models

type Account struct {
	ID                    string       `json:"id" gorm:"primaryKey"`
	UserID                string       `json:"user_id" gorm:"index"`
	AccountID             string       `json:"account_id"`
	ProviderID            ProviderType `json:"provider_id"`
	AccessToken           *string      `json:"access_token,omitempty"`
	RefreshToken          *string      `json:"refresh_token,omitempty"`
	IDToken               *string      `json:"id_token,omitempty"`
	AccessTokenExpiresAt  *time.Time   `json:"access_token_expires_at,omitempty"`
	RefreshTokenExpiresAt *time.Time   `json:"refresh_token_expires_at,omitempty"`
	Scope                 *string      `json:"scope,omitempty"`
	Password              *string      `json:"password,omitempty"` // for email/password auth
	CreatedAt             time.Time    `json:"created_at" gorm:"autoCreateTime"`
	UpdatedAt             time.Time    `json:"updated_at" gorm:"autoUpdateTime"`
	User                  User         `gorm:"foreignKey:UserID"`
}

type AccountDatabaseHooksConfig struct {
	BeforeCreate func(account *Account) error
	AfterCreate  func(account Account) error
	BeforeUpdate func(account *Account) error
	AfterUpdate  func(account Account) error
}

type AccountService interface {
	CreateAccount(account *Account) error
	GetAccountByUserID(userID string) (*Account, error)
	GetAccountByProviderAndAccountID(provider ProviderType, accountID string) (*Account, error)
	UpdateAccount(account *Account) error
}

type ApiMiddleware struct {
	AdminAuth     func() func(http.Handler) http.Handler
	Auth          func() func(http.Handler) http.Handler
	OptionalAuth  func() func(http.Handler) http.Handler
	CorsAuth      func() func(http.Handler) http.Handler
	CSRF          func() func(http.Handler) http.Handler
	RateLimit     func() func(http.Handler) http.Handler
	EndpointHooks func() func(http.Handler) http.Handler
}

type AuthApi interface {
	Services() *AuthServices
	SignUpWithEmailAndPassword(ctx context.Context, name string, email string, password string, callbackURL *string) (*SignUpResult, error)
	SignInWithEmailAndPassword(ctx context.Context, email string, password string, callbackURL *string) (*SignInResult, error)
	SignOut(ctx context.Context, sessionToken string) error
	VerifyEmail(ctx context.Context, rawToken string) (*VerifyEmailResult, error)
	SendEmailVerification(ctx context.Context, userID string, callbackURL *string) error
	ResetPassword(ctx context.Context, email string, callbackURL *string) error
	ChangePassword(ctx context.Context, rawToken string, newPassword string) error
	EmailChange(ctx context.Context, userID string, newEmail string, callbackURL *string) error
	GetMe(ctx context.Context, userID string) (*MeResult, error)
	PrepareOAuth2Login(ctx context.Context, providerName string) (*OAuth2LoginResult, error)
	SignInWithOAuth2(ctx context.Context, providerName string, code string, state string, verifier *string) (*SignInResult, error)
}

type AuthServices struct {
	Users         UserService
	Accounts      AccountService
	Sessions      SessionService
	Verifications VerificationService
	Passwords     PasswordService
	Tokens        TokenService
	RateLimits    RateLimitService
	Mailers       MailerService
}

type AuthSettings struct {
	// The unique key for the config block (e.g., "runtime_config" for the main config)
	Key string `gorm:"primaryKey;type:varchar(255)" json:"key"`
	// Value contains the JSON-encoded configuration data
	Value json.RawMessage `gorm:"type:jsonb" json:"value"`
	// CreatedAt is the timestamp when this setting was created
	CreatedAt time.Time `json:"created_at" gorm:"autoCreateTime"`
	// UpdatedAt is the timestamp when this setting was last updated
	UpdatedAt time.Time `json:"updated_at" gorm:"autoUpdateTime"`
}

type BasePlugin struct {
	// contains filtered or unexported fields
}

type CSRFConfig struct {
	Enabled    bool          `json:"enabled" toml:"enabled"`
	CookieName string        `json:"cookie_name" toml:"cookie_name"`
	HeaderName string        `json:"header_name" toml:"header_name"`
	ExpiresIn  time.Duration `json:"expires_in" toml:"expires_in"`
}

type ChangeEmailConfig struct {
	Enabled bool `json:"enabled" toml:"enabled"`
	// Library mode only
	SendEmailChangeVerificationEmail func(user User, newEmail string, url string, token string) error `json:"-" toml:"-"`
}

type Config struct {
	Mode              Mode                    `json:"-" toml:"-"`
	AppName           string                  `json:"app_name" toml:"app_name"`
	BaseURL           string                  `json:"base_url" toml:"base_url"`
	BasePath          string                  `json:"base_path" toml:"base_path"`
	Secret            string                  `json:"secret" toml:"secret"`
	Logger            LoggerConfig            `json:"logger" toml:"logger"`
	DB                *gorm.DB                `json:"-" toml:"-"`
	Database          DatabaseConfig          `json:"database" toml:"database"`
	Email             EmailConfig             `json:"email" toml:"email"`
	SecondaryStorage  SecondaryStorageConfig  `json:"secondary_storage" toml:"secondary_storage"`
	EmailPassword     EmailPasswordConfig     `json:"email_password" toml:"email_password"`
	EmailVerification EmailVerificationConfig `json:"email_verification" toml:"email_verification"`
	User              UserConfig              `json:"user" toml:"user"`
	Session           SessionConfig           `json:"session" toml:"session"`
	CSRF              CSRFConfig              `json:"csrf" toml:"csrf"`
	SocialProviders   SocialProvidersConfig   `json:"social_providers" toml:"social_providers"`
	TrustedOrigins    TrustedOriginsConfig    `json:"trusted_origins" toml:"trusted_origins"`
	RateLimit         RateLimitConfig         `json:"rate_limit" toml:"rate_limit"`
	EndpointHooks     EndpointHooksConfig     `json:"-" toml:"-"`
	DatabaseHooks     DatabaseHooksConfig     `json:"-" toml:"-"`
	EventHooks        EventHooksConfig        `json:"-" toml:"-"`
	Webhooks          WebhooksConfig          `json:"webhooks" toml:"webhooks"`
	EventBus          EventBusConfig          `json:"event_bus" toml:"event_bus"`
	Plugins           PluginsConfig           `json:"-" toml:"-"`
}

type ConfigManager interface {
	Init() error
	GetConfig() *Config
	Load() error
	Update(key string, value any) error
	Watch(ctx context.Context) (<-chan *Config, error)
}

type ConfigOption func(*Config)

type CustomRoute struct {
	Method     string
	Path       string
	Middleware []RouteMiddleware
	Handler    RouteHandler
}

type DatabaseConfig struct {
	Provider        string        `json:"provider" toml:"provider"`
	URL             string        `json:"url" toml:"url"`
	MaxOpenConns    int           `json:"max_open_conns" toml:"max_open_conns"`
	MaxIdleConns    int           `json:"max_idle_conns" toml:"max_idle_conns"`
	ConnMaxLifetime time.Duration `json:"conn_max_lifetime" toml:"conn_max_lifetime"`
}

type DatabaseHooksConfig struct {
	Users         *UserDatabaseHooksConfig
	Accounts      *AccountDatabaseHooksConfig
	Sessions      *SessionDatabaseHooksConfig
	Verifications *VerificationDatabaseHooksConfig
}

type EmailChangeRequestResult struct {
	Message string `json:"message"`
}

type EmailChangeResult struct {
	Message string `json:"message"`
	User    *User  `json:"user,omitempty"`
}

type EmailConfig struct {
	Provider string `json:"provider" toml:"provider"`
	SMTPHost string `json:"smtp_host" toml:"smtp_host"`
	SMTPPort int    `json:"smtp_port" toml:"smtp_port"`
	SMTPUser string `json:"smtp_user" toml:"smtp_user"`
	SMTPPass string `json:"smtp_pass" toml:"smtp_pass"`
	From     string `json:"from" toml:"from"`
}

type EmailPasswordConfig struct {
	Enabled                  bool          `json:"enabled" toml:"enabled"`
	MinPasswordLength        int           `json:"min_password_length" toml:"min_password_length"`
	MaxPasswordLength        int           `json:"max_password_length" toml:"max_password_length"`
	DisableSignUp            bool          `json:"disable_sign_up" toml:"disable_sign_up"`
	RequireEmailVerification bool          `json:"require_email_verification" toml:"require_email_verification"`
	AutoSignIn               bool          `json:"auto_sign_in" toml:"auto_sign_in"`
	ResetTokenExpiry         time.Duration `json:"reset_token_expiry" toml:"reset_token_expiry"`
	// Library mode only
	Password               PasswordConfig                                  `json:"-" toml:"-"`
	SendResetPasswordEmail func(user User, url string, token string) error `json:"-" toml:"-"`
}

type EmailVerificationConfig struct {
	AutoSignIn   bool          `json:"auto_sign_in" toml:"auto_sign_in"`
	SendOnSignUp bool          `json:"send_on_sign_up" toml:"send_on_sign_up"`
	SendOnSignIn bool          `json:"send_on_sign_in" toml:"send_on_sign_in"`
	ExpiresIn    time.Duration `json:"expires_in" toml:"expires_in"`
	// Library mode only
	SendVerificationEmail func(user User, url string, token string) error `json:"-" toml:"-"`
}

type EndpointHookContext struct {
	Path            string
	Method          string
	Body            map[string]any
	Headers         map[string][]string
	Query           map[string][]string
	Request         *http.Request
	User            *User
	ResponseStatus  int
	ResponseHeaders map[string][]string
	ResponseBody    []byte
	ResponseCookies []*http.Cookie
	Redirect        func(url string, status int)
	Handled         bool
}

type EndpointHooksConfig struct {
	Before   func(ctx *EndpointHookContext) error
	Response func(ctx *EndpointHookContext) error
	After    func(ctx *EndpointHookContext)
}

type Event struct {
	ID        string            `json:"id"`
	Type      string            `json:"type"`
	Timestamp time.Time         `json:"timestamp"`
	Payload   json.RawMessage   `json:"payload"`
	Metadata  map[string]string `json:"metadata"`
}

type EventBus interface {
	EventPublisher
	EventSubscriber
}

type EventBusConfig struct {
	Enabled               bool   `json:"enabled" toml:"enabled"`
	Prefix                string `json:"prefix" toml:"prefix"`
	MaxConcurrentHandlers int    `json:"max_concurrent_handlers" toml:"max_concurrent_handlers"`
	PubSubType            string `json:"pubsub_type" toml:"pubsub_type"`
	PubSub                PubSub `json:"-" toml:"-"`
}

type EventEmitter interface {
	OnUserSignedUp(user User)
	OnUserLoggedIn(user User)
	OnEmailVerified(user User)
	OnPasswordChanged(user User)
	OnEmailChanged(user User)
}

type EventHandler func(ctx context.Context, event Event) error

type EventHooksConfig struct {
	OnUserSignedUp    func(user User)
	OnUserLoggedIn    func(user User)
	OnEmailVerified   func(user User)
	OnPasswordChanged func(user User)
	OnEmailChanged    func(user User)
}

type EventPublisher interface {
	Publish(ctx context.Context, event Event) error
	Close() error
}

type EventSubscriber interface {
	Subscribe(eventType string, handler EventHandler) (SubscriptionID, error)
	Unsubscribe(eventType string, id SubscriptionID)
	Close() error
}

type Handler interface {
	Handle(w http.ResponseWriter, r *http.Request)
}

type IPConfig struct {
	Headers []string `json:"headers" toml:"headers"`
}

type KeyValueStore struct {
	Key       string     `gorm:"primaryKey;type:varchar(255)" json:"key" `
	Value     string     `json:"value"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
	CreatedAt time.Time  `json:"created_at"`
	UpdatedAt time.Time  `json:"updated_at"`
}

type Logger interface {
	// Debug logs a message at debug level with optional key-value pairs.
	Debug(msg string, args ...any)
	// Info logs a message at info level with optional key-value pairs.
	Info(msg string, args ...any)
	// Warn logs a message at warn level with optional key-value pairs.
	Warn(msg string, args ...any)
	// Error logs a message at error level with optional key-value pairs.
	Error(msg string, args ...any)
}

type LoggerConfig struct {
	Level  string `json:"level" toml:"level"`
	Logger Logger `json:"-" toml:"-"`
}

type MailerService interface {
	Send(ctx context.Context, to string, subject string, body string, htmlBody string) error
}

type MeResult struct {
	User    *User    `json:"user"`
	Session *Session `json:"session"`
}

type Message struct {
	UUID     string
	Payload  []byte // Message payload (serialized data)
	Metadata map[string]string
}

type Mode string

type OAuth2LoginResult struct {
	AuthURL  string  // The authorization URL to redirect to
	State    string  // CSRF protection state
	Verifier *string // PKCE code verifier (if PKCE is required)
}

type OAuth2ProviderConfig struct {
	Enabled      bool     `json:"enabled" toml:"enabled"`
	ClientID     string   `json:"client_id" toml:"client_id"`
	ClientSecret string   `json:"client_secret" toml:"client_secret"`
	RedirectURL  string   `json:"redirect_url" toml:"redirect_url"`
	Scopes       []string `json:"scopes" toml:"scopes"`
	// For generic providers or overriding defaults
	AuthURL     string `json:"auth_url" toml:"auth_url"`
	TokenURL    string `json:"token_url" toml:"token_url"`
	UserInfoURL string `json:"user_info_url" toml:"user_info_url"`
}

type OAuth2UserInfo struct {
	ID       string
	Email    string
	Name     string
	Picture  string
	Verified bool
	Raw      map[string]any
}

type PasswordConfig struct {
	Hash   func(password string) (string, error)      `json:"-" toml:"-"`
	Verify func(hashedPassword, password string) bool `json:"-" toml:"-"`
}

type PasswordResetRequestResult struct {
	Message string `json:"message"`
}

type PasswordResetResult struct {
	Message string `json:"message"`
}

type PasswordService interface {
	HashPassword(password string) (string, error)
	VerifyPassword(password string, hash string) (bool, error)
}

type Plugin interface {
	Metadata() PluginMetadata
	SetMetadata(meta PluginMetadata)

	Config() PluginConfig
	SetConfig(cfg PluginConfig)

	Ctx() *PluginContext
	SetCtx(ctx *PluginContext)

	Init(ctx *PluginContext) error
	SetInit(fn func(ctx *PluginContext) error)

	Migrations() []any
	SetMigrations(migrations []any)

	Routes() []PluginRoute
	SetRoutes(routes []PluginRoute)

	RateLimit() *PluginRateLimit
	SetRateLimit(rateLimit *PluginRateLimit)

	EndpointHooks() any
	SetEndpointHooks(hooks any)

	DatabaseHooks() any
	SetDatabaseHooks(hooks any)

	EventHooks() any
	SetEventHooks(hooks any)

	Webhooks() any
	SetWebhooks(hooks any)

	Close() error
	SetClose(fn func() error)
}

type PluginConfig struct {
	Enabled bool
	Options any
}

type PluginContext struct {
	Config          *Config
	Api             AuthApi
	EventBus        EventBus
	Middleware      *ApiMiddleware
	WebhookExecutor WebhookExecutor
	Plugin          Plugin // Reference to the plugin being initialized
}

type PluginMetadata struct {
	Name        string
	Version     string
	Description string
}

type PluginOption func(p Plugin)

type PluginRateLimit = RateLimitConfig

type PluginRegistry interface {
	Register(p Plugin)
	InitAll() error
	RunMigrations() error
	Plugins() []Plugin
	CloseAll()
}

type PluginRoute struct {
	Method     string
	Path       string // Relative path, /auth is auto-prefixed
	Middleware []RouteMiddleware
	Handler    RouteHandler
}

type PluginsConfig struct {
	Plugins []Plugin
}

type ProviderType string

type PubSub interface {
	// Publish sends a message to the specified topic
	Publish(ctx context.Context, topic string, msg *Message) error

	// Subscribe returns a channel that receives messages from the specified topic.
	// The channel should be closed when the subscription is cancelled or closed.
	Subscribe(ctx context.Context, topic string) (<-chan *Message, error)

	// Close closes the pub/sub and cleans up resources
	Close() error
}

type RateLimitConfig struct {
	Enabled     bool                           `json:"enabled" toml:"enabled"`
	Window      time.Duration                  `json:"window" toml:"window"`
	Max         int                            `json:"max" toml:"max"`
	Algorithm   string                         `json:"algorithm" toml:"algorithm"`
	Prefix      string                         `json:"prefix" toml:"prefix"`
	CustomRules map[string]RateLimitCustomRule `json:"custom_rules" toml:"custom_rules"`
	IP          IPConfig                       `json:"ip" toml:"ip"`
}

type RateLimitCustomRule struct {
	Disabled bool          `json:"disabled" toml:"disabled"`
	Window   time.Duration `json:"window" toml:"window"`
	Max      int           `json:"max" toml:"max"`
}

type RateLimitService interface {
	Allow(ctx context.Context, key string, req *http.Request) (bool, error)
	GetClientIP(req *http.Request) string
	BuildKey(key string) string
}

type RouteHandler func() http.Handler

type RouteMiddleware func(http.Handler) http.Handler

type SecondaryStorage interface {
	Get(ctx context.Context, key string) (any, error)
	Set(ctx context.Context, key string, value any, ttl *time.Duration) error
	Delete(ctx context.Context, key string) error
	Incr(ctx context.Context, key string, ttl *time.Duration) (int, error)
	Close() error
}

type SecondaryStorageConfig struct {
	Type            SecondaryStorageType            `json:"type" toml:"type"`
	MemoryOptions   SecondaryStorageMemoryOptions   `json:"memory_options" toml:"memory_options"`
	DatabaseOptions SecondaryStorageDatabaseOptions `json:"database_options" toml:"database_options"`
	Storage         SecondaryStorage                `json:"-" toml:"-"`
}

type SecondaryStorageDatabaseOptions struct {
	// CleanupInterval controls how often expired entries are cleaned up.
	CleanupInterval time.Duration `json:"cleanup_interval" toml:"cleanup_interval"`
}

type SecondaryStorageMemoryOptions struct {
	// CleanupInterval controls how often expired entries are cleaned up.
	CleanupInterval time.Duration `json:"cleanup_interval" toml:"cleanup_interval"`
}

type SecondaryStorageType string

type Session struct {
	ID        string    `json:"id" gorm:"primaryKey"`
	UserID    string    `json:"user_id" gorm:"index"`
	Token     string    `json:"token" gorm:"uniqueIndex"`
	ExpiresAt time.Time `json:"expires_at"`
	IPAddress *string   `json:"ip_address,omitempty"`
	UserAgent *string   `json:"user_agent,omitempty"`
	CreatedAt time.Time `json:"created_at" gorm:"autoCreateTime"`
	UpdatedAt time.Time `json:"updated_at" gorm:"autoUpdateTime"`
}

type SessionConfig struct {
	CookieName string        `json:"cookie_name" toml:"cookie_name"`
	ExpiresIn  time.Duration `json:"expires_in" toml:"expires_in"`
	UpdateAge  time.Duration `json:"update_age" toml:"update_age"`
}

type SessionDatabaseHooksConfig struct {
	BeforeCreate func(session *Session) error
	AfterCreate  func(session Session) error
}

type SessionService interface {
	CreateSession(userID string, token string) (*Session, error)
	GetSessionByUserID(userID string) (*Session, error)
	GetSessionByToken(token string) (*Session, error)
	DeleteSessionByID(ID string) error
}

type SignInResult struct {
	Token     string  `json:"token"`
	User      *User   `json:"user"`
	CSRFToken *string `json:"csrf_token,omitempty"`
}

type SignOutResult struct {
	Message string `json:"message"`
}

type SignUpResult struct {
	Token     string  `json:"token,omitempty"`
	User      *User   `json:"user"`
	CSRFToken *string `json:"csrf_token,omitempty"`
}

type SocialProvidersConfig map[string]OAuth2ProviderConfig

type SubscriptionID uint64

type TokenService interface {
	GenerateToken() (string, error)
	HashToken(token string) string
	GenerateEncryptedToken() (string, error)
	EncryptToken(token string) (string, error)
	DecryptToken(encryptedToken string) (string, error)
}

type TrustedOriginsConfig struct {
	Origins []string `json:"origins" toml:"origins"`
}

type User struct {
	ID            string    `json:"id" gorm:"primaryKey"`
	Name          string    `json:"name"`
	Email         string    `json:"email" gorm:"uniqueIndex"`
	EmailVerified bool      `json:"email_verified"`
	Image         *string   `json:"image,omitempty"`
	CreatedAt     time.Time `json:"created_at" gorm:"autoCreateTime"`
	UpdatedAt     time.Time `json:"updated_at" gorm:"autoUpdateTime"`
}

type UserConfig struct {
	ChangeEmail ChangeEmailConfig `json:"change_email" toml:"change_email"`
}

type UserDatabaseHooksConfig struct {
	BeforeCreate func(user *User) error
	AfterCreate  func(user User) error
	BeforeUpdate func(user *User) error
	AfterUpdate  func(user User) error
}

type UserService interface {
	CreateUser(user *User) error
	GetUserByID(id string) (*User, error)
	GetUserByEmail(email string) (*User, error)
	UpdateUser(user *User) error
}

type Verification struct {
	ID         string           `json:"id" gorm:"primaryKey"`
	UserID     *string          `json:"user_id,omitempty"`
	Identifier string           `json:"identifier"` // email or other identifier
	Token      string           `json:"token"`
	Type       VerificationType `json:"type"`
	ExpiresAt  time.Time        `json:"expires_at"`
	CreatedAt  time.Time        `json:"created_at" gorm:"autoCreateTime"`
	UpdatedAt  time.Time        `json:"updated_at" gorm:"autoUpdateTime"`
}

type VerificationDatabaseHooksConfig struct {
	BeforeCreate func(verification *Verification) error
	AfterCreate  func(verification Verification) error
}

type VerificationService interface {
	CreateVerification(verif *Verification) error
	GetVerificationByToken(token string) (*Verification, error)
	DeleteVerification(id string) error
	IsExpired(verif *Verification) bool
}

type VerificationType string

type VerifyEmailResult struct {
	Message string `json:"message"`
	User    *User  `json:"user,omitempty"`
}

type WebhookConfig struct {
	URL            string            `json:"url" toml:"url"`
	Headers        map[string]string `json:"headers" toml:"headers"`
	TimeoutSeconds time.Duration     `json:"timeout_seconds" toml:"timeout_seconds"`
}

type WebhookExecutor interface {
	ExecuteWebhook(webhook *WebhookConfig, payload any) error
}

type WebhooksConfig struct {
	OnUserSignedUp    *WebhookConfig `json:"on_user_signed_up" toml:"on_user_signed_up"`
	OnUserLoggedIn    *WebhookConfig `json:"on_user_logged_in" toml:"on_user_logged_in"`
	OnEmailVerified   *WebhookConfig `json:"on_email_verified" toml:"on_email_verified"`
	OnPasswordChanged *WebhookConfig `json:"on_password_changed" toml:"on_password_changed"`
	OnEmailChanged    *WebhookConfig `json:"on_email_changed" toml:"on_email_changed"`
}