models

type AccessToken struct {
	ID            string `gorm:"primaryKey"`
	Token         string `gorm:"uniqueIndex;not null"`
	TokenType     string `gorm:"not null;default:'Bearer'"`
	TokenCategory string `gorm:"not null;default:'access';index"` // 'access' or 'refresh'
	Status        string `gorm:"not null;default:'active';index"` // 'active', 'disabled', 'revoked'
	UserID        string `gorm:"not null;index"`
	ClientID      string `gorm:"not null;index"`
	Scopes        string `gorm:"not null"` // space-separated scopes
	ExpiresAt     time.Time
	CreatedAt     time.Time
	LastUsedAt    *time.Time `gorm:"index"` // Last time token was used (for refresh tokens)
	ParentTokenID string     `gorm:"index"` // Links access tokens to their refresh token
}

type DeviceCode struct {
	DeviceCode   string `gorm:"primaryKey"`
	UserCode     string `gorm:"uniqueIndex;not null"`
	ClientID     string `gorm:"not null;index"`
	Scopes       string `gorm:"not null"` // space-separated scopes
	ExpiresAt    time.Time
	Interval     int    // polling interval in seconds
	UserID       string // filled after authorization
	Authorized   bool   `gorm:"default:false"`
	AuthorizedAt time.Time
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type OAuthClient struct {
	ClientID     string `gorm:"primaryKey"`
	ClientSecret string `gorm:"not null"` // bcrypt hashed secret
	ClientName   string `gorm:"not null"`
	Description  string `gorm:"type:text"`
	Scopes       string `gorm:"not null"`                       // space-separated scopes
	GrantTypes   string `gorm:"not null;default:'device_code'"` // comma-separated grant types
	RedirectURIs string `gorm:"type:text"`                      // comma-separated redirect URIs
	IsActive     bool   `gorm:"not null;default:true"`
	CreatedBy    string // User ID who created this client
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type OAuthConnection struct {
	ID             string `gorm:"primaryKey"`
	UserID         string `gorm:"not null;uniqueIndex:idx_oauth_user_provider,priority:1"`
	Provider       string `gorm:"not null;uniqueIndex:idx_oauth_provider_user,priority:1;uniqueIndex:idx_oauth_user_provider,priority:2"` // "github", "gitea", "gitlab"
	ProviderUserID string `gorm:"not null;uniqueIndex:idx_oauth_provider_user,priority:2"`                                                // Provider's user ID

	// OAuth metadata (snapshot for audit/reference)
	ProviderUsername string // Provider's username
	ProviderEmail    string // Provider's email (snapshot)
	AvatarURL        string // User avatar URL from provider

	// Token storage (should be encrypted in production)
	AccessToken  string    `gorm:"type:text"` // OAuth access token
	RefreshToken string    `gorm:"type:text"` // OAuth refresh token
	TokenExpiry  time.Time // Token expiration time

	// Activity tracking
	LastUsedAt time.Time

	CreatedAt time.Time
	UpdatedAt time.Time
}

type User struct {
	ID           string `gorm:"primaryKey"`
	Username     string `gorm:"uniqueIndex;not null"`
	Email        string `gorm:"uniqueIndex;not null"` // Email is unique and required
	PasswordHash string // OAuth-only users have empty password
	Role         string `gorm:"not null;default:'user'"` // "admin" or "user"
	FullName     string // User full name
	AvatarURL    string // User avatar URL (from OAuth or manual)

	// External authentication support
	ExternalID string `gorm:"index"`           // External user ID (e.g., from HTTP API)
	AuthSource string `gorm:"default:'local'"` // "local" or "http_api"

	CreatedAt time.Time
	UpdatedAt time.Time
}