swift-sdk/Sources/Hanzo/Models/IamToken.swift

//
// IamToken.swift
//
// Generated by openapi-generator
// https://openapi-generator.tech
//

import Foundation

public struct IamToken: Sendable, Codable, ParameterConvertible, Hashable {

    public var accessToken: String?
    public var accessTokenHash: String?
    public var application: String?
    public var code: String?
    public var codeChallenge: String?
    public var codeChallengeMethod: String?
    public var codeExpireIn: Int64?
    public var codeIsUsed: Bool?
    public var createdAt: Date?
    public var createdTime: String?
    public var deleted: Bool?
    public var expiresIn: Int64?
    public var id: String?
    public var name: String?
    /** Nonce is the OIDC authorize nonce, stored on the code and echoed into the id_token minted at the exchange (OIDC Core §3.1.3.6) so a relying party binds the id_token to its own request and detects replay. */
    public var nonce: String?
    public var organization: String?
    public var owner: String?
    /** PublicGrant records that this grant was established WITHOUT client authentication — a PKCE code exchange from a client that presented no secret. Whether a client is confidential is a property of the GRANT, not only of the registration: `hanzo-cli` and every @hanzo/iam SPA keep a registered secret for a BACKEND path while the surface that actually signs in is a public PKCE client that cannot hold one. authorizationCodeGrant already makes exactly that bounded relaxation; this is the same fact, recorded so refreshTokenGrant can honour it instead of demanding a secret the client never had (which 401s invalid_client and kills the session at the access token's expiry). Carried across rotation, so the second refresh behaves like the first. */
    public var publicGrant: Bool?
    /** RedirectUri binds the authorization code to the exact redirect URI of the authorize request (RFC 6749 §4.1.3): the token endpoint refuses a code redeemed with a different redirect_uri, closing code-injection across a client's registered URIs. */
    public var redirectUri: String?
    public var refreshConsumed: Bool?
    public var refreshExpireIn: Int64?
    /** Refresh-token rotation state (v2). Each refresh belongs to a family (the grant); rotation mints a new row in the same family and marks the prior one consumed. Presenting a consumed refresh is reuse — the whole family is revoked (RFC 9700 §4.14.2). RefreshExpireIn is the refresh token's own absolute expiry (unix), independent of the access token's shorter life. */
    public var refreshFamily: String?
    public var refreshToken: String?
    public var refreshTokenHash: String?
    /** RFC 8707 resource indicator */
    public var resource: String?
    public var scope: String?
    public var tokenType: String?
    public var updatedAt: Date?
    public var user: String?
    public var userCode: String?

    public init(accessToken: String? = nil, accessTokenHash: String? = nil, application: String? = nil, code: String? = nil, codeChallenge: String? = nil, codeChallengeMethod: String? = nil, codeExpireIn: Int64? = nil, codeIsUsed: Bool? = nil, createdAt: Date? = nil, createdTime: String? = nil, deleted: Bool? = nil, expiresIn: Int64? = nil, id: String? = nil, name: String? = nil, nonce: String? = nil, organization: String? = nil, owner: String? = nil, publicGrant: Bool? = nil, redirectUri: String? = nil, refreshConsumed: Bool? = nil, refreshExpireIn: Int64? = nil, refreshFamily: String? = nil, refreshToken: String? = nil, refreshTokenHash: String? = nil, resource: String? = nil, scope: String? = nil, tokenType: String? = nil, updatedAt: Date? = nil, user: String? = nil, userCode: String? = nil) {
        self.accessToken = accessToken
        self.accessTokenHash = accessTokenHash
        self.application = application
        self.code = code
        self.codeChallenge = codeChallenge
        self.codeChallengeMethod = codeChallengeMethod
        self.codeExpireIn = codeExpireIn
        self.codeIsUsed = codeIsUsed
        self.createdAt = createdAt
        self.createdTime = createdTime
        self.deleted = deleted
        self.expiresIn = expiresIn
        self.id = id
        self.name = name
        self.nonce = nonce
        self.organization = organization
        self.owner = owner
        self.publicGrant = publicGrant
        self.redirectUri = redirectUri
        self.refreshConsumed = refreshConsumed
        self.refreshExpireIn = refreshExpireIn
        self.refreshFamily = refreshFamily
        self.refreshToken = refreshToken
        self.refreshTokenHash = refreshTokenHash
        self.resource = resource
        self.scope = scope
        self.tokenType = tokenType
        self.updatedAt = updatedAt
        self.user = user
        self.userCode = userCode
    }

    public enum CodingKeys: String, CodingKey, CaseIterable {
        case accessToken
        case accessTokenHash
        case application
        case code
        case codeChallenge
        case codeChallengeMethod
        case codeExpireIn
        case codeIsUsed
        case createdAt
        case createdTime
        case deleted
        case expiresIn
        case id
        case name
        case nonce
        case organization
        case owner
        case publicGrant
        case redirectUri
        case refreshConsumed
        case refreshExpireIn
        case refreshFamily
        case refreshToken
        case refreshTokenHash
        case resource
        case scope
        case tokenType
        case updatedAt
        case user
        case userCode
    }

    // Encodable protocol methods

    public func encode(to encoder: Encoder) throws {
        var container = encoder.container(keyedBy: CodingKeys.self)
        try container.encodeIfPresent(accessToken, forKey: .accessToken)
        try container.encodeIfPresent(accessTokenHash, forKey: .accessTokenHash)
        try container.encodeIfPresent(application, forKey: .application)
        try container.encodeIfPresent(code, forKey: .code)
        try container.encodeIfPresent(codeChallenge, forKey: .codeChallenge)
        try container.encodeIfPresent(codeChallengeMethod, forKey: .codeChallengeMethod)
        try container.encodeIfPresent(codeExpireIn, forKey: .codeExpireIn)
        try container.encodeIfPresent(codeIsUsed, forKey: .codeIsUsed)
        try container.encodeIfPresent(createdAt, forKey: .createdAt)
        try container.encodeIfPresent(createdTime, forKey: .createdTime)
        try container.encodeIfPresent(deleted, forKey: .deleted)
        try container.encodeIfPresent(expiresIn, forKey: .expiresIn)
        try container.encodeIfPresent(id, forKey: .id)
        try container.encodeIfPresent(name, forKey: .name)
        try container.encodeIfPresent(nonce, forKey: .nonce)
        try container.encodeIfPresent(organization, forKey: .organization)
        try container.encodeIfPresent(owner, forKey: .owner)
        try container.encodeIfPresent(publicGrant, forKey: .publicGrant)
        try container.encodeIfPresent(redirectUri, forKey: .redirectUri)
        try container.encodeIfPresent(refreshConsumed, forKey: .refreshConsumed)
        try container.encodeIfPresent(refreshExpireIn, forKey: .refreshExpireIn)
        try container.encodeIfPresent(refreshFamily, forKey: .refreshFamily)
        try container.encodeIfPresent(refreshToken, forKey: .refreshToken)
        try container.encodeIfPresent(refreshTokenHash, forKey: .refreshTokenHash)
        try container.encodeIfPresent(resource, forKey: .resource)
        try container.encodeIfPresent(scope, forKey: .scope)
        try container.encodeIfPresent(tokenType, forKey: .tokenType)
        try container.encodeIfPresent(updatedAt, forKey: .updatedAt)
        try container.encodeIfPresent(user, forKey: .user)
        try container.encodeIfPresent(userCode, forKey: .userCode)
    }
}


@available(iOS 13, tvOS 13, watchOS 6, macOS 10.15, *)
extension IamToken: Identifiable {}