/* generated using openapi-typescript-codegen -- do not edit */
/* istanbul ignore file */
/* tslint:disable */
/* eslint-disable */
import type { ApiEmptyResponse } from '../models/ApiEmptyResponse';
import type { ApiResponse_CaptchaResponse } from '../models/ApiResponse_CaptchaResponse';
import type { ApiResponse_ContextMe } from '../models/ApiResponse_ContextMe';
import type { ApiResponse_EmailResponse } from '../models/ApiResponse_EmailResponse';
import type { ApiResponse_Enable2FAResponse } from '../models/ApiResponse_Enable2FAResponse';
import type { ApiResponse_Get2FAStatusResponse } from '../models/ApiResponse_Get2FAStatusResponse';
import type { ApiResponse_Regenerate2FABackupCodesResponse } from '../models/ApiResponse_Regenerate2FABackupCodesResponse';
import type { ApiResponse_RegisterEmailCodeResponse } from '../models/ApiResponse_RegisterEmailCodeResponse';
import type { ApiResponse_RegisterResponse } from '../models/ApiResponse_RegisterResponse';
import type { ApiResponse_RsaResponse } from '../models/ApiResponse_RsaResponse';
import type { ApiResponse_WsTokenResponse } from '../models/ApiResponse_WsTokenResponse';
import type { ChangePasswordParams } from '../models/ChangePasswordParams';
import type { Disable2FAParams } from '../models/Disable2FAParams';
import type { EmailChangeRequest } from '../models/EmailChangeRequest';
import type { EmailVerifyRequest } from '../models/EmailVerifyRequest';
import type { LoginParams } from '../models/LoginParams';
import type { Regenerate2FABackupCodesRequest } from '../models/Regenerate2FABackupCodesRequest';
import type { RegisterEmailCodeParams } from '../models/RegisterEmailCodeParams';
import type { RegisterParams } from '../models/RegisterParams';
import type { ResetPasswordRequest } from '../models/ResetPasswordRequest';
import type { ResetPasswordVerifyParams } from '../models/ResetPasswordVerifyParams';
import type { Verify2FAParams } from '../models/Verify2FAParams';
import type { CancelablePromise } from '../core/CancelablePromise';
import { OpenAPI } from '../core/OpenAPI';
import { request as __request } from '../core/request';
export class AuthService {
	/**
	 * Regenerate 2FA backup codes
	 * After verifying the current password, generate a new set of backup codes for a user with 2FA enabled and replace the old backup codes. password must be encrypted with the current session RSA public key. Backup codes are returned in plaintext only once in this response; clients must prompt users to store them securely.
	 * @returns ApiResponse_Regenerate2FABackupCodesResponse Backup codes have been regenerated; old backup codes are immediately invalidated.
	 * @throws ApiError
	 */
	public static authRegenerateTwoFactorBackupCodes({
		requestBody,
	}: {
		/**
		 * The current account password encrypted with RSA.
		 */
		requestBody: Regenerate2FABackupCodesRequest,
	}): CancelablePromise<ApiResponse_Regenerate2FABackupCodesResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/2fa/backup-codes/regenerate',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				400: `2FA is not enabled, the password is incorrect, or RSA decryption failed.`,
				401: `The current session is not authenticated.`,
				500: `Database write or backup code hashing failed.`,
			},
		});
	}
	/**
	 * Disable two-factor authentication
	 * Disable TOTP two-factor authentication for the current signed-in user. This requires verifying both the current password and a valid TOTP code or backup code. password must be encrypted with the current session RSA public key; a successfully verified backup code is consumed.
	 * @returns ApiEmptyResponse 2FA has been disabled.
	 * @throws ApiError
	 */
	public static authDisableTwoFactor({
		requestBody,
	}: {
		/**
		 * TOTP/backup code and the current password encrypted with RSA.
		 */
		requestBody: Disable2FAParams,
	}): CancelablePromise<ApiEmptyResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/2fa/disable',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				400: `2FA is not enabled, the verification code is incorrect, the password is incorrect, or RSA decryption failed.`,
				401: `The current session is not authenticated.`,
				500: `Database write failed.`,
			},
		});
	}
	/**
	 * Initialize two-factor authentication setup
	 * Generate a new TOTP secret, otpauth QR-code URI, and 10 one-time backup codes for the current signed-in user, and save them in a not-yet-enabled state. Clients must guide the user to scan the QR code and call /auth/2fa/verify with a dynamic code before 2FA is actually enabled. Backup codes are returned in plaintext only once in this response; frontends must remind users to store them securely.
	 * @returns ApiResponse_Enable2FAResponse 2FA setup initialized successfully. Returns the secret, QR-code URI, and backup codes.
	 * @throws ApiError
	 */
	public static authPrepareTwoFactorEnable(): CancelablePromise<ApiResponse_Enable2FAResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/2fa/enable',
			errors: {
				400: `The current user has already enabled 2FA.`,
				401: `The current session is not authenticated.`,
				500: `Database write or backup code hashing failed.`,
			},
		});
	}
	/**
	 * Get two-factor authentication status
	 * Read the current signed-in user's TOTP two-factor authentication status, including whether it is enabled, the authentication method, and whether backup codes are still available.
	 * @returns ApiResponse_Get2FAStatusResponse Read successfully.
	 * @throws ApiError
	 */
	public static authGetTwoFactorStatus(): CancelablePromise<ApiResponse_Get2FAStatusResponse> {
		return __request(OpenAPI, {
			method: 'GET',
			url: '/api/v1/auth/2fa/status',
			errors: {
				401: `The current session is not authenticated.`,
				500: `Database read failed.`,
			},
		});
	}
	/**
	 * Verify and enable two-factor authentication
	 * After initializing with /auth/2fa/enable, submit the 6-digit TOTP code generated by the authenticator app. On success, the current user's 2FA status is set to enabled. A small clock drift of one 30-second window before or after is allowed.
	 * @returns ApiEmptyResponse 2FA has been enabled.
	 * @throws ApiError
	 */
	public static authVerifyAndEnableTwoFactor({
		requestBody,
	}: {
		/**
		 * The 6-digit TOTP code generated by the authenticator app.
		 */
		requestBody: Verify2FAParams,
	}): CancelablePromise<ApiEmptyResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/2fa/verify',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				400: `2FA has not been initialized, is already enabled, or the verification code is incorrect.`,
				401: `The current session is not authenticated.`,
				500: `Database write failed.`,
			},
		});
	}
	/**
	 * Get captcha image
	 * Generate a one-time captcha image and store the plaintext captcha in the current session. Captchas are used for sensitive entry points such as login and sending registration email codes. Set rsa=true to return the current session RSA public key at the same time and reduce frontend initialization requests. The captcha is consumed after either successful or failed validation, so clients must fetch a new one after failure.
	 * @returns ApiResponse_CaptchaResponse Captcha generated successfully. The base64 field is image data that can be used directly as img.src.
	 * @throws ApiError
	 */
	public static authGetCaptcha({
		w,
		h,
		dark,
		rsa,
	}: {
		/**
		 * Captcha image width; allowed range is 80..=400.
		 */
		w: number,
		/**
		 * Captcha image height; allowed range is 30..=200.
		 */
		h: number,
		/**
		 * Whether to generate a dark-mode captcha.
		 */
		dark: boolean,
		/**
		 * Whether to include the RSA public key in the response.
		 */
		rsa: boolean,
	}): CancelablePromise<ApiResponse_CaptchaResponse> {
		return __request(OpenAPI, {
			method: 'GET',
			url: '/api/v1/auth/captcha',
			query: {
				'w': w,
				'h': h,
				'dark': dark,
				'rsa': rsa,
			},
			errors: {
				400: `Invalid captcha size.`,
				500: `Session write failed or RSA initialization failed.`,
			},
		});
	}
	/**
	 * Get current user verified email
	 * Return the verified primary email for the current signed-in user. If no verified email is bound to the account, the email field is null.
	 * @returns ApiResponse_EmailResponse Read successfully.
	 * @throws ApiError
	 */
	public static authGetPrimaryEmail(): CancelablePromise<ApiResponse_EmailResponse> {
		return __request(OpenAPI, {
			method: 'GET',
			url: '/api/v1/auth/email',
			errors: {
				401: `The current session is not authenticated.`,
				500: `Database read failed.`,
			},
		});
	}
	/**
	 * Request login email change
	 * After verifying the current user password, send a confirmation link to the new email address. password must be encrypted with the current session RSA public key. The token in the confirmation link is valid for 1 hour by default; the actual email switch is completed by calling /auth/email/verify.
	 * @returns ApiEmptyResponse The confirmation email has been queued for delivery.
	 * @throws ApiError
	 */
	public static authRequestEmailChange({
		requestBody,
	}: {
		/**
		 * The new email address and encrypted current account password.
		 */
		requestBody: EmailChangeRequest,
	}): CancelablePromise<ApiEmptyResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/email/change',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				400: `The new email is empty, the password is incorrect, or RSA decryption failed.`,
				401: `The current session is not authenticated.`,
				409: `The new email is already in use.`,
				500: `Cache, email service, or database read failed.`,
			},
		});
	}
	/**
	 * Confirm email change
	 * Complete an email change using the token from the confirmation email. The endpoint checks again whether the target email is already taken, then marks old emails as unverified and inserts the new verified primary email in a transaction.
	 * @returns ApiEmptyResponse Email changed successfully.
	 * @throws ApiError
	 */
	public static authVerifyEmailChange({
		requestBody,
	}: {
		/**
		 * Email change confirmation token.
		 */
		requestBody: EmailVerifyRequest,
	}): CancelablePromise<ApiEmptyResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/email/verify',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				400: `The token is empty.`,
				404: `The token is invalid or expired.`,
				409: `The target email was taken by another account before confirmation.`,
				500: `Database transaction failed.`,
			},
		});
	}
	/**
	 * Account login
	 * Log in using a username or verified email. password must be a Base64 ciphertext encrypted with the public key returned by /auth/rsa; the first login attempt must include captcha. If the account has TOTP enabled, the first successful password check returns 400/two-factor required and records pending verification state in the session. Then submit username, password, and totp_code again in the same session to complete login. On success, the session is renewed, the current user is bound, and temporary RSA keys are cleared.
	 * @returns ApiEmptyResponse Login succeeded. The server establishes login state through the session cookie.
	 * @throws ApiError
	 */
	public static authLogin({
		requestBody,
	}: {
		/**
		 * Login parameters. username accepts a username or email; password is an RSA-OAEP-SHA256 encrypted ciphertext; captcha is the captcha stored in the current session; totp_code is required only during the second verification step.
		 */
		requestBody: LoginParams,
	}): CancelablePromise<ApiEmptyResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/login',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				400: `Captcha error, RSA decryption failure, or missing/incorrect TOTP.`,
				404: `User does not exist or password is incorrect; to reduce enumeration risk, incorrect passwords are also treated as user-not-found.`,
				500: `Database, cache, or session write failed.`,
			},
		});
	}
	/**
	 * Log out
	 * Clear the user identity and all temporary authentication data from the current session, including captcha, temporary RSA keys, and pending 2FA state. This endpoint is idempotent: unauthenticated users also receive a success response.
	 * @returns ApiEmptyResponse Logged out successfully, or the session was already unauthenticated.
	 * @throws ApiError
	 */
	public static authLogout(): CancelablePromise<ApiEmptyResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/logout',
			errors: {
				500: `Session persistence failed.`,
			},
		});
	}
	/**
	 * Get current signed-in user context
	 * Return the current user's basic profile, preferred language, timezone, and notification summary using the user_uid bound to the session. This endpoint is typically used to restore the login state when the frontend app starts.
	 * @returns ApiResponse_ContextMe The current session is authenticated. Returns the user context.
	 * @throws ApiError
	 */
	public static authGetCurrentUser(): CancelablePromise<ApiResponse_ContextMe> {
		return __request(OpenAPI, {
			method: 'GET',
			url: '/api/v1/auth/me',
			errors: {
				401: `The current session is unauthenticated or the login state has expired.`,
				404: `The user in the session no longer exists, has been disabled, or has been deleted.`,
				500: `Database read failed.`,
			},
		});
	}
	/**
	 * @returns ApiEmptyResponse Password changed successfully
	 * @throws ApiError
	 */
	public static authChangePassword({
		requestBody,
	}: {
		/**
		 * Password change parameters (passwords encrypted with session RSA public key)
		 */
		requestBody: ChangePasswordParams,
	}): CancelablePromise<ApiEmptyResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/password/change',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				400: `Invalid password`,
				401: `Authentication required`,
				500: `Internal server error`,
			},
		});
	}
	/**
	 * Register a new account
	 * Create an account after validating username, email, password, captcha, and email verification code. password must be encrypted with the current session RSA public key; captcha and email_code are one-time credentials. On successful registration, the new user is written to the session and does not need to log in again.
	 * @returns ApiResponse_RegisterResponse Registration succeeded; the current session is automatically signed in as the new user.
	 * @throws ApiError
	 */
	public static authRegister({
		requestBody,
	}: {
		/**
		 * Registration parameters. email_code comes from /auth/register/email-code; password is a Base64 ciphertext encrypted with RSA-OAEP-SHA256.
		 */
		requestBody: RegisterParams,
	}): CancelablePromise<ApiResponse_RegisterResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/register',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				400: `Captcha error, email verification code error, weak password, RSA decryption failure, or missing required fields.`,
				409: `The username or email is already in use.`,
				500: `Database transaction, password hashing, cache, or session write failed.`,
			},
		});
	}
	/**
	 * Send registration email verification code
	 * After validating the captcha in the current session, send a 6-digit registration code to the target email address. The endpoint checks whether a verified email already exists and applies a per-email cooldown to prevent email bombing. The code is valid for 10 minutes by default.
	 * @returns ApiResponse_RegisterEmailCodeResponse The verification email has been queued for delivery. Returns the code expiration time.
	 * @throws ApiError
	 */
	public static authSendRegisterEmailCode({
		requestBody,
	}: {
		/**
		 * The target email address and captcha from the current session.
		 */
		requestBody: RegisterEmailCodeParams,
	}): CancelablePromise<ApiResponse_RegisterEmailCodeResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/register/email-code',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				400: `The captcha is incorrect, the email is empty, or requests are too frequent.`,
				409: `The email is already used by another verified account.`,
				500: `Cache write failed or the email service is unavailable.`,
			},
		});
	}
	/**
	 * Request password reset email
	 * Submit an email address to send a password reset link if it belongs to an active user. To prevent user enumeration, the business logic attempts to return success whether the email exists, rate limits are triggered, or email delivery fails. Internally, the endpoint enforces a 60-second cooldown and a daily limit of 5 requests per email.
	 * @returns ApiEmptyResponse The request has been accepted; if the email exists, a reset email will be sent.
	 * @throws ApiError
	 */
	public static authRequestPasswordReset({
		requestBody,
	}: {
		/**
		 * The email address that should receive the password reset link.
		 */
		requestBody: ResetPasswordRequest,
	}): CancelablePromise<ApiEmptyResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/reset-password',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				500: `Rare unrecoverable server-side error.`,
			},
		});
	}
	/**
	 * Confirm password reset
	 * Set a new password using the token from the password reset email. password must be encrypted with the current session RSA public key; the new password is strength-checked and rehashed with Argon2id. The token is deleted immediately after successful use; expired or missing tokens fail.
	 * @returns ApiEmptyResponse Password reset succeeded.
	 * @throws ApiError
	 */
	public static authVerifyPasswordReset({
		requestBody,
	}: {
		/**
		 * The reset token and new password encrypted with RSA.
		 */
		requestBody: ResetPasswordVerifyParams,
	}): CancelablePromise<ApiEmptyResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/reset-password/verify',
			body: requestBody,
			mediaType: 'application/json',
			errors: {
				400: `The token is invalid or expired, RSA decryption failed, or the password is too weak.`,
				500: `Database update or password hashing failed.`,
			},
		});
	}
	/**
	 * Get login form RSA public key
	 * Generate or reuse a temporary RSA-2048 key pair for the current browser session and return the public key in PKCS#1 PEM format. Clients should use this public key to encrypt sensitive fields such as passwords with RSA-OAEP-SHA256 before submitting login, registration, password reset, or 2FA disable requests. The private key is encrypted with AEAD and stored only in the server-side session; it is never returned to clients.
	 * @returns ApiResponse_RsaResponse Return the RSA public key available for the current session; if an unexpired key already exists in the session, reuse the existing public key.
	 * @throws ApiError
	 */
	public static authGetRsaPublicKey(): CancelablePromise<ApiResponse_RsaResponse> {
		return __request(OpenAPI, {
			method: 'GET',
			url: '/api/v1/auth/rsa',
			errors: {
				500: `APP_SESSION_SECRET is missing, RSA generation failed, or session write failed.`,
			},
		});
	}
	/**
	 * Issue a short-lived WebSocket token
	 * Issue a short-lived JWT (30 minutes) scoped to IM WebSocket access. The token is signed by the appks signing key and can be verified by imks either locally (via cached signing keys) or via RPC. The returned token should be passed as `{ token: <value> }` in the Socket.IO CONNECT auth packet. Requires an authenticated session.
	 * @returns ApiResponse_WsTokenResponse Token issued successfully.
	 * @throws ApiError
	 */
	public static authWsToken(): CancelablePromise<ApiResponse_WsTokenResponse> {
		return __request(OpenAPI, {
			method: 'POST',
			url: '/api/v1/auth/ws-token',
			errors: {
				401: `The current session is unauthenticated or the login state has expired.`,
				500: `Token issuance or Redis write failed.`,
			},
		});
	}
}
