auth

type AccessRequest struct {
	Subject  Subject        `json:"subject"`
	Action   Action         `json:"action"`
	Resource Resource       `json:"resource"`
	Context  map[string]any `json:"context,omitempty"`
}

type Action string

type AuthProvider interface {
	// Name returns the stable provider identifier used in route paths and DB records.
	Name() string

	// LoginURL generates the IdP redirect URL for the given state.
	LoginURL(ctx context.Context, state AuthState) (string, error)

	// HandleCallback validates the callback request, exchanges the code for
	// tokens, verifies the ID token, and returns the normalised identity.
	// Implementations must verify email_verified == true and reject missing emails.
	HandleCallback(ctx context.Context, r *http.Request, state AuthState) (*ExternalIdentity, error)
}

type AuthService struct {
	// contains filtered or unexported fields
}

type AuthState struct {
	State        string
	CodeVerifier string
	ProviderName string
}

type AuthStore interface {
	// Policies
	CreatePolicy(ctx context.Context, p Policy) (Policy, error)
	GetPolicy(ctx context.Context, id string) (Policy, error)
	ListPolicies(ctx context.Context) ([]Policy, error)
	ListEnabledPolicies(ctx context.Context) ([]Policy, error)
	UpdatePolicy(ctx context.Context, p Policy) error
	DeletePolicy(ctx context.Context, id string) error

	// User-Agent assignments
	AssignAgent(ctx context.Context, userID string, agentID string) error
	RemoveAgent(ctx context.Context, userID string, agentID string) error
	ListUserAgentIDs(ctx context.Context, userID string) ([]string, error)
	ListAgentUserIDs(ctx context.Context, agentID string) ([]string, error)

	// API tokens (auth_user_token)
	CreateUserToken(ctx context.Context, token UserToken) (UserToken, error)
	GetUserTokenByHash(ctx context.Context, tokenHash string) (UserToken, error)
	GetActiveUserTokenByHash(ctx context.Context, tokenHash string) (UserToken, error)
	GetActiveAutoUserToken(ctx context.Context, userID string) (UserToken, error)
	RotateUserToken(ctx context.Context, id string) (int64, error)
	RevokeUserToken(ctx context.Context, id string) (int64, error)
	UpdateUserTokenLastUsed(ctx context.Context, id string) (int64, error)
}

type AuthStores struct {
	Users       UserStore
	Logins      LoginIdentityStore
	Sessions    SessionStore
	Credentials CredentialStore
}

type ChannelIdentity struct {
	ID         string    `json:"id"`
	UserID     string    `json:"user_id"`
	Platform   string    `json:"platform"`
	ExternalID string    `json:"external_id"`
	Name       string    `json:"name"`
	CreatedAt  time.Time `json:"created_at"`
	UpdatedAt  time.Time `json:"updated_at"`
}

type ChannelIdentityStore interface {
	CreateChannelIdentity(ctx context.Context, i ChannelIdentity) (ChannelIdentity, error)
	GetChannelIdentity(ctx context.Context, id string) (ChannelIdentity, error)
	GetChannelIdentityByPlatform(ctx context.Context, platform, externalID string) (ChannelIdentity, error)
	ListChannelIdentitiesByUser(ctx context.Context, userID string) ([]ChannelIdentity, error)
	UpdateChannelIdentityExternalID(ctx context.Context, id, externalID string) error
	DeleteChannelIdentity(ctx context.Context, id string) error
}

type Credential struct {
	ID           string    `json:"id"`
	UserID       string    `json:"user_id"`
	PasswordHash string    `json:"-"`
	CreatedAt    time.Time `json:"created_at"`
	UpdatedAt    time.Time `json:"updated_at"`
}

type CredentialService struct {
	// contains filtered or unexported fields
}

type CredentialStore interface {
	CreateCredential(ctx context.Context, c Credential) (Credential, error)
	GetCredentialByUserID(ctx context.Context, userID string) (Credential, error)
	UpdateCredentialHash(ctx context.Context, userID, passwordHash string) error
	DeleteCredential(ctx context.Context, userID string) error
}

type ExternalIdentity struct {
	Provider   string
	Subject    string
	Email      string
	Name       string
	AvatarURL  string
	Claims     map[string]any
	OAuthToken *OAuthToken // set by OAuth providers; nil for OIDC/local
}

type LinkCodeStore struct {
	// contains filtered or unexported fields
}

type LoginIdentity struct {
	ID              string         `json:"id"`
	UserID          string         `json:"user_id"`
	Provider        string         `json:"provider"`
	ProviderSubject string         `json:"provider_subject"`
	Email           string         `json:"email"`
	Name            string         `json:"name"`
	AvatarURL       string         `json:"avatar_url"`
	RawClaims       map[string]any `json:"raw_claims,omitempty"`
	CreatedAt       time.Time      `json:"created_at"`
	UpdatedAt       time.Time      `json:"updated_at"`
}

type LoginIdentityStore interface {
	CreateLoginIdentity(ctx context.Context, i LoginIdentity) (LoginIdentity, error)
	GetLoginIdentityByProvider(ctx context.Context, provider, providerSubject string) (LoginIdentity, error)
	ListLoginIdentitiesByUser(ctx context.Context, userID string) ([]LoginIdentity, error)
	UpdateLoginIdentity(ctx context.Context, i LoginIdentity) error
}

type OAuthToken struct {
	AccessToken           string
	RefreshToken          string
	ExpiresIn             int // seconds until access token expires
	RefreshTokenExpiresIn int // seconds until refresh token expires
}

type OIDCLoginResult struct {
	User         User
	Session      Session
	IsNewUser    bool
	SessionToken string // raw token for the session cookie (not stored in DB)
}

type PermissionChecker interface {
	Can(ctx context.Context, principal Principal, action Action, resource Resource) bool
}

type Policy struct {
	ID         string    `json:"id"`
	Name       string    `json:"name"`
	Effect     string    `json:"effect"`
	Subjects   string    `json:"subjects"`
	Actions    string    `json:"actions"`
	Resources  string    `json:"resources"`
	Conditions string    `json:"conditions"`
	Priority   int       `json:"priority"`
	IsSystem   bool      `json:"is_system"`
	Enabled    bool      `json:"enabled"`
	CreatedAt  time.Time `json:"created_at"`
}

type PolicyEngine struct {
	// contains filtered or unexported fields
}

type Principal struct {
	UserID    string `json:"user_id"`
	Email     string `json:"email"`
	Name      string `json:"name"`
	AvatarURL string `json:"avatar_url"`
	Role      string `json:"role"` // user role: admin or user
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type Resource struct {
	Type    ResourceType   `json:"type"`
	ID      string         `json:"id"`
	OwnerID string         `json:"owner_id"`
	Attrs   map[string]any `json:"attrs,omitempty"`
}

type ResourceType string

type RoleBasedChecker struct{}

type Session struct {
	ID        string    `json:"id"`
	UserID    string    `json:"user_id"`
	TokenHash string    `json:"-"`
	ExpiresAt time.Time `json:"expires_at"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type SessionManager struct {
	// contains filtered or unexported fields
}

type SessionStore interface {
	CreateSession(ctx context.Context, s Session) (Session, error)
	GetSessionByTokenHash(ctx context.Context, tokenHash string) (Session, error)
	DeleteSession(ctx context.Context, id string) error
	DeleteExpiredSessions(ctx context.Context) error
	DeleteUserSessions(ctx context.Context, userID string) error
	UpdateSessionExpiry(ctx context.Context, id string, expiresAt time.Time) error
	GetSession(ctx context.Context, id string) (Session, error)
	ListSessionsByUser(ctx context.Context, userID string) ([]Session, error)
}

type Subject struct {
	UserID   string         `json:"user_id"`
	Roles    []string       `json:"roles"`
	AgentIDs []string       `json:"agent_ids"`
	Attrs    map[string]any `json:"attrs,omitempty"`
}

type TokenService struct {
	// contains filtered or unexported fields
}

type Transactioner interface {
	BeginAuthTx(ctx context.Context) (stores AuthStores, commit func() error, rollback func(), err error)
}

type User struct {
	ID               string    `json:"id"`
	Email            string    `json:"email"`
	Name             string    `json:"name"`
	AvatarURL        string    `json:"avatar_url"`
	Role             string    `json:"role"`
	DefaultAgentID   string    `json:"default_agent_id,omitempty"`
	NotifyIdentityID *string   `json:"notify_identity_id,omitempty"`
	IsActive         bool      `json:"is_active"`
	AgePublicKey     string    `json:"-"`
	AgePrivateKey    string    `json:"-"`
	CreatedAt        time.Time `json:"created_at"`
	UpdatedAt        time.Time `json:"updated_at"`
}

type UserStore interface {
	CreateUser(ctx context.Context, u User) (User, error)
	GetUser(ctx context.Context, id string) (User, error)
	GetUserByEmail(ctx context.Context, email string) (User, error)
	ListUsers(ctx context.Context) ([]User, error)
	ListUsersPaged(ctx context.Context, limit, offset int64) ([]User, error)
	UpdateUser(ctx context.Context, u User) error
	DeleteUser(ctx context.Context, id string) error
	CountUsers(ctx context.Context) (int64, error)
	UpdateUserAgeKeys(ctx context.Context, userID, publicKey, privateKey string) error
	UpdateUserDefaultAgent(ctx context.Context, userID, agentID string) error
	UpdateUserNotifyIdentity(ctx context.Context, userID string, identityID *string) error
	UpdateUserRole(ctx context.Context, userID string, role string) error
	UpdateUserActive(ctx context.Context, userID string, isActive bool) error
}

type UserToken struct {
	ID            string     `json:"id"`
	UserID        string     `json:"user_id"`
	Name          string     `json:"name"`
	TokenHash     string     `json:"-"`
	TokenPrefix   string     `json:"token_prefix"`
	AutoGenerated bool       `json:"auto_generated"`
	LastUsedAt    *time.Time `json:"last_used_at,omitempty"`
	ExpiresAt     *time.Time `json:"expires_at,omitempty"`
	RotatedAt     *time.Time `json:"rotated_at,omitempty"`
	RevokedAt     *time.Time `json:"revoked_at,omitempty"`
	CreatedAt     time.Time  `json:"created_at"`
	UpdatedAt     time.Time  `json:"updated_at"`
}

type VaultWriter interface {
	SetReserved(ctx context.Context, userID string, name string, plaintext string) error
}