models

type AccessToken struct {
	ID            string `gorm:"primaryKey"`
	Token         string `gorm:"uniqueIndex;not null"`
	TokenType     string `gorm:"not null;default:'Bearer'"`
	TokenCategory string `gorm:"not null;default:'access';index"` // 'access' or 'refresh'
	Status        string `gorm:"not null;default:'active';index"` // 'active', 'disabled', 'revoked'
	UserID        string `gorm:"not null;index"`
	ClientID      string `gorm:"not null;index"`
	Scopes        string `gorm:"not null"` // space-separated scopes
	ExpiresAt     time.Time
	CreatedAt     time.Time
	LastUsedAt    *time.Time `gorm:"index"` // Last time token was used (for refresh tokens)
	ParentTokenID string     `gorm:"index"` // Links access tokens to their refresh token
}

type DeviceCode struct {
	DeviceCode   string `gorm:"primaryKey"`
	UserCode     string `gorm:"uniqueIndex;not null"`
	ClientID     string `gorm:"not null;index"`
	Scopes       string `gorm:"not null"` // space-separated scopes
	ExpiresAt    time.Time
	Interval     int    // polling interval in seconds
	UserID       string // filled after authorization
	Authorized   bool   `gorm:"default:false"`
	AuthorizedAt time.Time
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type OAuthClient struct {
	ClientID     string `gorm:"primaryKey"`
	ClientSecret string `gorm:"not null"` // bcrypt hashed secret
	ClientName   string `gorm:"not null"`
	Description  string `gorm:"type:text"`
	Scopes       string `gorm:"not null"`                       // space-separated scopes
	GrantTypes   string `gorm:"not null;default:'device_code'"` // comma-separated grant types
	RedirectURIs string `gorm:"type:text"`                      // comma-separated redirect URIs
	IsActive     bool   `gorm:"not null;default:true"`
	CreatedBy    string // User ID who created this client
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type User struct {
	ID           string `gorm:"primaryKey"`
	Username     string `gorm:"uniqueIndex;not null"`
	PasswordHash string `gorm:"not null"`
	Role         string `gorm:"not null;default:'user'"` // "admin" or "user"

	// External authentication support
	ExternalID string `gorm:"index"`           // External user ID (e.g., from HTTP API)
	AuthSource string `gorm:"default:'local'"` // "local" or "http_api"
	Email      string // User email (optional)
	FullName   string // User full name (optional)

	CreatedAt time.Time
	UpdatedAt time.Time
}