tiku-backend.net/Tiku.Application/Auth/IAuthSessionStore.cs

using Tiku.Domain.Tenancy;

namespace Tiku.Application.Auth;

public interface IAuthSessionStore
{
    string GenerateRefreshToken(AuthRealm realm, Guid? tenantId, Guid sessionId);
    bool TryParseRefreshToken(string refreshToken, out RefreshTokenLocator locator);
    string HashRefreshToken(string refreshToken);

    Task<AuthTokenPair> IssueAsync(
        AuthSessionIssueRequest request,
        CancellationToken cancellationToken = default);

    Task<AuthTokenPair> RotateAsync(
        string refreshToken,
        string? ipAddress,
        string? userAgent,
        CancellationToken cancellationToken = default);

    Task<AuthSessionValidationResult?> ValidateAccessSessionAsync(
        Guid sessionId,
        Guid userId,
        AuthRealm realm,
        Guid? tenantId,
        CancellationToken cancellationToken = default);

    Task RevokeFamilyAsync(string refreshToken, string reason, CancellationToken cancellationToken = default);
    Task RevokeRealmAsync(Guid userId, AuthRealm realm, Guid? tenantId, string reason, CancellationToken cancellationToken = default);
    Task RevokeAllAsync(Guid userId, string reason, CancellationToken cancellationToken = default);
}

public sealed record AuthSessionIssueRequest(
    Guid UserId,
    string? Phone,
    string? Email,
    string SecurityStamp,
    AuthRealm Realm,
    Guid? TenantId,
    string Provider,
    bool MfaSatisfied,
    string? IpAddress,
    string? UserAgent,
    Guid? TokenFamilyId = null,
    Guid? ParentSessionId = null);

public sealed record AuthSessionValidationResult(Guid UserId, AuthRealm Realm, Guid? TenantId, bool MfaSatisfied);

public readonly record struct RefreshTokenLocator(AuthRealm Realm, Guid? TenantId, Guid SessionId);