{
  "properties": {
    "spec": {
      "additionalProperties": false,
      "properties": {
        "createdAt": {
          "description": "Timestamp when session was created",
          "format": "date-time",
          "type": [
            "string",
            "null"
          ]
        },
        "lastUsed": {
          "description": "Timestamp when the session last refreshed or used the Kubernetes API proxy",
          "format": "date-time",
          "type": [
            "string",
            "null"
          ]
        },
        "sessionID": {
          "description": "Unique identifier for this session",
          "type": "string"
        },
        "userID": {
          "description": "User identifier (email or sub)",
          "type": [
            "string",
            "null"
          ]
        },
        "verifier": {
          "description": "PKCE verifier for code exchange",
          "type": "string"
        }
      },
      "required": [
        "sessionID",
        "verifier"
      ],
      "type": [
        "object",
        "null"
      ]
    },
    "status": {
      "additionalProperties": false,
      "properties": {
        "apiToken": {
          "description": "Encrypted credential for the Kubernetes API proxy",
          "type": [
            "string",
            "null"
          ]
        },
        "completedAt": {
          "description": "Timestamp when OAuth flow completed",
          "format": "date-time",
          "type": [
            "string",
            "null"
          ]
        },
        "email": {
          "description": "Authenticated user's email address",
          "type": [
            "string",
            "null"
          ]
        },
        "error": {
          "description": "Error message if OAuth flow failed",
          "type": [
            "string",
            "null"
          ]
        },
        "expiredAt": {
          "description": "Timestamp when the session expired",
          "format": "date-time",
          "type": [
            "string",
            "null"
          ]
        },
        "groups": {
          "description": "User's group memberships from OIDC at login time",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "issuer": {
          "description": "OIDC issuer that asserted the subject",
          "type": [
            "string",
            "null"
          ]
        },
        "phase": {
          "description": "Lifecycle phase of the session",
          "enum": [
            "Pending",
            "Authenticating",
            "Failed",
            "Active",
            "Revoked",
            "Expired"
          ],
          "type": [
            "string",
            "null"
          ]
        },
        "refreshToken": {
          "description": "Encrypted JWT refresh token for token rotation",
          "type": [
            "string",
            "null"
          ]
        },
        "revokedAt": {
          "description": "Timestamp when the session was revoked",
          "format": "date-time",
          "type": [
            "string",
            "null"
          ]
        },
        "subject": {
          "description": "Immutable OIDC subject identifier",
          "type": [
            "string",
            "null"
          ]
        },
        "username": {
          "description": "Authenticated user's preferred username",
          "type": [
            "string",
            "null"
          ]
        }
      },
      "type": [
        "object",
        "null"
      ]
    }
  },
  "type": "object"
}