auth

type APIKey struct {
	// Key is the hashed key value (SHA-256 hex or Argon2id PHC format).
	Key string
	// IdentityID maps this key to an Identity.
	IdentityID string
	// Name is a human-readable label for this key.
	Name string
	// CreatedAt is when the key was created (UTC).
	CreatedAt time.Time
	// ExpiresAt is when the key expires (nil = never expires).
	ExpiresAt *time.Time
	// Revoked indicates if the key has been revoked.
	Revoked bool
}

type APIKeyService struct {
	// contains filtered or unexported fields
}

type AuthStore interface {
	// GetAPIKey retrieves an API key by its hash.
	// Returns outbound.ErrKeyNotFound if key doesn't exist.
	GetAPIKey(ctx context.Context, keyHash string) (*APIKey, error)

	// GetIdentity retrieves user identity by ID.
	// Returns outbound.ErrIdentityNotFound if identity doesn't exist.
	GetIdentity(ctx context.Context, id string) (*Identity, error)

	// ListAPIKeys returns all stored API keys for iteration-based verification.
	ListAPIKeys(ctx context.Context) ([]*APIKey, error)
}

type ExtendedIdentity struct {
	Identity
	// Enabled indicates if this user is active.
	Enabled bool
	// CreatedAt is when the user was created (UTC).
	CreatedAt time.Time
	// UpdatedAt is when the user was last modified (UTC).
	UpdatedAt time.Time
}

type Identity struct {
	// ID is the unique identifier for this identity.
	ID string
	// Name is the display name for this identity.
	Name string
	// Roles are the roles assigned to this identity.
	Roles []Role
}

type Role string

type UserStore interface {
	// ListUsers retrieves all proxy users.
	// Returns both enabled and disabled users.
	ListUsers(ctx context.Context) ([]Identity, error)

	// GetUser retrieves a proxy user by ID.
	// Returns ErrUserNotFound if the user doesn't exist.
	GetUser(ctx context.Context, id string) (*Identity, error)

	// CreateUser creates a new proxy user.
	// The ID field is set by the implementation if empty.
	CreateUser(ctx context.Context, user *Identity) error

	// UpdateUser updates an existing proxy user.
	// Updates Name, Roles, and Enabled fields.
	UpdateUser(ctx context.Context, user *Identity) error

	// DeleteUser deletes a proxy user by ID.
	// Also deletes associated API keys (cascade).
	// Returns ErrUserNotFound if the user doesn't exist.
	DeleteUser(ctx context.Context, id string) error

	// CreateUserAPIKey creates a new API key for a proxy user.
	// The keyHash should be the SHA-256 hex hash of the raw API key.
	// Returns ErrUserNotFound if the user doesn't exist.
	CreateUserAPIKey(ctx context.Context, userID, keyHash string, expiresAt *time.Time) error

	// RevokeUserAPIKey revokes a proxy user's API key by its hash.
	// Returns ErrUserKeyNotFound if the key doesn't exist.
	RevokeUserAPIKey(ctx context.Context, keyHash string) error
}