user

type ChangePasswordRequest struct {
	CurrentPassword string `json:"current_password" validate:"required"`
	NewPassword     string `json:"new_password" validate:"required"`
}

type CreateUserRequest struct {
	Username    string   `json:"username" validate:"required,min=3,max=50"`
	Email       *string  `json:"email,omitempty" validate:"omitempty,email"`
	Password    string   `json:"password" validate:"required"`
	Role        Role     `json:"role,omitempty"`
	Permissions []string `json:"permissions,omitempty"`
}

type Handler struct {
	// contains filtered or unexported fields
}

type InMemoryPasswordResetStore struct {
	// contains filtered or unexported fields
}

type ListUsersQuery struct {
	Page     int     `query:"page"`
	PageSize int     `query:"page_size"`
	Search   string  `query:"search"`
	Role     *Role   `query:"role"`
	Status   *Status `query:"status"`
	SortBy   string  `query:"sort_by"`
	SortDir  string  `query:"sort_dir"`
}

type ListUsersResponse struct {
	Users      []*User `json:"users"`
	Total      int64   `json:"total"`
	Page       int     `json:"page"`
	PageSize   int     `json:"page_size"`
	TotalPages int     `json:"total_pages"`
}

type LoginRequest struct {
	Username string `json:"username" validate:"required"`
	Password string `json:"password" validate:"required"`
}

type LoginResponse struct {
	Token        string `json:"token"`
	RefreshToken string `json:"refresh_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	ExpiresAt    string `json:"expires_at,omitempty"`
	User         *User  `json:"user"`
	MFARequired  bool   `json:"mfa_required,omitempty"`
	MFAToken     string `json:"mfa_token,omitempty"`
}

type PasswordHistory struct {
	ID           uuid.UUID `db:"id"`
	UserID       uuid.UUID `db:"user_id"`
	PasswordHash string    `db:"password_hash"`
	CreatedAt    time.Time `db:"created_at"`
}

type PasswordResetConfig struct {
	// TokenTTL is how long reset tokens are valid.
	TokenTTL time.Duration
	// MaxRequestsPerHour limits reset requests per user per hour.
	MaxRequestsPerHour int
	// TokenLength is the length of the reset token in bytes.
	TokenLength int
}

type PasswordResetConfirmRequest struct {
	Token       string `json:"token" validate:"required"`
	NewPassword string `json:"new_password" validate:"required"`
}

type PasswordResetRequest struct {
	Email string `json:"email" validate:"required,email"`
}

type PasswordResetResponse struct {
	Message string `json:"message"`
}

type PasswordResetService struct {
	// contains filtered or unexported fields
}

type PasswordResetStore interface {
	// Create creates a new reset token.
	Create(ctx context.Context, token *PasswordResetToken) error
	// GetByToken retrieves a reset token by token string.
	GetByToken(ctx context.Context, token string) (*PasswordResetToken, error)
	// MarkUsed marks a token as used.
	MarkUsed(ctx context.Context, id uuid.UUID) error
	// CountRecentByUser counts recent tokens for a user.
	CountRecentByUser(ctx context.Context, userID uuid.UUID, since time.Time) (int, error)
	// DeleteExpired removes expired tokens.
	DeleteExpired(ctx context.Context) error
}

type PasswordResetToken struct {
	ID        uuid.UUID  `json:"id" db:"id"`
	UserID    uuid.UUID  `json:"user_id" db:"user_id"`
	Token     string     `json:"-" db:"token"`
	ExpiresAt time.Time  `json:"expires_at" db:"expires_at"`
	UsedAt    *time.Time `json:"-" db:"used_at"`
	CreatedAt time.Time  `json:"created_at" db:"created_at"`
}

type PermissionService interface {
	GetEffectivePermissions(ctx context.Context, userID uuid.UUID) ([]string, error)
	SetUserPermissions(ctx context.Context, userID uuid.UUID, permissions []string, grantedBy *string) error
	InitializeUserPermissions(ctx context.Context, userID uuid.UUID, role string, grantedBy *string) error
	DeleteUserPermissions(ctx context.Context, userID uuid.UUID) error
}

type Repository interface {
	// Create creates a new user.
	Create(ctx context.Context, user *User) error
	// GetByID retrieves a user by ID.
	GetByID(ctx context.Context, id uuid.UUID) (*User, error)
	// GetByUsername retrieves a user by username.
	GetByUsername(ctx context.Context, username string) (*User, error)
	// GetByEmail retrieves a user by email.
	GetByEmail(ctx context.Context, email string) (*User, error)
	// Update updates a user.
	Update(ctx context.Context, user *User) error
	// Delete soft-deletes a user.
	Delete(ctx context.Context, id uuid.UUID) error
	// List retrieves users with pagination and filtering.
	List(ctx context.Context, query *ListUsersQuery) (*ListUsersResponse, error)
	// ExistsByUsername checks if a username exists.
	ExistsByUsername(ctx context.Context, username string) (bool, error)
	// ExistsByEmail checks if an email exists.
	ExistsByEmail(ctx context.Context, email string) (bool, error)
	// AnyUserExists checks if any non-deleted user exists.
	AnyUserExists(ctx context.Context) (bool, error)
	// AdminExists checks if any admin user exists.
	AdminExists(ctx context.Context) (bool, error)

	// Password history
	// AddPasswordHistory adds a password hash to history.
	AddPasswordHistory(ctx context.Context, userID uuid.UUID, passwordHash string) error
	// GetPasswordHistory retrieves password history for a user.
	GetPasswordHistory(ctx context.Context, userID uuid.UUID, limit int) ([]string, error)

	// Sessions
	// CreateSession creates a new session.
	CreateSession(ctx context.Context, session *Session) error
	// GetSessionByID retrieves a session by ID.
	GetSessionByID(ctx context.Context, id uuid.UUID) (*Session, error)
	// GetSessionByRefreshToken retrieves a session by refresh token.
	GetSessionByRefreshToken(ctx context.Context, token string) (*Session, error)
	// GetUserSessions retrieves all sessions for a user.
	GetUserSessions(ctx context.Context, userID uuid.UUID) ([]*Session, error)
	// RevokeSession revokes a session.
	RevokeSession(ctx context.Context, id uuid.UUID) error
	// RevokeUserSessions revokes all sessions for a user.
	RevokeUserSessions(ctx context.Context, userID uuid.UUID) error
	// CleanupExpiredSessions removes expired sessions.
	CleanupExpiredSessions(ctx context.Context) error
}

type ResetPasswordRequest struct {
	NewPassword string `json:"new_password" validate:"required"`
}

type Role string

type SQLiteRepository struct {
	// contains filtered or unexported fields
}

type Service struct {
	// contains filtered or unexported fields
}

type ServiceConfig struct {
	// LockoutThreshold is the number of failed attempts before lockout.
	LockoutThreshold int
	// LockoutDuration is how long the account is locked.
	LockoutDuration time.Duration
	// PasswordHistoryCount is the number of passwords to check for reuse.
	PasswordHistoryCount int
	// SessionDuration is how long sessions are valid.
	SessionDuration time.Duration
}

type Session struct {
	ID           uuid.UUID  `json:"id" db:"id"`
	UserID       uuid.UUID  `json:"user_id" db:"user_id"`
	RefreshToken string     `json:"-" db:"refresh_token"`
	UserAgent    string     `json:"user_agent" db:"user_agent"`
	IPAddress    string     `json:"ip_address" db:"ip_address"`
	ExpiresAt    time.Time  `json:"expires_at" db:"expires_at"`
	CreatedAt    time.Time  `json:"created_at" db:"created_at"`
	RevokedAt    *time.Time `json:"-" db:"revoked_at"`
}

type Status string

type UpdateUserRequest struct {
	Email       *string  `json:"email,omitempty" validate:"omitempty,email"`
	Role        *Role    `json:"role,omitempty"`
	Status      *Status  `json:"status,omitempty"`
	Permissions []string `json:"permissions,omitempty"`
}

type User struct {
	// ID is the unique identifier.
	ID uuid.UUID `json:"id" db:"id"`
	// Username is the unique username.
	Username string `json:"username" db:"username"`
	// Email is the optional email address.
	Email *string `json:"email,omitempty" db:"email"`
	// PasswordHash is the Argon2id hashed password.
	PasswordHash string `json:"-" db:"password_hash"`
	// MFASecret is the encrypted TOTP secret.
	MFASecret *string `json:"-" db:"mfa_secret"`
	// MFAEnabled indicates if MFA is enabled.
	MFAEnabled bool `json:"mfa_enabled" db:"mfa_enabled"`
	// Role is the user's role.
	Role Role `json:"role" db:"role"`
	// Status is the account status.
	Status Status `json:"status" db:"status"`
	// FailedLoginAttempts tracks consecutive failed logins.
	FailedLoginAttempts int `json:"-" db:"failed_login_attempts"`
	// LockedUntil is when the account lockout expires.
	LockedUntil *time.Time `json:"-" db:"locked_until"`
	// LastLoginAt is the last successful login time.
	LastLoginAt *time.Time `json:"last_login_at,omitempty" db:"last_login_at"`
	// CreatedAt is when the user was created.
	CreatedAt time.Time `json:"created_at" db:"created_at"`
	// UpdatedAt is when the user was last updated.
	UpdatedAt time.Time `json:"updated_at" db:"updated_at"`
	// DeletedAt is when the user was soft-deleted.
	DeletedAt *time.Time `json:"-" db:"deleted_at"`
}