{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://heartcortex.ai/schemas/1.0/presence-method.schema.json",
  "title": "Presence method",
  "description": "A way one person proves presence (API Standard 6.3 and 13.2 rule 13; Part 6, Section 3.5): a WebAuthn passkey or a CIBA device. POST /heart/v1/presence/methods sends method and its fields, and may send actionId and presence; GET /heart/v1/presence/methods lists methods without key material.",
  "type": "object",
  "required": [
    "method"
  ],
  "properties": {
    "id": {
      "$ref": "common.schema.json#/$defs/uuid",
      "readOnly": true
    },
    "principal": {
      "description": "The person the method belongs to: the sub of their tokens. Always the person who enrolled it.",
      "type": "string",
      "maxLength": 256,
      "readOnly": true
    },
    "method": {
      "enum": [
        "webauthn",
        "ciba"
      ]
    },
    "label": {
      "description": "A name the person gives it, such as 'Phone' or 'Security key'.",
      "type": "string",
      "maxLength": 100
    },
    "credentialId": {
      "description": "webauthn: the credential ID, base64url.",
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{1,1366}$"
    },
    "alg": {
      "description": "webauthn: ES256 (P-256) or EdDSA (Ed25519).",
      "enum": [
        "ES256",
        "EdDSA"
      ]
    },
    "publicKey": {
      "description": "webauthn: the credential's public key, base64url: the 65-byte uncompressed point for ES256, or the 32-byte key for EdDSA. Sent when enrolling; never returned.",
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{43,88}$",
      "writeOnly": true
    },
    "attestationObject": {
      "description": "webauthn, optional: the registration's attestation object, base64url, for a system that checks it. Never returned.",
      "type": "string",
      "maxLength": 16384,
      "writeOnly": true
    },
    "loginHint": {
      "description": "ciba: what the system's CIBA provider uses to reach the person's device (the login_hint of OpenID CIBA).",
      "type": "string",
      "maxLength": 256
    },
    "source": {
      "description": "api: enrolled with POST /heart/v1/presence/methods. config: set in the system's own configuration, and removed there.",
      "enum": [
        "api",
        "config"
      ],
      "readOnly": true
    },
    "createdAt": {
      "$ref": "common.schema.json#/$defs/timestamp",
      "readOnly": true
    },
    "lastUsedAt": {
      "$ref": "common.schema.json#/$defs/timestamp",
      "readOnly": true
    },
    "actionId": {
      "description": "Request only: the Action ID the client chose (API Standard 6.3).",
      "$ref": "common.schema.json#/$defs/actionId",
      "writeOnly": true
    },
    "presence": {
      "description": "Request only: proof by one of the person's own methods for the digest of the Action named by actionId.",
      "$ref": "common.schema.json#/$defs/presence",
      "writeOnly": true
    }
  },
  "dependentRequired": {
    "presence": [
      "actionId"
    ]
  },
  "allOf": [
    {
      "if": {
        "properties": {
          "method": {
            "const": "webauthn"
          }
        },
        "required": [
          "method"
        ]
      },
      "then": {
        "required": [
          "credentialId",
          "alg"
        ]
      }
    },
    {
      "if": {
        "properties": {
          "method": {
            "const": "ciba"
          }
        },
        "required": [
          "method"
        ]
      },
      "then": {
        "required": [
          "loginHint"
        ]
      }
    }
  ],
  "additionalProperties": false
}