialize, Deserialize, DeriveEntityModel)]
#[sea_orm(table_name = "fediverse_auth_challenges")]
pub struct Model {
    /// Stable PK.
    #[sea_orm(primary_key, auto_increment = false)]
    pub id: Uuid,
    /// 256-bit URL-safe base64 nonce embedded in the AP `AuthRequest`
    /// activity. Must match the nonce echoed by the IdP `Accept`.
    #[sea_orm(unique)]
    pub nonce: String,
    /// `@user@domain` handle the user typed (verbatim).
    pub handle: String,
    /// Domain part of the handle (lowercased).
    pub domain: String,
    /// Optional FK to `remote_identities.id` once the IdP has approved
    /// the challenge.
    pub requested_remote_id: Option<Uuid>,
    /// `pending`, `approved`, `rejected`, `expired`, or `consumed`.
    pub status: String,
    /// Where to redirect the browser after a successful approve.
    pub redirect_url: Option<String>,
    /// Insertion timestamp.
    pub created_at: DateTime<Utc>,
    /// Hard deadline (`created_at + ttl`) after which the row is
    /// considered `Expired` regardless of status.
    pub expires_at: DateTime<Utc>,
    /// Set the moment a JWT is minted from this challenge (one-shot).
    pub consumed_at: Option<DateTime<Utc>>,
}

/// SeaORM relations (none modelled here).
#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
pub enum Relation {}

impl ActiveModelBehavior for ActiveModel {}