auth

type Config struct {
	// CookieSecret is the HMAC key used to sign sessions. Must be
	// at least 32 bytes of entropy. If empty, New generates a
	// process-local random key — fine for dev, wrong for prod
	// because every restart invalidates every session.
	CookieSecret []byte

	// CookieName is the session cookie name. Defaults to
	// "rivolt_session".
	CookieName string

	// CookieTTL is how long a session is valid. Defaults to 30
	// days, short enough that a leaked cookie expires on its own
	// but long enough that users don't re-auth weekly.
	CookieTTL time.Duration

	// SecureCookie marks the cookie Secure so it's only sent over
	// HTTPS. Defaults to true; flip to false only for local http
	// development.
	SecureCookie bool

	// TrustedProxyCIDRs is the list of subnets whose
	// X-Forwarded-User / X-Forwarded-Email / X-Forwarded-Preferred-
	// Username headers are believed. Empty (the default) disables
	// header-based auth entirely, which is what self-hosted /
	// docker-compose deployments want: the in-app cookie login is
	// the only issuer.
	//
	// In a k8s deployment behind oauth2-proxy or Keycloak gatekeeper,
	// set this to the pod-network CIDR (e.g.
	// "10.0.0.0/8,127.0.0.1/32") — requests not coming from an
	// allowed source are treated as if the header weren't there,
	// so a direct client curl with a forged header falls back to
	// the cookie path and fails open to "unauthenticated". The
	// ingress is still expected to strip inbound X-Forwarded-*
	// from the client as a belt-and-braces measure.
	TrustedProxyCIDRs []*net.IPNet

	// OnAuth, when set, is told the method of every authenticated request
	// (cookie, kratos, header, bypass): a metrics hook. No user data.
	OnAuth func(method string)

	// HeaderUser / HeaderEmail are the header names the
	// upstream proxy writes the authenticated identity into.
	// Defaults follow oauth2-proxy conventions. Most proxies can
	// be configured to emit these exact names.
	HeaderUser  string
	HeaderEmail string

	// KratosCookieName is the name of the Ory Kratos session cookie
	// (default "ory_kratos_session"). When KratosResolver is set, a
	// request bearing this cookie is checked against Kratos's
	// /sessions/whoami; on success the resolved Rivolt UUID is
	// installed in the request context, identical to the cookie
	// path. Empty disables the issuer.
	KratosCookieName string

	// KratosHost, when set, restricts the Kratos session issuer to
	// requests whose Host header names it (hostname, case-insensitive,
	// port ignored). It must be the host where Kratos cookies are
	// legitimately issued (RIVOLT_KRATOS_COOKIE_HOST, e.g. rivolt.dev),
	// the SAME value on every install that shares that Kratos, NOT the
	// install's own host: a Kratos cookie scoped to a parent domain is
	// also sent to sibling hosts (preview, demo), and keying on their own
	// host would let them accept it. Empty keeps the old behaviour.
	KratosHost string

	// KratosResolver, when non-nil, enables the Kratos session
	// issuer. The function receives the cookie value (verbatim)
	// and returns the Rivolt user UUID, an "ok" flag (false →
	// no active session), and an error for transient failures.
	// Wired by main to a closure that calls kratos.Whoami and
	// runs the resulting identity through UserIDFor to produce
	// the same UUID the cookie / header issuers would.
	//
	// The resolver is called with the request context so it
	// inherits the request's deadline.
	KratosResolver func(ctx context.Context, cookieHeader string) (uuid.UUID, bool, error)

	// UserIDFor maps a username to the stable tenant UUID. main
	// wires this to db.UserIDFor; the indirection keeps the auth
	// package free of any direct dependency on the db package.
	UserIDFor func(username string) uuid.UUID

	// UsernameFor resolves a user UUID back to a display username
	// for /api/auth/me. Optional — when nil, Me returns an empty
	// username, which the SPA tolerates. Wired by main to a DB
	// lookup so OIDC sessions surface the IdP's display name.
	UsernameFor func(ctx context.Context, uid uuid.UUID) (string, error)

	// RoleFor resolves a user UUID to its role string
	// ("user" / "admin"). Optional — when nil, Me omits the
	// `role` field, which the SPA treats as "user". main wires
	// this to db.RoleFor so /api/admin/* visibility flips on
	// without an extra round-trip.
	RoleFor func(ctx context.Context, uid uuid.UUID) (string, error)

	// DisabledFor reports whether a user has been admin-disabled.
	// Optional — when nil the gate is open. Wired by main to
	// db.IsDisabled so a flipped flag invalidates every in-flight
	// session on the next request without needing to revoke each
	// session row by hand. A non-nil error is treated as "fail
	// closed": better to bounce the user to /login on a transient
	// DB blip than to honor a session for someone who may have
	// just been disabled.
	DisabledFor func(ctx context.Context, uid uuid.UUID) (bool, error)

	// BypassUserID, when non-zero, makes Middleware inject this
	// user on every request that doesn't already have an identity
	// resolved by header or cookie. Debug / local-dev only —
	// effectively disables auth. main logs a loud warning at boot
	// and refuses to set this when SecureCookie is true.
	BypassUserID uuid.UUID
}

type Service struct {
	// contains filtered or unexported fields
}

type SessionCreateOpts struct {
	UserAgent   string
	IPAddress   string
	DeviceLabel string
}

type SessionInfo struct {
	ID     uuid.UUID
	UserID uuid.UUID
}

type SessionRef struct {
	ID   uuid.UUID
	Kind string // "web" | "app" (sessions.KindWeb / KindApp)
}

type SessionStore interface {
	Create(ctx context.Context, userID uuid.UUID, ttl time.Duration, opts SessionCreateOpts) (SessionInfo, string, error)
	// Lookup resolves a browser session cookie (kind web only).
	Lookup(ctx context.Context, rawTokenCookie string) (SessionInfo, error)
	// LookupBearer resolves an iPhone app token (kind app only).
	LookupBearer(ctx context.Context, rawToken string) (SessionInfo, error)
	RevokeByToken(ctx context.Context, rawTokenCookie string) error
}