passwordpolicy

type ChangePasswordInput struct {
	UserID            string `json:"user_id"`
	CurrentPassword   string `json:"current_password"`
	NewPassword       string `json:"new_password"`
	CurrentSessionID  string `json:"current_session_id,omitempty"`
	KeepOtherSessions bool   `json:"keep_other_sessions,omitempty"`
}

type CompromisedChecker func(ctx context.Context, password string) (bool, error)

type Config struct {
	// Policy defines the active password strength, complexity, history, and compromised rules.
	Policy Policy

	// CompromisedChecker overrides the default compromised passwords checker if non-nil.
	CompromisedChecker CompromisedChecker

	// Hasher provides password hashing verification for history comparison.
	// Reuses Core's Argon2id hasher by default.
	Hasher password.Hasher

	// EnforceOnSignUp controls whether the BeforeSignUp hook validates passwords. Defaults to true.
	EnforceOnSignUp bool

	// Clock provides time abstraction for deterministic testing. Defaults to time.Now().UTC.
	Clock func() time.Time
}

type HistoryRecordedPayload struct {
	UserID    string    `json:"user_id"`
	HistoryID string    `json:"history_id"`
	Timestamp time.Time `json:"timestamp"`
}

type Module struct {
	// contains filtered or unexported fields
}

type Option func(*Config)

type PasswordHistory struct {
	ID           string    `json:"id"`
	UserID       string    `json:"user_id"`
	PasswordHash string    `json:"password_hash"`
	CreatedAt    time.Time `json:"created_at"`
}

type PasswordPolicy interface {
	// ValidatePassword evaluates a candidate password against the configured policy.
	// If userID is provided (non-empty), it also evaluates password reuse against history.
	ValidatePassword(ctx context.Context, password string, userID string) error

	// ValidatePasswordDetailed evaluates a candidate password and returns a structured
	// list of specific violation codes (e.g. "min_length", "complexity_uppercase", "compromised").
	ValidatePasswordDetailed(ctx context.Context, password string, userID string) (*ValidationResult, error)

	// ChangePassword enforces policy and history reuse prevention, executes Core ChangePassword,
	// and records the new password hash into history.
	ChangePassword(ctx context.Context, in ChangePasswordInput) error

	// ResetPassword enforces policy and history reuse prevention, executes Core ResetPassword,
	// and records the new password hash into history.
	ResetPassword(ctx context.Context, in ResetPasswordInput) error

	// RecordHistory adds a password hash into the user's password history and prunes old records.
	RecordHistory(ctx context.Context, userID, hash string) error

	// GetHistory retrieves historical password records for a user up to limit.
	GetHistory(ctx context.Context, userID string, limit int) ([]*PasswordHistory, error)

	// ClearHistory removes all historical password records for a user.
	ClearHistory(ctx context.Context, userID string) error

	// GetPolicy returns the currently active policy configuration.
	GetPolicy() Policy
}

type Policy struct {
	// MinLength specifies the minimum number of characters required. Defaults to 8.
	MinLength int `json:"min_length"`

	// MaxLength specifies the maximum number of characters permitted. Defaults to 128.
	MaxLength int `json:"max_length"`

	// RequireUppercase requires at least one uppercase letter (A-Z).
	RequireUppercase bool `json:"require_uppercase"`

	// RequireLowercase requires at least one lowercase letter (a-z).
	RequireLowercase bool `json:"require_lowercase"`

	// RequireDigit requires at least one numeric digit (0-9).
	RequireDigit bool `json:"require_digit"`

	// RequireSymbol requires at least one special punctuation/symbol character.
	RequireSymbol bool `json:"require_symbol"`

	// HistoryCount specifies how many past passwords to check against reuse. If 0, history check is disabled.
	HistoryCount int `json:"history_count"`

	// RejectCompromised enables checking against known breached or weak passwords.
	RejectCompromised bool `json:"reject_compromised"`
}

type PolicyValidatedPayload struct {
	UserID    string    `json:"user_id,omitempty"`
	Timestamp time.Time `json:"timestamp"`
}

type PolicyViolationPayload struct {
	UserID     string    `json:"user_id,omitempty"`
	Violations []string  `json:"violations"`
	Timestamp  time.Time `json:"timestamp"`
}

type ResetPasswordInput struct {
	Token       string `json:"token"`
	NewPassword string `json:"new_password"`
}

type ValidationResult struct {
	Valid      bool     `json:"valid"`
	Violations []string `json:"violations,omitempty"`
	Error      error    `json:"-"`
}