Implement registration identity model

src/user_engine/domain/__init__.py

@@ -16,10 +16,13 @@ from user_engine.domain.models import (
     Catalog,
     CatalogLifecycle,
     ExternalIdentity,
+    FactorVerification,
     FamilyDataspaceRequest,
     FamilyInvitation,
     FamilyMemberSpec,
     FamilyRole,
+    IdentityFactor,
+    IdentityFactorType,
     InvitationStatus,
     ManagementMode,
     Membership,
@@ -29,6 +32,8 @@ from user_engine.domain.models import (
     ProfileScope,
     ProfileValue,
     ProjectionType,
+    RegistrationSession,
+    RegistrationStatus,
     Sensitivity,
     TenantAccount,
     User,
@@ -53,10 +58,13 @@ __all__ = [
     "Catalog",
     "CatalogLifecycle",
     "ExternalIdentity",
+    "FactorVerification",
     "FamilyDataspaceRequest",
     "FamilyInvitation",
     "FamilyMemberSpec",
     "FamilyRole",
+    "IdentityFactor",
+    "IdentityFactorType",
     "InvitationStatus",
     "ManagementMode",
     "Membership",
@@ -66,6 +74,8 @@ __all__ = [
     "ProfileScope",
     "ProfileValue",
     "ProjectionType",
+    "RegistrationSession",
+    "RegistrationStatus",
     "Sensitivity",
     "TenantAccount",
     "User",

src/user_engine/domain/models.py

@@ -59,6 +59,25 @@ class InvitationStatus(StrEnum):
     REVOKED = "revoked"
 
 
+class RegistrationStatus(StrEnum):
+    STARTED = "started"
+    FACTOR_PENDING = "factor_pending"
+    FACTOR_VERIFIED = "factor_verified"
+    COMPLETED = "completed"
+    ABANDONED = "abandoned"
+    EXPIRED = "expired"
+    REJECTED = "rejected"
+
+
+class IdentityFactorType(StrEnum):
+    EMAIL = "email"
+    PHONE = "phone"
+    POSTAL_ADDRESS = "postal_address"
+    EID = "eid"
+    INVITE = "invite"
+    SSO = "sso"
+
+
 class ProfileScope(StrEnum):
     GLOBAL = "global"
     TENANT = "tenant"
@@ -313,6 +332,53 @@ class FamilyInvitation:
     revoked_at: datetime | None = None
 
 
+@dataclass(frozen=True)
+class FactorVerification:
+    factor_type: IdentityFactorType
+    normalized_value: str
+    verification_id: str = field(default_factory=lambda: new_id("fvr"))
+    display_value: str | None = None
+    source_system: str = "external-proofing"
+    assurance: Mapping[str, Any] = field(default_factory=dict)
+    evidence_refs: tuple[CanonEntityReference, ...] = ()
+    verified_at: datetime = field(default_factory=utc_now)
+    expires_at: datetime | None = None
+
+
+@dataclass(frozen=True)
+class IdentityFactor:
+    factor_type: IdentityFactorType
+    normalized_value: str
+    factor_id: str = field(default_factory=lambda: new_id("fac"))
+    registration_id: str | None = None
+    user_id: str | None = None
+    display_value: str | None = None
+    source_system: str = "external-proofing"
+    assurance: Mapping[str, Any] = field(default_factory=dict)
+    evidence_refs: tuple[CanonEntityReference, ...] = ()
+    verified_at: datetime = field(default_factory=utc_now)
+    expires_at: datetime | None = None
+
+
+@dataclass(frozen=True)
+class RegistrationSession:
+    tenant: str
+    registration_id: str = field(default_factory=lambda: new_id("reg"))
+    status: RegistrationStatus = RegistrationStatus.STARTED
+    required_factor_types: tuple[IdentityFactorType, ...] = ()
+    verified_factor_ids: tuple[str, ...] = ()
+    user_id: str | None = None
+    netkingdom_id: str | None = None
+    started_by_subject: str | None = None
+    correlation_id: str | None = None
+    created_at: datetime = field(default_factory=utc_now)
+    updated_at: datetime = field(default_factory=utc_now)
+    completed_at: datetime | None = None
+    abandoned_at: datetime | None = None
+    expired_at: datetime | None = None
+    rejected_at: datetime | None = None
+
+
 @dataclass(frozen=True)
 class AuthorizationRequest:
     actor: Actor