authn

type Application struct {
	ID             string
	ExternalID     string
	OrgID          string
	Name           string
	DisplayName    string
	ClientID       string
	ClientSecret   string
	RedirectURIs   []string
	GrantTypes     []string
	Scopes         []string
	Providers      []string
	EnablePassword bool
	EnableSignup   bool
	Attributes     AttributeSet
}

type ApplicationAdmin interface {
	CreateApplication(ctx context.Context, req CreateApplicationRequest) (Application, error)
	GetApplication(ctx context.Context, orgID, appID string) (Application, error)
	UpdateApplication(ctx context.Context, req UpdateApplicationRequest) (Application, error)
	DeleteApplication(ctx context.Context, req DeleteApplicationRequest) error
}

type AssignUserToGroupRequest struct {
	OrgID    string
	GroupID  string
	UserID   string
	Metadata map[string]string
}

type AttributeSet map[string]any

type AuthCodeExchangeRequest struct {
	Code         string
	State        string
	RedirectURI  string
	CodeVerifier string
	OrgID        string
	AppID        string
	Metadata     map[string]string
}

type Authenticator interface {
	Authenticate(ctx context.Context, credential Credential) (Principal, error)
}

type CallbackRequest struct {
	Code          string
	State         string
	ExpectedState string
	RedirectURI   string
	OrgID         string
	AppID         string
	Metadata      map[string]string
}

type CallbackResult struct {
	Tokens    TokenSet
	Principal Principal
	State     string
	Provider  string
}

type CreateApplicationRequest struct {
	Application    Application
	IdempotencyKey string
	Metadata       map[string]string
}

type CreateGroupRequest struct {
	Group          Group
	IdempotencyKey string
	Metadata       map[string]string
}

type CreateOrganizationRequest struct {
	Organization   Organization
	IdempotencyKey string
	Metadata       map[string]string
}

type Credential struct {
	Scheme   string
	Token    string
	Metadata map[string]string
}

type DeleteApplicationRequest struct {
	AppID    string
	OrgID    string
	Hard     bool
	Metadata map[string]string
}

type DeleteGroupRequest struct {
	OrgID     string
	GroupID   string
	Recursive bool
	Metadata  map[string]string
}

type DeleteOrganizationRequest struct {
	OrgID    string
	Hard     bool
	Metadata map[string]string
}

type Group struct {
	ID          string
	ExternalID  string
	OrgID       string
	ParentID    string
	Name        string
	DisplayName string
	Type        string
	Path        string
	Users       []string
	Attributes  AttributeSet
}

type GroupAdmin interface {
	CreateGroup(ctx context.Context, req CreateGroupRequest) (Group, error)
	GetGroup(ctx context.Context, orgID, groupID string) (Group, error)
	ListGroups(ctx context.Context, filter GroupFilter) ([]Group, error)
	UpdateGroup(ctx context.Context, req UpdateGroupRequest) (Group, error)
	DeleteGroup(ctx context.Context, req DeleteGroupRequest) error
	AssignUserToGroup(ctx context.Context, req AssignUserToGroupRequest) error
	RemoveUserFromGroup(ctx context.Context, req AssignUserToGroupRequest) error
}

type GroupFilter struct {
	OrgID    string
	ParentID string
	Type     string
	UserID   string
	Limit    int
	Offset   int
}

type IdentityAdmin interface {
	TokenService
	UserDirectory
	OrganizationAdmin
	ApplicationAdmin
	GroupAdmin
}

type IdentityProfile struct {
	Principal Principal

	// User is the canonical user projection from the identity provider when it
	// can be read. It may be zero when only token claims were available.
	User User

	// Groups contains expanded group objects. Principal.Groups and User.Groups
	// are usually only group IDs/names; this slice carries display names, parent
	// IDs and group type when available.
	Groups []Group

	// CurrentApplication is the login/OIDC application used by the current flow.
	// A user does not usually "belong" to an application in the same way they
	// belong to a group; the application here means the OAuth client that issued
	// the token or handled the login.
	CurrentApplication Application

	Warnings   []string
	Attributes AttributeSet
}

type IdentityProfileRequest struct {
	Principal  Principal
	Token      string
	Credential Credential

	OrgID string
	AppID string

	IncludeUser               bool
	IncludeGroups             bool
	IncludeCurrentApplication bool

	// AllowPartial returns Principal plus whatever profile data can be read when
	// admin/read APIs fail. This is useful for normal request paths where token
	// authentication must not fail only because optional profile enrichment is
	// unavailable.
	AllowPartial bool

	Metadata map[string]string
}

type LoginService interface {
	BuildLoginURL(ctx context.Context, req LoginURLRequest) (LoginURL, error)
	HandleCallback(ctx context.Context, req CallbackRequest) (CallbackResult, error)
}

type LoginURL struct {
	URL         string
	RedirectURI string
	State       string
	Scope       string
	Provider    string
	OrgID       string
	AppID       string
}

type LoginURLRequest struct {
	RedirectURI string
	State       string
	Scope       string
	OrgID       string
	AppID       string
	Metadata    map[string]string
}

type Organization struct {
	ID          string
	ExternalID  string
	Name        string
	DisplayName string
	OwnerID     string
	ParentID    string
	Tags        []string
	Enabled     bool
	Attributes  AttributeSet
}

type OrganizationAdmin interface {
	CreateOrganization(ctx context.Context, req CreateOrganizationRequest) (Organization, error)
	GetOrganization(ctx context.Context, orgID string) (Organization, error)
	UpdateOrganization(ctx context.Context, req UpdateOrganizationRequest) (Organization, error)
	DeleteOrganization(ctx context.Context, req DeleteOrganizationRequest) error
}

type Principal struct {
	SubjectID   string
	SubjectType string

	Provider   string
	ExternalID string
	Issuer     string
	Audience   []string

	TenantID  string
	OrgID     string
	AppID     string
	ProjectID string

	Username string
	Name     string
	Email    string
	Phone    string

	Roles  []string
	Groups []string
	Scopes []string

	// AuthMethod records how the subject authenticated. It is intentionally a
	// string instead of an enum type so adapters can preserve provider-specific
	// methods while still using the AuthMethod* constants above.
	AuthMethod string

	Attributes AttributeSet
	IssuedAt   time.Time
	ExpiresAt  time.Time
}

type ProfileService interface {
	GetIdentityProfile(ctx context.Context, req IdentityProfileRequest) (IdentityProfile, error)
}

type RefreshTokenRequest struct {
	RefreshToken string
	Scope        string
	OrgID        string
	AppID        string
	Metadata     map[string]string
}

type RevokeTokenRequest struct {
	Token     string
	TokenType string
	OrgID     string
	AppID     string
	Metadata  map[string]string
}

type TokenAuthenticator struct {
	Verifier TokenVerifier
	Issuer   string
	Audience []string
	OrgID    string
	AppID    string
}

type TokenService interface {
	ExchangeCode(ctx context.Context, req AuthCodeExchangeRequest) (TokenSet, Principal, error)
	RefreshToken(ctx context.Context, req RefreshTokenRequest) (TokenSet, error)
	VerifyToken(ctx context.Context, req VerifyTokenRequest) (Principal, error)
	RevokeToken(ctx context.Context, req RevokeTokenRequest) error
}

type TokenSet struct {
	AccessToken  string
	RefreshToken string
	IDToken      string
	TokenType    string
	Scope        string
	ExpiresAt    time.Time
	Raw          AttributeSet
}

type TokenVerifier func(ctx context.Context, req VerifyTokenRequest) (Principal, error)

type UpdateApplicationRequest struct {
	Application Application
	Metadata    map[string]string
}

type UpdateGroupRequest struct {
	Group    Group
	Metadata map[string]string
}

type UpdateOrganizationRequest struct {
	Organization Organization
	Metadata     map[string]string
}

type User struct {
	ID          string
	ExternalID  string
	Provider    string
	OrgID       string
	Username    string
	DisplayName string
	Email       string
	Phone       string
	Roles       []string
	Groups      []string
	Enabled     bool
	Attributes  AttributeSet
}

type UserDirectory interface {
	GetUser(ctx context.Context, orgID, userID string) (User, error)
	FindUsers(ctx context.Context, filter UserFilter) ([]User, error)
	UpsertUser(ctx context.Context, user User) (User, error)
	DisableUser(ctx context.Context, orgID, userID string) error
}

type UserFilter struct {
	ID         string
	ExternalID string
	OrgID      string
	Username   string
	Email      string
	Phone      string
	GroupID    string
	Role       string
	Limit      int
	Offset     int
}

type VerifyTokenRequest struct {
	Token     string
	TokenType string
	Issuer    string
	Audience  []string
	OrgID     string
	AppID     string
	Leeway    time.Duration
	Metadata  map[string]string
}