auth: complete account authorization flows

(cherry picked from commit 04f4527df32ad5c35720cccc41d27fe51549612f)

internal/domain/account.go

@@ -1,14 +1,93 @@
 package domain
 
-// PasswordSettings 是账号 2FA/SRP 配置。第一阶段默认 HasPassword=false。
+import "errors"
+
+var (
+	ErrPasswordHashInvalid   = errors.New("password hash invalid")
+	ErrSRPIDInvalid          = errors.New("srp id invalid")
+	ErrSRPPasswordChanged    = errors.New("srp password changed")
+	ErrNewSettingsInvalid    = errors.New("new password settings invalid")
+	ErrNewSaltInvalid        = errors.New("new password salt invalid")
+	ErrPasswordRecoveryNA    = errors.New("password recovery not available")
+	ErrEmailCodeInvalid      = errors.New("email code invalid")
+	ErrEmailInvalid          = errors.New("email invalid")
+	ErrSessionPasswordNeeded = errors.New("session password needed")
+)
+
+// PasswordKDFAlgo 是业务层的 SRP KDF 算法描述，不依赖 tg.*。
+type PasswordKDFAlgo struct {
+	Salt1 []byte
+	Salt2 []byte
+	G     int
+	P     []byte
+}
+
+// SecurePasswordKDFAlgo 是 Telegram Passport secure secret 的 KDF 算法描述。
+type SecurePasswordKDFAlgo struct {
+	Kind string
+	Salt []byte
+}
+
+// PasswordCheck 是 inputCheckPasswordEmpty/inputCheckPasswordSRP 的业务层表达。
+type PasswordCheck struct {
+	Empty bool
+	SRPID int64
+	A     []byte
+	M1    []byte
+}
+
+// PasswordInputSettings 是 account.passwordInputSettings 的业务层表达。
+type PasswordInputSettings struct {
+	NewAlgo         *PasswordKDFAlgo
+	NewPasswordHash []byte
+	Hint            string
+	HasHint         bool
+	Email           string
+	HasEmail        bool
+}
+
+// PrivatePasswordSettings 是 account.passwordSettings 的业务层表达。
+type PrivatePasswordSettings struct {
+	Email string
+}
+
+type PasswordResetKind string
+
+const (
+	PasswordResetOK            PasswordResetKind = "ok"
+	PasswordResetRequestedWait PasswordResetKind = "requested_wait"
+	PasswordResetFailedWait    PasswordResetKind = "failed_wait"
+)
+
+type PasswordResetResult struct {
+	Kind      PasswordResetKind
+	UntilDate int
+	RetryDate int
+}
+
+// PasswordSettings 是账号 2FA/SRP 配置。默认 HasPassword=false。
 type PasswordSettings struct {
 	HasRecovery             bool
 	HasSecureValues         bool
 	HasPassword             bool
+	CurrentAlgo             *PasswordKDFAlgo
+	SRPB                    []byte
+	SRPID                   int64
 	Hint                    string
 	EmailUnconfirmedPattern string
+	RecoveryEmail           string
 	LoginEmailPattern       string
+	NewAlgo                 PasswordKDFAlgo
+	NewSecureAlgo           SecurePasswordKDFAlgo
 	SecureRandom            []byte
+	PendingResetDate        int
+
+	// Server-only SRP fields. They are persisted but never exposed to rpc/tg conversion.
+	SRPVerifier []byte
+	SRPBSecret  []byte
+
+	RecoveryCode          string
+	RecoveryCodeExpiresAt int64
 }
 
 // ReactionNotifyFrom stores one account-level reaction notification scope.

internal/domain/authorization.go

@@ -1,10 +1,13 @@
 package domain
 
+import "time"
+
 // Authorization 是一条设备授权：auth_key 与 user 的绑定 + initConnection 设备信息。
 // auth_key 是协议产物、授权是业务产物，故独立于 store.AuthKeyData。
 type Authorization struct {
 	AuthKeyID     [8]byte // 协议原生 auth_key_id；store 边界按小端转 int64
 	UserID        int64
+	Hash          int64
 	Layer         int
 	DeviceModel   string
 	Platform      string
@@ -12,4 +15,6 @@ type Authorization struct {
 	APIID         int
 	AppVersion    string
 	IP            string
+	CreatedAt     time.Time
+	ActiveAt      time.Time
 }