auth

type AuthPlugin struct {
	// contains filtered or unexported fields
}

type BackupCode struct {
	Code   string
	Used   bool
	UsedAt *time.Time
}

type Claims struct {
	UserID string `json:"user_id"`
	Email  string `json:"email"`
	Role   string `json:"role"`
	jwt.RegisteredClaims
}

type Config struct {
	// JWTSecret is the secret key for JWT signing.
	JWTSecret string `yaml:"jwt_secret" json:"jwtSecret"`

	// JWTExpiry is the JWT token expiry duration in hours.
	JWTExpiry int `yaml:"jwt_expiry" json:"jwtExpiry"`

	// Issuer is the JWT issuer.
	Issuer string `yaml:"issuer" json:"issuer"`

	// OAuthProviders is a list of enabled OAuth providers.
	OAuthProviders []string `yaml:"oauth_providers" json:"oauthProviders"`

	// Google OAuth config.
	GoogleClientID     string `yaml:"google_client_id" json:"googleClientId"`
	GoogleClientSecret string `yaml:"google_client_secret" json:"googleClientSecret"`

	// Facebook OAuth config.
	FacebookClientID     string `yaml:"facebook_client_id" json:"facebookClientId"`
	FacebookClientSecret string `yaml:"facebook_client_secret" json:"facebookClientSecret"`

	// GitHub OAuth config.
	GitHubClientID     string `yaml:"github_client_id" json:"githubClientId"`
	GitHubClientSecret string `yaml:"github_client_secret" json:"githubClientSecret"`

	// Microsoft OAuth config.
	MicrosoftClientID     string `yaml:"microsoft_client_id" json:"microsoftClientId"`
	MicrosoftClientSecret string `yaml:"microsoft_client_secret" json:"microsoftClientSecret"`

	// Discord OAuth config.
	DiscordClientID     string `yaml:"discord_client_id" json:"discordClientId"`
	DiscordClientSecret string `yaml:"discord_client_secret" json:"discordClientSecret"`

	// Telegram OAuth config.
	TelegramBotToken string `yaml:"telegram_bot_token" json:"telegramBotToken"`

	// Twitter/X OAuth config.
	TwitterClientID     string `yaml:"twitter_client_id" json:"twitterClientId"`
	TwitterClientSecret string `yaml:"twitter_client_secret" json:"twitterClientSecret"`

	// OTP config.
	OTPEnabled      bool   `yaml:"otp_enabled" json:"otpEnabled"`
	OTPIssuer       string `yaml:"otp_issuer" json:"otpIssuer"`
	OTPDigits       int    `yaml:"otp_digits" json:"otpDigits"`
	OTPPeriod       int    `yaml:"otp_period" json:"otpPeriod"`
	BackupCodeCount int    `yaml:"backup_code_count" json:"backupCodeCount"`

	// OutputDir is where generated auth code is written.
	OutputDir string `yaml:"output_dir" json:"outputDir"`

	// AllowOutputEscape allows code generation output outside project/workspace root.
	AllowOutputEscape bool `yaml:"allow_output_escape" json:"allowOutputEscape"`

	// ResolveOTPSecret resolves the OTP secret for an authenticated user ID.
	// If nil, storage key auth:otp:secret:user:<id> is used when storage is configured.
	ResolveOTPSecret func(userID string) (string, error) `yaml:"-" json:"-"`
}

type OAuthProvider struct {
	Name         string
	ClientID     string
	ClientSecret string
	AuthURL      string
	TokenURL     string
	UserURL      string
	Scopes       []string
}

type OTPConfig struct {
	Secret  string
	Digits  int
	Period  int
	Issuer  string
	Account string
}

type User struct {
	ID    string `json:"id"`
	Email string `json:"email"`
	Role  string `json:"role"`
}