models

type Account struct {
	bun.BaseModel `bun:"table:accounts"`

	ID                    string     `json:"id" bun:"column:id,pk"`
	UserID                string     `json:"user_id" bun:"column:user_id"`
	AccountID             string     `json:"account_id" bun:"column:account_id"`
	ProviderID            string     `json:"provider_id" bun:"column:provider_id"`
	AccessToken           *string    `json:"access_token" bun:"column:access_token"`
	RefreshToken          *string    `json:"refresh_token" bun:"column:refresh_token"`
	IDToken               *string    `json:"id_token" bun:"column:id_token"`
	AccessTokenExpiresAt  *time.Time `json:"access_token_expires_at" bun:"column:access_token_expires_at"`
	RefreshTokenExpiresAt *time.Time `json:"refresh_token_expires_at" bun:"column:refresh_token_expires_at"`
	Scope                 *string    `json:"scope" bun:"column:scope"`
	Password              *string    `json:"password" bun:"column:password"` // for email/password auth
	CreatedAt             time.Time  `json:"created_at" bun:"column:created_at,default:current_timestamp"`
	UpdatedAt             time.Time  `json:"updated_at" bun:"column:updated_at,default:current_timestamp"`

	User User `json:"-" bun:"rel:belongs-to,join:user_id=id"`
}

type AccountDatabaseHooksConfig struct {
	BeforeCreate func(account *Account) error
	AfterCreate  func(account Account) error
	BeforeUpdate func(account *Account) error
	AfterUpdate  func(account Account) error
}

type AuthMethodProvider interface {
	AuthMiddleware() func(http.Handler) http.Handler
	OptionalAuthMiddleware() func(http.Handler) http.Handler
}

type AuthProviderID string

type CORSConfig struct {
	AllowCredentials bool          `json:"allow_credentials" toml:"allow_credentials"`
	AllowedOrigins   []string      `json:"allowed_origins" toml:"allowed_origins"`
	AllowedMethods   []string      `json:"allowed_methods" toml:"allowed_methods"`
	AllowedHeaders   []string      `json:"allowed_headers" toml:"allowed_headers"`
	ExposedHeaders   []string      `json:"exposed_headers" toml:"exposed_headers"`
	MaxAge           time.Duration `json:"max_age" toml:"max_age"`
}

type Config struct {
	// Core identity
	AppName  string         `json:"app_name" toml:"app_name"`
	BaseURL  string         `json:"base_url" toml:"base_url"`
	BasePath string         `json:"base_path" toml:"base_path"`
	Secret   string         `json:"secret" toml:"secret"`
	Database DatabaseConfig `json:"database" toml:"database"`
	Logger   LoggerConfig   `json:"logger" toml:"logger"`
	Session  SessionConfig  `json:"session" toml:"session"`
	Security SecurityConfig `json:"security" toml:"security"`
	EventBus EventBusConfig `json:"event_bus" toml:"event_bus"`
	Plugins  PluginsConfig  `json:"plugins" toml:"plugins"`
	// RouteMappings defines plugin-to-route mappings.
	// Each route specifies which plugins should execute hooks for that endpoint.
	// This enables fully declarative plugin routing in both standalone and library modes.
	RouteMappings []RouteMapping `json:"route_mappings" toml:"route_mappings"`
	// PreParsedConfigs stores the original typed plugin config objects.
	// This allows skipping mapstructure unmarshalling and preserving type safety.
	// Key: plugin ID, Value: typed config struct passed to Auth.New()
	PreParsedConfigs map[string]any `json:"-" toml:"-"`
	// CoreDatabaseHooks allows you to hook into database operations for users, accounts, sessions, and verifications.
	CoreDatabaseHooks *CoreDatabaseHooksConfig `json:"-" toml:"-"`
}

type ConfigManager interface {
	// Init initializes the config manager, creating initial config if necessary
	Init() error
	// GetConfig returns the current configuration
	GetConfig() *Config
	// Load reloads the configuration from the storage
	Load() error
	// Update updates a specific configuration key with a new value
	Update(key string, value any) error
	// UpdateWithResult updates config and returns the updated config to avoid redundant GetConfig() calls
	UpdateWithResult(key string, value any, result **Config) error
	// Watch returns a channel that emits config updates
	Watch(ctx context.Context) (<-chan *Config, error)
}

type ContextKey string

type CoreDatabaseHooksConfig struct {
	Users         *UserDatabaseHooksConfig
	Accounts      *AccountDatabaseHooksConfig
	Sessions      *SessionDatabaseHooksConfig
	Verifications *VerificationDatabaseHooksConfig
}

type DatabaseConfig struct {
	Provider        string        `json:"provider" toml:"provider"`
	URL             string        `json:"url" toml:"url"`
	MaxOpenConns    int           `json:"max_open_conns" toml:"max_open_conns"`
	MaxIdleConns    int           `json:"max_idle_conns" toml:"max_idle_conns"`
	ConnMaxLifetime time.Duration `json:"conn_max_lifetime" toml:"conn_max_lifetime"`
}

type Event struct {
	ID        string            `json:"id"`
	Type      string            `json:"type"`
	Timestamp time.Time         `json:"timestamp"`
	Payload   json.RawMessage   `json:"payload"`
	Metadata  map[string]string `json:"metadata"`
}

type EventBus interface {
	EventPublisher
	EventSubscriber
}

type EventBusConfig struct {
	Prefix                string                  `json:"prefix" toml:"prefix"`
	MaxConcurrentHandlers int                     `json:"max_concurrent_handlers" toml:"max_concurrent_handlers"`
	Provider              events.EventBusProvider `json:"provider" toml:"provider"`
	GoChannel             *GoChannelConfig        `json:"go_channel" toml:"go_channel"`
	SQLite                *SQLiteConfig           `json:"sqlite" toml:"sqlite"`
	PostgreSQL            *PostgreSQLConfig       `json:"postgres" toml:"postgres"`
	Redis                 *RedisConfig            `json:"redis" toml:"redis"`
	Kafka                 *KafkaConfig            `json:"kafka" toml:"kafka"`
	NATS                  *NatsConfig             `json:"nats" toml:"nats"`
	RabbitMQ              *RabbitMQConfig         `json:"rabbitmq" toml:"rabbitmq"`
}

type EventHandler func(ctx context.Context, event Event) error

type EventPublisher interface {
	Publish(ctx context.Context, event Event) error
	Close() error
}

type EventSubscriber interface {
	Subscribe(eventType string, handler EventHandler) (SubscriptionID, error)
	Unsubscribe(eventType string, id SubscriptionID)
	Close() error
}

type GoChannelConfig struct {
	BufferSize int `json:"buffer_size" toml:"buffer_size"`
}

type Hook struct {
	// Stage determines when this hook is executed
	Stage HookStage
	// PluginID identifies a plugin capability (e.g., "session.auth", "bearer.auth", "csrf.protect").
	// If set, hook only executes if PluginID is in ctx.Route.Metadata["plugins"].
	// If empty, hook executes based on Matcher logic.
	PluginID string
	// Matcher optionally filters when this hook should run (optional).
	// Checked after PluginID filtering, if present.
	Matcher HookMatcher
	// Handler is the function that executes the hook
	Handler HookHandler
	// Order determines execution order when multiple hooks are at the same stage
	// Lower order values execute first (0 is before 1, which is before 2, etc.).
	// Order is local to the plugin (only compared against other hooks with same PluginID).
	Order int
	// Async determines if this hook runs in a background goroutine without blocking the response.
	// Async hooks are for side-effects only (logging, analytics, events, webhooks, secondary storage).
	// Must be false for all auth validation, CSRF, rate-limiting, and critical security hooks.
	// Async hooks execute with a timeout to prevent leaks and have no access to response writer.
	Async bool
}

type HookHandler func(reqCtx *RequestContext) error

type HookMatcher func(reqCtx *RequestContext) bool

type HookStage int

type KafkaConfig struct {
	Brokers       string `json:"brokers" toml:"brokers"`
	ConsumerGroup string `json:"consumer_group" toml:"consumer_group"`
}

type Logger interface {
	// Debug logs a message at debug level with optional key-value pairs.
	Debug(msg string, args ...any)
	// Info logs a message at info level with optional key-value pairs.
	Info(msg string, args ...any)
	// Warn logs a message at warn level with optional key-value pairs.
	Warn(msg string, args ...any)
	// Error logs a message at error level with optional key-value pairs.
	Error(msg string, args ...any)
}

type LoggerConfig struct {
	Level string `json:"level" toml:"level"`
}

type Message struct {
	UUID     string
	Payload  []byte // Message payload (serialized data)
	Metadata map[string]string
}

type MiddlewareProvider interface {
	Middleware() func(http.Handler) http.Handler
}

type NatsConfig struct {
	URL string `json:"url" toml:"url"`
}

type Plugin interface {
	Metadata() PluginMetadata
	Config() any
	Init(ctx *PluginContext) error
	Close() error
}

type PluginContext struct {
	DB              bun.IDB
	Logger          Logger
	EventBus        EventBus
	ServiceRegistry ServiceRegistry
	GetConfig       func() *Config
}

type PluginID string

type PluginMetadata struct {
	ID          string
	Version     string
	Description string
}

type PluginOption func(p Plugin)

type PluginRegistry interface {
	Register(p Plugin) error
	InitAll() error
	RunMigrations(ctx context.Context) error
	DropMigrations(ctx context.Context) error
	Plugins() []Plugin
	GetConfig() *Config
	CloseAll()
	GetPlugin(pluginID string) Plugin
}

type PluginWithConfigWatcher interface {
	OnConfigUpdate(config *Config) error
}

type PluginWithHooks interface {
	Hooks() []Hook
}

type PluginWithMiddleware interface {
	Middleware() []func(http.Handler) http.Handler
}

type PluginWithMigrations interface {
	Migrations(ctx context.Context, dbProvider string) (*embed.FS, error)
}

type PluginWithRoutes interface {
	Routes() []Route
}

type PluginsConfig map[string]any

type PostgreSQLConfig struct {
	URL string `json:"url" toml:"url"`
}

type PubSub interface {
	// Publish sends a message to the specified topic
	Publish(ctx context.Context, topic string, msg *Message) error

	// Subscribe returns a channel that receives messages from the specified topic.
	// The channel should be closed when the subscription is cancelled or closed.
	Subscribe(ctx context.Context, topic string) (<-chan *Message, error)

	// Close closes the pub/sub and cleans up resources
	Close() error
}

type RabbitMQConfig struct {
	URL string `json:"url" toml:"url"`
}

type RedisConfig struct {
	URL           string `json:"url" toml:"url"`
	ConsumerGroup string `json:"consumer_group" toml:"consumer_group"`
}

type RequestContext struct {
	// Core HTTP components
	Request        *http.Request
	ResponseWriter http.ResponseWriter

	// Parsed request metadata
	Path    string
	Method  string
	Headers http.Header

	// User information (may be nil if not authenticated)
	UserID   *string
	ClientIP string

	// Generic key-value storage for hooks to share data
	Values map[string]any

	// Route is the matched route, assigned by the router after route matching.
	// Plugins use Route.Metadata["plugins"] to determine if they should execute.
	Route *Route

	// Handled flag indicates whether a hook has handled the request
	// and subsequent handlers should not be called
	Handled bool

	// Response capture fields allow handlers and hooks to override
	// the final HTTP response written to the client
	ResponseStatus  int
	ResponseHeaders http.Header
	ResponseBody    []byte
	ResponseReady   bool
	ResponseData    any
}

type Route struct {
	Method     string
	Path       string
	Handler    http.Handler
	Middleware []func(http.Handler) http.Handler
	// Metadata holds route-specific metadata, including plugin IDs ("plugins"),
	// custom tags, and plugin-specific attributes for conditional hook execution.
	Metadata map[string]any
}

type RouteMapping struct {
	// Path is the route path (e.g., "/auth/me", "/auth/sign-in")
	Path string `json:"path" toml:"path"`
	// Method is the HTTP method (e.g., "GET", "POST", "PUT", "DELETE")
	Method string `json:"method" toml:"method"`
	// Plugins is the list of plugin IDs that should execute for this route.
	// Plugin IDs follow the format "{plugin_name}.{operation}" (e.g., "session.auth", "csrf.protect")
	Plugins []string `json:"plugins" toml:"plugins"`
}

type SQLiteConfig struct {
	DBPath string `json:"db_path" toml:"db_path"`
}

type SecondaryStorage interface {
	// Get retrieves the value associated with the given key.
	Get(ctx context.Context, key string) (any, error)
	// Set stores a value with an optional time-to-live (TTL).
	Set(ctx context.Context, key string, value any, ttl *time.Duration) error
	// Delete removes the value associated with the given key.
	Delete(ctx context.Context, key string) error
	// Incr increments an integer value associated with the given key.
	Incr(ctx context.Context, key string, ttl *time.Duration) (int, error)
	// TTL retrieves the time-to-live (TTL) for the given key.
	TTL(ctx context.Context, key string) (*time.Duration, error)
	// Close closes the storage and releases any resources.
	Close() error
}

type SecondaryStorageType string

type SecurityConfig struct {
	TrustedOrigins []string   `json:"trusted_origins" toml:"trusted_origins"`
	TrustedHeaders []string   `json:"trusted_headers" toml:"trusted_headers"`
	TrustedProxies []string   `json:"trusted_proxies" toml:"trusted_proxies"`
	CORS           CORSConfig `json:"cors" toml:"cors"`
}

type ServiceID string

type ServiceRegistry interface {
	Register(name string, service any)
	Get(name string) any
}

type Session struct {
	bun.BaseModel `bun:"table:sessions"`

	ID        string    `json:"id" bun:"column:id,pk"`
	UserID    string    `json:"user_id" bun:"column:user_id"`
	Token     string    `json:"token" bun:"column:token"`
	ExpiresAt time.Time `json:"expires_at" bun:"column:expires_at"`
	IPAddress *string   `json:"ip_address" bun:"column:ip_address"`
	UserAgent *string   `json:"user_agent" bun:"column:user_agent"`
	CreatedAt time.Time `json:"created_at" bun:"column:created_at,default:current_timestamp"`
	UpdatedAt time.Time `json:"updated_at" bun:"column:updated_at,default:current_timestamp"`

	User User `json:"-" bun:"rel:belongs-to,join:user_id=id"`
}

type SessionConfig struct {
	CookieName   string        `json:"cookie_name" toml:"cookie_name"`
	ExpiresIn    time.Duration `json:"expires_in" toml:"expires_in"`         // Sliding window per activity
	UpdateAge    time.Duration `json:"update_age" toml:"update_age"`         // How often to check/update
	CookieMaxAge time.Duration `json:"cookie_max_age" toml:"cookie_max_age"` // Absolute max age of the cookie
	Secure       bool          `json:"secure" toml:"secure"`
	HttpOnly     bool          `json:"http_only" toml:"http_only"`
	SameSite     string        `json:"same_site" toml:"same_site"`
}

type SessionDatabaseHooksConfig struct {
	BeforeCreate func(session *Session) error
	AfterCreate  func(session Session) error
	BeforeUpdate func(session *Session) error
	AfterUpdate  func(session Session) error
}

type SocialProviderConfig struct {
	Enabled      bool     `json:"enabled" toml:"enabled"`
	ClientID     string   `json:"client_id" toml:"client_id"`
	ClientSecret string   `json:"client_secret" toml:"client_secret"`
	RedirectURL  string   `json:"redirect_url" toml:"redirect_url"`
	Scopes       []string `json:"scopes" toml:"scopes"`
}

type SubscriptionID uint64

type User struct {
	bun.BaseModel `bun:"table:users"`

	ID            string          `json:"id" bun:"column:id,pk"`
	Name          string          `json:"name" bun:"column:name"`
	Email         string          `json:"email" bun:"column:email"`
	EmailVerified bool            `json:"email_verified" bun:"column:email_verified"`
	Image         *string         `json:"image" bun:"column:image"`
	Metadata      json.RawMessage `json:"metadata" bun:"column:metadata"`
	CreatedAt     time.Time       `json:"created_at" bun:"column:created_at,default:current_timestamp"`
	UpdatedAt     time.Time       `json:"updated_at" bun:"column:updated_at,default:current_timestamp"`
}

type UserDatabaseHooksConfig struct {
	BeforeCreate func(user *User) error
	AfterCreate  func(user User) error
	BeforeUpdate func(user *User) error
	AfterUpdate  func(user User) error
}

type Verification struct {
	bun.BaseModel `bun:"table:verifications"`

	ID         string           `json:"id" bun:"column:id,pk"`
	UserID     *string          `json:"user_id" bun:"column:user_id"`
	Identifier string           `json:"identifier" bun:"column:identifier"` // email or other identifier
	Token      string           `json:"token" bun:"column:token"`
	Type       VerificationType `json:"type" bun:"column:type"`
	ExpiresAt  time.Time        `json:"expires_at" bun:"column:expires_at"`
	CreatedAt  time.Time        `json:"created_at" bun:"column:created_at,default:current_timestamp"`
	UpdatedAt  time.Time        `json:"updated_at" bun:"column:updated_at,default:current_timestamp"`

	User *User `json:"-" bun:"rel:belongs-to,join:user_id=id"`
}

type VerificationDatabaseHooksConfig struct {
	BeforeCreate func(verification *Verification) error
	AfterCreate  func(verification Verification) error
}

type VerificationType string