snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/flow/continue_with.go

@@ -0,0 +1,350 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package flow
+
+import (
+	"encoding/base64"
+	"net/url"
+
+	"github.com/ory/herodot"
+
+	"github.com/gofrs/uuid"
+
+	"github.com/ory/x/urlx"
+)
+
+// swagger:model continueWith
+type ContinueWith interface {
+	//swagger:ignore
+	GetAction() string
+}
+
+// swagger:enum ContinueWithActionSetOrySessionToken
+type ContinueWithActionSetOrySessionToken string
+
+const (
+	ContinueWithActionSetOrySessionTokenString ContinueWithActionSetOrySessionToken = "set_ory_session_token" // #nosec G101 -- only a key constant
+)
+
+var _ ContinueWith = new(ContinueWithSetOrySessionToken)
+
+// Indicates that a session was issued, and the application should use this token for authenticated requests
+//
+// swagger:model continueWithSetOrySessionToken
+type ContinueWithSetOrySessionToken struct {
+	// Action will always be `set_ory_session_token`
+	//
+	// required: true
+	Action ContinueWithActionSetOrySessionToken `json:"action"`
+
+	// Token is the token of the session
+	//
+	// required: true
+	OrySessionToken string `json:"ory_session_token"`
+}
+
+func (ContinueWithSetOrySessionToken) AppendTo(url.Values) url.Values {
+	return nil
+}
+
+func NewContinueWithSetToken(t string) *ContinueWithSetOrySessionToken {
+	return &ContinueWithSetOrySessionToken{
+		Action:          ContinueWithActionSetOrySessionTokenString,
+		OrySessionToken: t,
+	}
+}
+
+func (c ContinueWithSetOrySessionToken) GetAction() string {
+	return string(c.Action)
+}
+
+// swagger:enum ContinueWithActionShowVerificationUI
+type ContinueWithActionShowVerificationUI string
+
+// #nosec G101 -- only a key constant
+const (
+	ContinueWithActionShowVerificationUIString ContinueWithActionShowVerificationUI = "show_verification_ui"
+)
+
+var _ ContinueWith = new(ContinueWithVerificationUI)
+
+// Indicates, that the UI flow could be continued by showing a verification ui
+//
+// swagger:model continueWithVerificationUi
+type ContinueWithVerificationUI struct {
+	// Action will always be `show_verification_ui`
+	//
+	// required: true
+	Action ContinueWithActionShowVerificationUI `json:"action"`
+	// Flow contains the ID of the verification flow
+	//
+	// required: true
+	Flow ContinueWithVerificationUIFlow `json:"flow"`
+}
+
+func (c ContinueWithVerificationUI) GetAction() string {
+	return string(c.Action)
+}
+
+// swagger:model continueWithVerificationUiFlow
+type ContinueWithVerificationUIFlow struct {
+	// The ID of the verification flow
+	//
+	// required: true
+	ID uuid.UUID `json:"id"`
+
+	// The address that should be verified in this flow
+	//
+	// required: true
+	VerifiableAddress string `json:"verifiable_address"`
+
+	// The URL of the verification flow
+	//
+	// If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
+	//
+	// required: false
+	URL string `json:"url,omitempty"`
+}
+
+func NewContinueWithVerificationUI(id uuid.UUID, address, url string) *ContinueWithVerificationUI {
+	return &ContinueWithVerificationUI{
+		Action: ContinueWithActionShowVerificationUIString,
+		Flow: ContinueWithVerificationUIFlow{
+			ID:                id,
+			VerifiableAddress: address,
+			URL:               url,
+		},
+	}
+}
+
+func (c ContinueWithVerificationUI) AppendTo(src *url.URL) *url.URL {
+	values := src.Query()
+	values.Set("flow", c.Flow.ID.String())
+	return urlx.CopyWithQuery(src, values)
+}
+
+type FlowWithContinueWith interface {
+	Flow
+	AddContinueWith(ContinueWith)
+	ContinueWith() []ContinueWith
+}
+
+// swagger:enum ContinueWithActionShowSettingsUI
+type ContinueWithActionShowSettingsUI string
+
+// #nosec G101 -- only a key constant
+const (
+	ContinueWithActionShowSettingsUIString ContinueWithActionShowSettingsUI = "show_settings_ui"
+)
+
+var _ ContinueWith = new(ContinueWithSettingsUI)
+
+// Indicates, that the UI flow could be continued by showing a settings ui
+//
+// swagger:model continueWithSettingsUi
+type ContinueWithSettingsUI struct {
+	// Action will always be `show_settings_ui`
+	//
+	// required: true
+	Action ContinueWithActionShowSettingsUI `json:"action"`
+
+	// Flow contains the ID of the settings flow
+	//
+	// required: true
+	Flow ContinueWithSettingsUIFlow `json:"flow"`
+}
+
+func (c ContinueWithSettingsUI) GetAction() string {
+	return string(c.Action)
+}
+
+// swagger:model continueWithSettingsUiFlow
+type ContinueWithSettingsUIFlow struct {
+	// The ID of the settings flow
+	//
+	// required: true
+	ID uuid.UUID `json:"id"`
+
+	// The URL of the settings flow
+	//
+	// If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
+	//
+	// required: false
+	URL string `json:"url,omitempty"`
+}
+
+func NewContinueWithSettingsUI(f Flow, redirectTo string) *ContinueWithSettingsUI {
+	return &ContinueWithSettingsUI{
+		Action: ContinueWithActionShowSettingsUIString,
+		Flow: ContinueWithSettingsUIFlow{
+			ID:  f.GetID(),
+			URL: redirectTo,
+		},
+	}
+}
+
+// swagger:enum ContinueWithActionShowRecoveryUI
+type ContinueWithActionShowRecoveryUI string
+
+// #nosec G101 -- only a key constant
+const (
+	ContinueWithActionShowRecoveryUIString ContinueWithActionShowRecoveryUI = "show_recovery_ui"
+)
+
+// Indicates, that the UI flow could be continued by showing a recovery ui
+//
+// swagger:model continueWithRecoveryUi
+type ContinueWithRecoveryUI struct {
+	// Action will always be `show_recovery_ui`
+	//
+	// required: true
+	Action ContinueWithActionShowRecoveryUI `json:"action"`
+	// Flow contains the ID of the recovery flow
+	//
+	// required: true
+	Flow ContinueWithRecoveryUIFlow `json:"flow"`
+}
+
+// swagger:model continueWithRecoveryUiFlow
+type ContinueWithRecoveryUIFlow struct {
+	// The ID of the recovery flow
+	//
+	// required: true
+	ID uuid.UUID `json:"id"`
+
+	// The URL of the recovery flow
+	//
+	// If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
+	//
+	// required: false
+	URL string `json:"url,omitempty"`
+}
+
+func NewContinueWithRecoveryUI(f Flow) *ContinueWithRecoveryUI {
+	return &ContinueWithRecoveryUI{
+		Action: ContinueWithActionShowRecoveryUIString,
+		Flow: ContinueWithRecoveryUIFlow{
+			ID: f.GetID(),
+		},
+	}
+}
+
+func (c ContinueWithRecoveryUI) GetAction() string {
+	return string(c.Action)
+}
+
+// swagger:enum ContinueWithActionRedirectBrowserTo
+type ContinueWithActionRedirectBrowserTo string
+
+// #nosec G101 -- only a key constant
+const (
+	ContinueWithActionRedirectBrowserToString ContinueWithActionRedirectBrowserTo = "redirect_browser_to"
+)
+
+// Indicates, that the UI flow could be continued by showing a recovery ui
+//
+// swagger:model continueWithRedirectBrowserTo
+type ContinueWithRedirectBrowserTo struct {
+	// Action will always be `redirect_browser_to`
+	//
+	// required: true
+	Action ContinueWithActionRedirectBrowserTo `json:"action"`
+
+	// The URL to redirect the browser to
+	//
+	// required: true
+	RedirectTo string `json:"redirect_browser_to"`
+}
+
+func NewContinueWithRedirectBrowserTo(redirectTo string) *ContinueWithRedirectBrowserTo {
+	return &ContinueWithRedirectBrowserTo{
+		Action:     ContinueWithActionRedirectBrowserToString,
+		RedirectTo: redirectTo,
+	}
+}
+
+func (c ContinueWithRedirectBrowserTo) GetAction() string {
+	return string(c.Action)
+}
+
+// swagger:enum ContinueWithActionShowPINEntryUI
+type ContinueWithActionShowPINEntryUI string
+
+// #nosec G101 -- only an action constant
+const (
+	ContinueWithActionShowPINEntryUIString ContinueWithActionShowPINEntryUI = "show_pin_entry_ui"
+)
+
+var _ ContinueWith = new(ContinueWithDeviceAuthnPINEntryUI)
+
+// Instructs the client to show its PIN entry UI
+//
+// Returned after a PIN-protected DeviceAuthn enrollment or secret rotation.
+// It carries the one-time HPKE-sealed pin_secret, which the device opens with
+// the transport private key it generated for this enrollment and binds to the
+// user's PIN. The plaintext secret never leaves the device; the server only
+// ever stores its at-rest ciphertext.
+//
+// The enrolled key's client_key_id is not included: it is the SHA-256 fingerprint
+// of the device's own public key, which the device derives locally. Non-PIN keys
+// need no client action at all and therefore produce no continue_with.
+//
+// swagger:model continueWithDeviceAuthnPinEntryUi
+type ContinueWithDeviceAuthnPINEntryUI struct {
+	// Action will always be `show_pin_entry_ui`
+	//
+	// required: true
+	Action ContinueWithActionShowPINEntryUI `json:"action"`
+
+	// Data carries the sealed pin_secret material.
+	//
+	// required: true
+	Data ContinueWithDeviceAuthnPINEntryUIData `json:"data"`
+}
+
+// The one-time HPKE-sealed pin_secret material
+//
+// Contains the encapsulated key and the sealed ciphertext that the device
+// opens with the X25519 transport private key it generated for this
+// enrollment or rotation. Open it with HPKE (RFC 9180) using the suite
+// DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM, the ASCII info
+// string "ory/deviceauthn/pin-secret/v1", and the key's client_key_id (its
+// ASCII hex form) as the AAD.
+//
+// swagger:model continueWithDeviceAuthnPinEntryUiData
+type ContinueWithDeviceAuthnPINEntryUIData struct {
+	// The base64-encoded HPKE encapsulated key (the `enc` output of the seal
+	// operation).
+	//
+	// required: true
+	Enc string `json:"enc"`
+
+	// The base64-encoded HPKE ciphertext of the sealed pin_secret.
+	//
+	// required: true
+	Ciphertext string `json:"ciphertext"`
+}
+
+func NewContinueWithDeviceAuthnPINEntryUI(enc, ciphertext []byte) *ContinueWithDeviceAuthnPINEntryUI {
+	return &ContinueWithDeviceAuthnPINEntryUI{
+		Action: ContinueWithActionShowPINEntryUIString,
+		Data: ContinueWithDeviceAuthnPINEntryUIData{
+			Enc:        base64.StdEncoding.EncodeToString(enc),
+			Ciphertext: base64.StdEncoding.EncodeToString(ciphertext),
+		},
+	}
+}
+
+func (c ContinueWithDeviceAuthnPINEntryUI) GetAction() string {
+	return string(c.Action)
+}
+
+func ErrorWithContinueWith(err *herodot.DefaultError, continueWith ...ContinueWith) *herodot.DefaultError {
+	if err.DetailsField == nil {
+		err.DetailsField = map[string]interface{}{}
+	}
+	err.DetailsField["continue_with"] = continueWith
+
+	return err
+}