auth

type APIKey struct {
	ID             string                 `json:"id"`
	Name           string                 `json:"name"`
	KeyPrefix      string                 `json:"key_prefix"` // First 8 chars for identification
	KeyHash        string                 `json:"-"`          // Never exposed
	UserID         string                 `json:"user_id"`
	Scopes         []APIKeyScope          `json:"scopes"`
	ExpiresAt      *time.Time             `json:"expires_at,omitempty"`
	LastUsedAt     *time.Time             `json:"last_used_at,omitempty"`
	RateLimit      int                    `json:"rate_limit"` // Requests per minute
	RateLimitCurr  int                    `json:"-"`
	RateLimitReset time.Time              `json:"-"`
	Active         bool                   `json:"active"`
	Revoked        bool                   `json:"revoked"`
	RevokedAt      *time.Time             `json:"revoked_at,omitempty"`
	CreatedAt      time.Time              `json:"created_at"`
	UpdatedAt      time.Time              `json:"updated_at"`
	Metadata       map[string]interface{} `json:"metadata,omitempty"`
}

type APIKeyOption func(*APIKeyService)

type APIKeyRequest struct {
	Name      string                 `json:"name"`
	Scopes    []APIKeyScope          `json:"scopes"`
	ExpiresIn time.Duration          `json:"expires_in,omitempty"` // 0 = no expiration
	RateLimit int                    `json:"rate_limit,omitempty"` // 0 = use default
	Metadata  map[string]interface{} `json:"metadata,omitempty"`
}

type APIKeyResponse struct {
	ID        string                 `json:"id"`
	Name      string                 `json:"name"`
	Key       string                 `json:"key,omitempty"` // Only present on creation
	KeyPrefix string                 `json:"key_prefix"`
	Scopes    []APIKeyScope          `json:"scopes"`
	ExpiresAt *time.Time             `json:"expires_at,omitempty"`
	RateLimit int                    `json:"rate_limit"`
	CreatedAt time.Time              `json:"created_at"`
	Metadata  map[string]interface{} `json:"metadata,omitempty"`
}

type APIKeyScope string

type APIKeyService struct {
	// contains filtered or unexported fields
}

type Config struct {
	Provider        Provider
	ClientID        string
	ClientSecret    string
	RedirectURL     string
	AuthURL         string
	TokenURL        string
	UserInfoURL     string
	Scopes          []string
	SAMLMetadataURL string
	SAMLIssuer      string
	SAMLCertPath    string
	SessionDuration time.Duration
	CookieName      string
	CookieSecure    bool
	CookieHTTPOnly  bool
	CookieSameSite  http.SameSite
	RequireHTTPS    bool
	MaxSessions     int
	EnableMFA       bool
	AllowedDomains  []string
	BlockedDomains  []string
	LocalUsers      map[string]LocalUserConfig
}

type JWTAlgorithm string

type JWTClaims struct {
	Issuer           string                 `json:"iss,omitempty"`
	Subject          string                 `json:"sub,omitempty"`
	Audience         string                 `json:"aud,omitempty"`
	ExpiresAt        int64                  `json:"exp,omitempty"`
	NotBefore        int64                  `json:"nbf,omitempty"`
	IssuedAt         int64                  `json:"iat,omitempty"`
	JWTID            string                 `json:"jti,omitempty"`
	Name             string                 `json:"name,omitempty"`
	Email            string                 `json:"email,omitempty"`
	Role             Role                   `json:"role,omitempty"`
	Permissions      []Permission           `json:"permissions,omitempty"`
	Scopes           []APIKeyScope          `json:"scopes,omitempty"`
	TenantID         string                 `json:"tenant_id,omitempty"`
	SessionID        string                 `json:"session_id,omitempty"`
	DeviceID         string                 `json:"device_id,omitempty"`
	MFAVerified      bool                   `json:"mfa_verified,omitempty"`
	RefreshTokenHash string                 `json:"-"`
	Custom           map[string]interface{} `json:"custom,omitempty"`
}

type JWTConfig struct {
	Algorithm          JWTAlgorithm
	Secret             []byte
	PrivateKey         *rsa.PrivateKey
	PublicKey          *rsa.PublicKey
	AccessTokenExpiry  time.Duration
	RefreshTokenExpiry time.Duration
	Issuer             string
	Audience           string
	ValidateIssuer     bool
	ValidateAudience   bool
	RequireMFA         bool
	MaxTokensPerUser   int
}

type JWTHeader struct {
	Algorithm string `json:"alg"`
	Type      string `json:"typ"`
}

type JWTService struct {
	// contains filtered or unexported fields
}

type JWTToken struct {
	Claims       *JWTClaims
	RawHeader    string
	RawPayload   string
	RawSignature string
	Signature    []byte
	Valid        bool
	Errors       []error
}

type LocalUserConfig struct {
	PasswordHash string
	Salt         string
	Role         Role
	Enabled      bool
}

type LocalUserInfo struct {
	Username string
	Role     Role
	Enabled  bool
}

type LoginResult struct {
	Success   bool      `json:"success"`
	Token     string    `json:"token"`
	Error     string    `json:"error"`
	ExpiresAt time.Time `json:"expires_at"`
}

type Manager struct {
	// contains filtered or unexported fields
}

type OAuthEndpoints struct {
	AuthURL     string
	TokenURL    string
	UserInfoURL string
	Scopes      []string
}

type OAuthTokenResponse struct {
	AccessToken  string
	TokenType    string
	ExpiresIn    int
	RefreshToken string
	IDToken      string
	Scope        string
}

type OAuthUserInfo struct {
	ID            string
	Email         string
	Name          string
	GivenName     string
	FamilyName    string
	Picture       string
	VerifiedEmail bool
	Provider      string
}

type Permission string

type Provider string

type Role string

type Session struct {
	ID           string
	UserID       string
	User         *User
	CreatedAt    time.Time
	ExpiresAt    time.Time
	LastActivity time.Time
	IPAddress    string
	UserAgent    string
	Active       bool
}

type TokenPair struct {
	AccessToken  string    `json:"access_token"`
	RefreshToken string    `json:"refresh_token"`
	TokenType    string    `json:"token_type"`
	ExpiresIn    int       `json:"expires_in"`
	ExpiresAt    time.Time `json:"expires_at"`
}

type User struct {
	ID            string
	Email         string
	Name          string
	Provider      Provider
	ProviderID    string
	Role          Role
	Permissions   []Permission
	Attributes    map[string]interface{}
	SessionID     string
	Authenticated bool
	LastLogin     time.Time
	CreatedAt     time.Time
}