@automattic/vip 4.1.4 → 4.1.6

package/internal/rechallenge/interactive_test.go

@@ -1,106 +0,0 @@
-package rechallenge
-
-import (
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/creack/pty"
-)
-
-// Same stdout-vs-stdin sensor bug as appctx.IsInteractive (parity blocker B5).
-// This one is live: gql/rechallenge.go:111 and main.go:143 use it to decide
-// whether a step-up approval can be prompted for, so a redirected stdout made
-// step-up give up on a perfectly interactive terminal.
-func TestIsInteractiveContextSensesStdinNotStdout(t *testing.T) {
-	ptmx, tty, err := pty.Open()
-	if err != nil {
-		t.Skipf("pty unavailable: %v", err)
-	}
-	defer func() { _ = ptmx.Close(); _ = tty.Close() }()
-	redirected, err := os.CreateTemp(t.TempDir(), "redirected")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer redirected.Close()
-
-	origIn, origOut := os.Stdin, os.Stdout
-	os.Stdin, os.Stdout = tty, redirected
-	defer func() { os.Stdin, os.Stdout = origIn, origOut }()
-
-	if !IsInteractiveContext(nil) {
-		t.Error("stdin is a TTY and only stdout is redirected: step-up must still be promptable")
-	}
-}
-
-// ShouldWaitForRechallenge is the opt-out from the non-interactive fail-fast:
-// an operator who can approve on another device asks for the old polling
-// behavior explicitly. Mirrors the environment half of
-// src/lib/rechallenge/flow.ts:shouldWaitForRechallenge.
-func TestShouldWaitForRechallenge(t *testing.T) {
-	tests := []struct {
-		name   string
-		argv   []string
-		env    string
-		setEnv bool
-		want   bool
-	}{
-		{name: "default off", want: false},
-		{name: "env =1", env: "1", setEnv: true, want: true},
-		{name: "env =0 stays off", env: "0", setEnv: true, want: false},
-		{name: "env =true is not 1", env: "true", setEnv: true, want: false},
-		{name: "env empty stays off", env: "", setEnv: true, want: false},
-		{name: "bare flag", argv: []string{"defensive-mode", "enable", "--rechallenge-wait"}, want: true},
-		{name: "flag=true", argv: []string{"--rechallenge-wait=true"}, want: true},
-		{name: "flag=false", argv: []string{"--rechallenge-wait=false"}, want: false},
-		{name: "flag=0", argv: []string{"--rechallenge-wait=0"}, want: false},
-		{name: "flag=OFF", argv: []string{"--rechallenge-wait=OFF"}, want: false},
-		{name: "similar flag does not count", argv: []string{"--rechallenge-waiting"}, want: false},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			if tc.setEnv {
-				t.Setenv(WaitEnvVar, tc.env)
-			}
-			if got := shouldWaitCheck(tc.argv); got != tc.want {
-				t.Errorf("got %v, want %v", got, tc.want)
-			}
-		})
-	}
-}
-
-// The message that tells the user how to opt in must name the variable the code
-// actually reads. These drift apart the moment they are two independent
-// strings.
-func TestInteractionRequiredErrorNamesTheRealEnvVar(t *testing.T) {
-	err := NewInteractionRequiredError("updateDefensiveModeStatus")
-	if !strings.Contains(err.Error(), WaitEnvVar+"=1") {
-		t.Errorf("error must tell the user the opt-in that exists; got %q", err.Error())
-	}
-}
-
-func TestIsInteractiveContext(t *testing.T) {
-	tests := []struct {
-		name string
-		argv []string
-		env  map[string]string
-		tty  bool
-		want bool
-	}{
-		{"tty + no overrides", nil, nil, true, true},
-		{"non-tty", nil, nil, false, false},
-		{"VIP_NON_INTERACTIVE=1", nil, map[string]string{"VIP_NON_INTERACTIVE": "1"}, true, false},
-		{"--non-interactive in argv", []string{"defensive-mode", "enable", "--non-interactive"}, nil, true, false},
-		{"VIP_NON_INTERACTIVE empty doesn't disable", nil, map[string]string{"VIP_NON_INTERACTIVE": ""}, true, true},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			for k, v := range tc.env {
-				t.Setenv(k, v)
-			}
-			if got := isInteractiveCheck(tc.argv, tc.tty); got != tc.want {
-				t.Errorf("got %v, want %v", got, tc.want)
-			}
-		})
-	}
-}

package/internal/rechallenge/redact.go

@@ -1,36 +0,0 @@
-package rechallenge
-
-import (
-	"regexp"
-	"strings"
-)
-
-// jwtInText matches a JSON Web Token by its header segment rather than by the
-// generic three-dotted-segments shape.
-//
-// Every JWT header is base64url-encoded JSON, so it always begins with the
-// encoding of `{"` — "eyJ". Anchoring on that is what keeps this usable: the
-// unanchored `seg.seg.seg` form that internal/parity uses is fine for a test
-// harness, but here it would also swallow ordinary dotted hostnames
-// ("parker-service.production.example") out of the very error text we are
-// adding for diagnosis. The authoritative protection is the explicit secret
-// list below — this pattern is the net for a token we were never handed.
-var jwtInText = regexp.MustCompile(`eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*`)
-
-// RedactSecrets strips credentials from server-controlled text before it is
-// shown, logged, or shipped.
-//
-// Every string that passes through here is on its way somewhere durable: the
-// user's terminal, a CI log, and cmd/vip-next/main.go's exit hook, which posts
-// error text to the telemetry endpoint. Parker echoes request context into some
-// error payloads, so a response body can carry back the Authorization header we
-// sent it. Pass every credential in scope as a secret; an empty secret is
-// ignored so a zero-valued token cannot blank the whole message.
-func RedactSecrets(value string, secrets ...string) string {
-	for _, secret := range secrets {
-		if secret != "" {
-			value = strings.ReplaceAll(value, secret, "<redacted>")
-		}
-	}
-	return jwtInText.ReplaceAllString(value, "<redacted-jwt>")
-}

package/internal/rechallenge/redact_test.go

@@ -1,142 +0,0 @@
-package rechallenge
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-)
-
-const fakeBearer = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NSJ9.c2lnbmF0dXJlLWJ5dGVz"
-
-func TestRedactSecrets(t *testing.T) {
-	tests := []struct {
-		name    string
-		in      string
-		secrets []string
-		absent  []string
-		present []string
-	}{
-		{
-			name:    "known secret is replaced verbatim",
-			in:      "upstream rejected Authorization: Bearer " + fakeBearer,
-			secrets: []string{fakeBearer},
-			absent:  []string{fakeBearer},
-			present: []string{"upstream rejected"},
-		},
-		{
-			name:    "a JWT we were never handed is still caught",
-			in:      `{"echo":{"headers":{"authorization":"Bearer eyJhbGciOiJub25lIn0.eyJzdWIiOiJvdGhlciJ9.xyz"}}}`,
-			secrets: nil,
-			absent:  []string{"eyJhbGciOiJub25lIn0.eyJzdWIiOiJvdGhlciJ9.xyz"},
-		},
-		{
-			// The unanchored seg.seg.seg pattern would eat this, gutting the
-			// diagnosis the surfaced reason exists to provide.
-			name:    "dotted hostnames survive",
-			in:      "step-up provider parker-service.production.example refused the request",
-			present: []string{"parker-service.production.example"},
-		},
-		{
-			name:    "empty secret does not blank the whole string",
-			in:      "session window elapsed",
-			secrets: []string{""},
-			present: []string{"session window elapsed"},
-		},
-		{
-			name:    "ordinary text is untouched",
-			in:      "Step-up verification did not complete (status=cancelled): user cancelled.",
-			present: []string{"user cancelled"},
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := RedactSecrets(tc.in, tc.secrets...)
-			for _, a := range tc.absent {
-				if strings.Contains(got, a) {
-					t.Errorf("redacted text still contains %q: %s", a, got)
-				}
-			}
-			for _, p := range tc.present {
-				if !strings.Contains(got, p) {
-					t.Errorf("redacted text lost %q: %s", p, got)
-				}
-			}
-		})
-	}
-}
-
-// TestHttpErrorRedactsBearerToken: Parker echoes request context into some
-// error payloads, and these error strings now reach the user's terminal, CI
-// logs, and the telemetry exit hook. The response body must never be able to
-// carry the bearer token back out.
-func TestHttpErrorRedactsBearerToken(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusForbidden)
-		// Worst case: the server reflects the request it received.
-		w.Write([]byte(`{"error":"forbidden","request":{"authorization":"Bearer ` +
-			r.Header.Get("Authorization") + `"}}`))
-	}))
-	defer srv.Close()
-
-	c := &Client{APIHost: srv.URL, HTTP: srv.Client(), BearerToken: fakeBearer}
-	_, err := c.CreateSession(CreateSessionInput{Path: "/x", RequestedOperation: "op"})
-	if err == nil {
-		t.Fatal("want an error for HTTP 403")
-	}
-	if strings.Contains(err.Error(), fakeBearer) {
-		t.Fatalf("bearer token leaked into error text: %s", err.Error())
-	}
-	if !strings.Contains(err.Error(), "forbidden") {
-		t.Errorf("redaction ate the diagnosis; want the server reason, got: %s", err.Error())
-	}
-
-	var herr *HttpError
-	if !errors.As(err, &herr) {
-		t.Fatalf("err = %T, want *HttpError", err)
-	}
-	if strings.Contains(herr.BodyText(), fakeBearer) {
-		t.Errorf("bearer token leaked via BodyText(): %s", herr.BodyText())
-	}
-}
-
-// TestFlowRedactsStatusReason: statusReason.message is server-controlled text
-// that lands in the TerminalError the user sees.
-func TestFlowRedactsStatusReason(t *testing.T) {
-	hour := time.Now().Add(time.Hour).Format(time.RFC3339)
-	mux := http.NewServeMux()
-	mux.HandleFunc("/p/sessions", func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte(`{"challengeId":"c1","status":"pending","verificationUrl":"https://example/v","pollIntervalSeconds":0,"expiresAt":"` + hour + `"}`))
-	})
-	mux.HandleFunc("/p/sessions/c1", func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte(`{"challengeId":"c1","status":"failed","expiresAt":"` + hour +
-			`","pollIntervalSeconds":0,"statusReason":{"code":"x","message":"denied for token ` + fakeBearer + `"}}`))
-	})
-	srv := httptest.NewServer(mux)
-	defer srv.Close()
-
-	r := &Runner{
-		Client:     &Client{APIHost: srv.URL, HTTP: srv.Client(), BearerToken: fakeBearer},
-		Tracker:    &fakeTracker{},
-		TokenCache: newTestCache(),
-		Stdout:     new(strings.Builder),
-		Sleep:      func(context.Context, time.Duration) error { return nil },
-	}
-	_, err := r.Run(context.Background(), RunInput{
-		RequestedOperation: "op",
-		Interactive:        true,
-		Extension:          testExtension(srv.URL),
-	})
-	if err == nil {
-		t.Fatal("want a TerminalError")
-	}
-	if strings.Contains(err.Error(), fakeBearer) {
-		t.Fatalf("bearer token leaked via statusReason: %s", err.Error())
-	}
-	if !strings.Contains(err.Error(), "denied for token") {
-		t.Errorf("the server's reason must survive redaction; got: %s", err.Error())
-	}
-}

package/internal/rechallenge/tokencache.go

@@ -1,148 +0,0 @@
-package rechallenge
-
-import (
-	"errors"
-	"regexp"
-	"sync"
-	"time"
-
-	json "encoding/json/v2"
-
-	"github.com/Automattic/vip/internal/keychain"
-)
-
-// baseServiceName keeps vip-next's elevated tokens isolated from the Node CLI.
-const baseServiceName = "vip-next-cli:elevated"
-
-// nonAlphanumericTC matches the sanitization used by Node's
-// API_HOST.replace(/[^a-z0-9]/gi, '-') so production and non-prod hosts get
-// distinct service entries.
-var nonAlphanumericTC = regexp.MustCompile(`[^a-zA-Z0-9]`)
-
-// ServiceNameForHost builds the keychain service name for the elevated-token
-// cache. Returns the bare base name for the production API host; otherwise
-// suffixes ":<sanitized-host>".
-func ServiceNameForHost(apiHost string) string {
-	if apiHost == keychain.ProductionAPIHost {
-		return baseServiceName
-	}
-	return baseServiceName + ":" + nonAlphanumericTC.ReplaceAllString(apiHost, "-")
-}
-
-// TokenCache stores elevated tokens per scope in a single Go-owned keychain
-// entry. The on-disk shape is a JSON blob {scope: ElevatedToken}, keeping
-// ClearAll cheap while preserving the Node data shape.
-type TokenCache struct {
-	Keychain *keychain.Keychain
-	mu       sync.Mutex
-	loaded   bool
-	blob     map[string]ElevatedToken
-}
-
-func (c *TokenCache) load() error {
-	if c.loaded {
-		return nil
-	}
-	raw, err := c.Keychain.Backend.Get(c.Keychain.Service, c.Keychain.Service)
-	if errors.Is(err, keychain.ErrNotFound) {
-		c.blob = map[string]ElevatedToken{}
-		c.loaded = true
-		return nil
-	}
-	if err != nil {
-		return err
-	}
-	parsed := map[string]ElevatedToken{}
-	if err := json.Unmarshal([]byte(raw), &parsed); err != nil {
-		// Corrupted blob → drop and reset (matches Node).
-		_ = c.Keychain.Backend.Delete(c.Keychain.Service, c.Keychain.Service)
-		c.blob = map[string]ElevatedToken{}
-		c.loaded = true
-		return nil
-	}
-	c.blob = parsed
-	c.loaded = true
-	return nil
-}
-
-func (c *TokenCache) write() error {
-	if len(c.blob) == 0 {
-		err := c.Keychain.Backend.Delete(c.Keychain.Service, c.Keychain.Service)
-		if errors.Is(err, keychain.ErrNotFound) {
-			return nil
-		}
-		return err
-	}
-	data, err := json.Marshal(c.blob, json.Deterministic(true))
-	if err != nil {
-		return err
-	}
-	return c.Keychain.Backend.Set(c.Keychain.Service, c.Keychain.Service, string(data))
-}
-
-// Get returns the cached token for scope, or nil if missing/expired.
-// Expired tokens are evicted as a side effect (matches Node).
-func (c *TokenCache) Get(scope string) (*ElevatedToken, error) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if err := c.load(); err != nil {
-		return nil, err
-	}
-	tok, ok := c.blob[scope]
-	if !ok {
-		return nil, nil
-	}
-	if isExpired(tok) {
-		delete(c.blob, scope)
-		if err := c.write(); err != nil {
-			return nil, err
-		}
-		return nil, nil
-	}
-	return &tok, nil
-}
-
-func (c *TokenCache) Set(scope string, tok ElevatedToken) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if err := c.load(); err != nil {
-		return err
-	}
-	c.blob[scope] = tok
-	return c.write()
-}
-
-func (c *TokenCache) ClearScope(scope string) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if err := c.load(); err != nil {
-		return err
-	}
-	if _, ok := c.blob[scope]; !ok {
-		return nil
-	}
-	delete(c.blob, scope)
-	return c.write()
-}
-
-// ClearAll drops the keychain entry entirely. Called on logout.
-func (c *TokenCache) ClearAll() error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.blob = map[string]ElevatedToken{}
-	c.loaded = true
-	err := c.Keychain.Backend.Delete(c.Keychain.Service, c.Keychain.Service)
-	if errors.Is(err, keychain.ErrNotFound) {
-		return nil
-	}
-	return err
-}
-
-// isExpired matches Node's 5-second grace window. A token whose ExpiresAt is
-// within the next 5 seconds counts as expired.
-func isExpired(tok ElevatedToken) bool {
-	if tok.ExpiresAt.IsZero() {
-		return true
-	}
-	return time.Now().Add(5 * time.Second).After(tok.ExpiresAt)
-}

package/internal/rechallenge/tokencache_test.go

@@ -1,139 +0,0 @@
-package rechallenge
-
-import (
-	"testing"
-	"time"
-
-	"github.com/Automattic/vip/internal/keychain"
-)
-
-type memBackend struct{ store map[string]string }
-
-func (m *memBackend) Set(s, u, p string) error {
-	if m.store == nil {
-		m.store = map[string]string{}
-	}
-	m.store[s+"|"+u] = p
-	return nil
-}
-func (m *memBackend) Get(s, u string) (string, error) {
-	if v, ok := m.store[s+"|"+u]; ok {
-		return v, nil
-	}
-	return "", keychain.ErrNotFound
-}
-func (m *memBackend) Delete(s, u string) error {
-	if _, ok := m.store[s+"|"+u]; !ok {
-		return keychain.ErrNotFound
-	}
-	delete(m.store, s+"|"+u)
-	return nil
-}
-
-func newTestCache() *TokenCache {
-	return &TokenCache{
-		Keychain: &keychain.Keychain{Backend: &memBackend{}, Service: "vip-next-cli:elevated"},
-	}
-}
-
-func TestTokenCacheRoundTrip(t *testing.T) {
-	c := newTestCache()
-	tok := ElevatedToken{Token: "x", ExpiresAt: time.Now().Add(1 * time.Hour), Purpose: "u"}
-	if err := c.Set("doThing", tok); err != nil {
-		t.Fatalf("Set: %v", err)
-	}
-	got, err := c.Get("doThing")
-	if err != nil {
-		t.Fatalf("Get: %v", err)
-	}
-	if got == nil || got.Token != "x" {
-		t.Errorf("Get = %+v, want token x", got)
-	}
-}
-
-func TestTokenCacheMissingReturnsNil(t *testing.T) {
-	c := newTestCache()
-	got, err := c.Get("absent")
-	if err != nil {
-		t.Fatalf("Get: %v", err)
-	}
-	if got != nil {
-		t.Errorf("Get(absent) = %+v, want nil", got)
-	}
-}
-
-func TestTokenCacheExpiredEvicted(t *testing.T) {
-	c := newTestCache()
-	// Expires within the 5s grace window — counts as expired.
-	c.Set("doThing", ElevatedToken{Token: "x", ExpiresAt: time.Now().Add(2 * time.Second)})
-	got, err := c.Get("doThing")
-	if err != nil {
-		t.Fatalf("Get: %v", err)
-	}
-	if got != nil {
-		t.Errorf("expired token must be evicted; got %+v", got)
-	}
-	// Fresh cache reading the same backend must not see the entry either.
-	c2 := &TokenCache{Keychain: c.Keychain}
-	got2, _ := c2.Get("doThing")
-	if got2 != nil {
-		t.Errorf("after eviction the keychain blob must not contain doThing; got %+v", got2)
-	}
-}
-
-func TestTokenCacheClearScope(t *testing.T) {
-	c := newTestCache()
-	c.Set("a", ElevatedToken{Token: "a", ExpiresAt: time.Now().Add(time.Hour)})
-	c.Set("b", ElevatedToken{Token: "b", ExpiresAt: time.Now().Add(time.Hour)})
-	if err := c.ClearScope("a"); err != nil {
-		t.Fatalf("ClearScope: %v", err)
-	}
-	got, _ := c.Get("a")
-	if got != nil {
-		t.Errorf("a should be cleared")
-	}
-	got, _ = c.Get("b")
-	if got == nil {
-		t.Errorf("b should still be present")
-	}
-}
-
-func TestTokenCacheClearAll(t *testing.T) {
-	c := newTestCache()
-	c.Set("a", ElevatedToken{Token: "a", ExpiresAt: time.Now().Add(time.Hour)})
-	c.Set("b", ElevatedToken{Token: "b", ExpiresAt: time.Now().Add(time.Hour)})
-	if err := c.ClearAll(); err != nil {
-		t.Fatalf("ClearAll: %v", err)
-	}
-	gotA, _ := c.Get("a")
-	gotB, _ := c.Get("b")
-	if gotA != nil || gotB != nil {
-		t.Errorf("ClearAll must drop everything; got a=%+v b=%+v", gotA, gotB)
-	}
-	be := c.Keychain.Backend.(*memBackend)
-	if _, exists := be.store["vip-next-cli:elevated|vip-next-cli:elevated"]; exists {
-		t.Errorf("keychain entry must be deleted after ClearAll")
-	}
-}
-
-func TestTokenCacheCorruptedBlobIsReset(t *testing.T) {
-	c := newTestCache()
-	be := c.Keychain.Backend.(*memBackend)
-	_ = be.Set("vip-next-cli:elevated", "vip-next-cli:elevated", "not-json")
-	got, err := c.Get("anything")
-	if err != nil {
-		t.Fatalf("Get on corrupt blob should not error; got %v", err)
-	}
-	if got != nil {
-		t.Errorf("corrupted blob should yield nil; got %+v", got)
-	}
-}
-
-func TestServiceNameForElevatedTokens(t *testing.T) {
-	if got := ServiceNameForHost("https://api.wpvip.com"); got != "vip-next-cli:elevated" {
-		t.Errorf("prod = %q, want vip-next-cli:elevated", got)
-	}
-	if got := ServiceNameForHost("https://staging-api.wpvip.com:8443"); got != "vip-next-cli:elevated:https---staging-api-wpvip-com-8443" {
-		t.Errorf("non-prod = %q", got)
-	}
-}

package/internal/rechallenge/types.go

@@ -1,100 +0,0 @@
-// Package rechallenge implements the Rechallenge v2 step-up authentication
-// flow. Mirrors src/lib/rechallenge/* in the Node implementation.
-//
-// Contract guarantees (load-bearing per project_rechallenge_v2.md):
-//   - Parker path templates and the elevated-header name come from
-//     extensions.rechallenge ON EACH response, never hardcoded.
-//   - Only mutations are eligible for step-up; queries surface errors unchanged.
-//   - The elevated-token cache uses a single keychain entry shared with the
-//     Node binary so logged-in state crosses binaries.
-package rechallenge
-
-import "time"
-
-const (
-	// ElevatedPermissionErrorCode matches src/lib/rechallenge/types.ts.
-	ElevatedPermissionErrorCode = "elevated-permission-required"
-	// Version is the rechallenge protocol version this client supports.
-	Version = "v2"
-	// ClientType is sent in createSession to identify the caller.
-	ClientType = "cli"
-)
-
-// Status mirrors RechallengeStatus from types.ts.
-type Status string
-
-const (
-	StatusPending   Status = "pending"
-	StatusVerified  Status = "verified"
-	StatusExpired   Status = "expired"
-	StatusFailed    Status = "failed"
-	StatusCancelled Status = "cancelled"
-)
-
-// IsTerminal reports whether the status indicates the flow should stop polling.
-func (s Status) IsTerminal() bool {
-	switch s {
-	case StatusVerified, StatusExpired, StatusFailed, StatusCancelled:
-		return true
-	}
-	return false
-}
-
-// Extension is the shape of errors[0].extensions.rechallenge from the API.
-type Extension struct {
-	Version              string `json:"version"`
-	CreateSessionPath    string `json:"createSessionPath"`
-	StatusPathTemplate   string `json:"statusPathTemplate"`
-	ExchangePathTemplate string `json:"exchangePathTemplate"`
-	ElevatedHeaderName   string `json:"elevatedHeaderName"`
-}
-
-// IsValid reports whether the extension has all required template fields.
-// Mirrors the typeof checks in link.ts:extractElevatedPermission.
-func (e Extension) IsValid() bool {
-	return e.CreateSessionPath != "" &&
-		e.StatusPathTemplate != "" &&
-		e.ExchangePathTemplate != "" &&
-		e.ElevatedHeaderName != ""
-}
-
-// Session is the response from POST {createSessionPath}.
-type Session struct {
-	ChallengeID         string    `json:"challengeId"`
-	Status              Status    `json:"status"`
-	VerificationURL     string    `json:"verificationUrl"`
-	PollIntervalSeconds int       `json:"pollIntervalSeconds"`
-	ExpiresAt           time.Time `json:"expiresAt"`
-}
-
-// StatusReason is the optional explanation returned with a terminal status.
-type StatusReason struct {
-	Code    string `json:"code"`
-	Message string `json:"message"`
-}
-
-// SessionStatus is the response from GET {statusPathTemplate}.
-type SessionStatus struct {
-	ChallengeID         string        `json:"challengeId"`
-	Status              Status        `json:"status"`
-	ExpiresAt           time.Time     `json:"expiresAt"`
-	VerifiedAt          *time.Time    `json:"verifiedAt,omitempty"`
-	Provider            string        `json:"provider,omitempty"`
-	PollIntervalSeconds int           `json:"pollIntervalSeconds"`
-	StatusReason        *StatusReason `json:"statusReason,omitempty"`
-}
-
-// ExchangeResponse is the response from POST {exchangePathTemplate}.
-type ExchangeResponse struct {
-	ElevatedToken ElevatedToken `json:"elevatedToken"`
-}
-
-// ElevatedToken is the elevated bearer issued after successful step-up.
-// HeaderName is set by the flow orchestrator (copied from Extension.ElevatedHeaderName)
-// so the link layer doesn't need to consult the Extension during replay.
-type ElevatedToken struct {
-	Token      string    `json:"token"`
-	ExpiresAt  time.Time `json:"expiresAt"`
-	Purpose    string    `json:"purpose"`
-	HeaderName string    `json:"headerName,omitempty"`
-}