// Copyright 2018 The Fuchsia Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

library fuchsia.auth;

// A high level assessment of whether the human that owns a Fuchsia account is
// present and engaged.
//
// Note this enum is currently defined to enable multi-user experimentation.
// Substantial work is required before any realistic use cases.
enum AuthStateSummary {
    // No information (either affirming or dissenting) is available about the
    // current presence or engagement of the account owner.
    UNKNOWN = 0;

    // The account owner has been marked as present by some test or experimental
    // authentication mechanism. This state should not be used to grant access
    // to any sensitive user information.
    TEST_PRESENT = 10000;

    // The account owner has been marked as not-present by some test or
    // experimental authentication mechanism.
    TEST_ABSENT = 10001;

    // TODO(jsankey): Add additional values to represent realistic
    //                authentication states.
};

// An assessment of the current presence and engagement of the human that owns
// a Fuchsia account, including the system's confidence in that assessment and
// its timeliness.
//
// Note this struct is currently defined to enable multi-user experimentation.
// Substantial work is required before any realistic use cases.
struct AuthState {
    // A high level assessment of whether the human that owns a Fuchsia account
    // is present and engaged.
    AuthStateSummary summary;

    // TODO(jsankey): Add additional fields to express timeliness, confidence,
    //                and authentication mechanism.
};

// An expression of the types of changes an auth state that should be reported
// over listener interfaces. By default no changes will be reported.
struct AuthChangeGranularity {
    // If true, any changes in the |AuthStateSummary| enumeration will be
    // reported.
    bool summary_changes;

    // TODO(jsankey): Expand to include other types of change.
};

// A unique identifier for an account with some service provider, comprised of
// the identity of the service provider and an account identity supplied by that
// service provider.
//
// TODO(jsankey): Integrate other parts of the AuthProvider API with this
// domain-based identity. In general multiple auth_provider_types may exist for
// the same identity_provider_domain.
struct ServiceProviderAccount {
    // The primary domain of the identity provider, such as "www.google.com".
    string identity_provider_domain;

    // User identifier as supplied by the identity provider. Some identity
    // providers send verified email address as the identifier, some send an
    // opaque string.
    string user_profile_id;
};