models

type AccessToken struct {
	ID        string `gorm:"primaryKey"`
	Token     string `gorm:"uniqueIndex;not null"`
	TokenType string `gorm:"not null;default:'Bearer'"`
	UserID    string `gorm:"not null;index"`
	ClientID  string `gorm:"not null;index"`
	Scopes    string `gorm:"not null"` // space-separated scopes
	ExpiresAt time.Time
	CreatedAt time.Time
}

type DeviceCode struct {
	DeviceCode   string `gorm:"primaryKey"`
	UserCode     string `gorm:"uniqueIndex;not null"`
	ClientID     string `gorm:"not null;index"`
	Scopes       string `gorm:"not null"` // space-separated scopes
	ExpiresAt    time.Time
	Interval     int    // polling interval in seconds
	UserID       string // filled after authorization
	Authorized   bool   `gorm:"default:false"`
	AuthorizedAt time.Time
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type OAuthClient struct {
	ClientID     string `gorm:"primaryKey"`
	ClientSecret string `gorm:"not null"` // bcrypt hashed secret
	ClientName   string `gorm:"not null"`
	Description  string `gorm:"type:text"`
	Scopes       string `gorm:"not null"`                       // space-separated scopes
	GrantTypes   string `gorm:"not null;default:'device_code'"` // comma-separated grant types
	RedirectURIs string `gorm:"type:text"`                      // comma-separated redirect URIs
	IsActive     bool   `gorm:"not null;default:true"`
	CreatedBy    string // User ID who created this client
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type User struct {
	ID           string `gorm:"primaryKey"`
	Username     string `gorm:"uniqueIndex;not null"`
	PasswordHash string `gorm:"not null"`
	Role         string `gorm:"not null;default:'user'"` // "admin" or "user"
	CreatedAt    time.Time
	UpdatedAt    time.Time
}