sectypes

type ColumnSecurity struct {
	Schema       string            `json:"schema"`
	Tablename    string            `json:"tablename"`
	Path         []string          `json:"path"`
	ExtraFilters map[string]string `json:"extra_filters"`
	UserID       int               `json:"user_id"`
	Accesstype   string            `json:"accesstype"`
	MaskStart    int               `json:"mask_start"`
	MaskEnd      int               `json:"mask_end"`
	MaskInvert   bool              `json:"mask_invert"`
	MaskChar     string            `json:"mask_char"`
	Control      string            `json:"control"`
	ID           int               `json:"id"`
}

type CreateKeyRequest struct {
	UserID    int
	KeyType   KeyType
	Name      string
	Scopes    []string
	Meta      map[string]any
	ExpiresAt *time.Time
}

type CreateKeyResponse struct {
	Key    UserKey
	RawKey string // crypto/rand 32 bytes, base64url-encoded
}

type KeyType string

type LoginRequest struct {
	Username      string         `json:"username"`
	Password      string         `json:"password"`
	TwoFactorCode string         `json:"two_factor_code,omitempty"` // TOTP or backup code
	Claims        map[string]any `json:"claims"`                    // Additional login data
	Meta          map[string]any `json:"meta"`                      // Additional metadata to be set on user context
}

type LoginResponse struct {
	Token              string           `json:"token"`
	RefreshToken       string           `json:"refresh_token"`
	User               *UserContext     `json:"user"`
	ExpiresIn          int64            `json:"expires_in"`                 // Token expiration in seconds
	Requires2FA        bool             `json:"requires_2fa"`               // True if 2FA code is required
	TwoFactorSetupData *TwoFactorSecret `json:"two_factor_setup,omitempty"` // Present when setting up 2FA
	Meta               map[string]any   `json:"meta"`                       // Additional metadata to be set on user context
}

type LogoutRequest struct {
	Token  string `json:"token"`
	UserID int    `json:"user_id"`
}

type OAuthCode struct {
	Code                string    `json:"code"`
	ClientID            string    `json:"client_id"`
	RedirectURI         string    `json:"redirect_uri"`
	ClientState         string    `json:"client_state,omitempty"`
	CodeChallenge       string    `json:"code_challenge"`
	CodeChallengeMethod string    `json:"code_challenge_method"`
	SessionToken        string    `json:"session_token"`
	RefreshToken        string    `json:"refresh_token,omitempty"`
	Scopes              []string  `json:"scopes,omitempty"`
	ExpiresAt           time.Time `json:"expires_at"`

	UserID       int            `json:"user_id,omitempty"`
	Nonce        string         `json:"nonce,omitempty"`
	AuthTime     int64          `json:"auth_time,omitempty"`
	ACR          string         `json:"acr,omitempty"`
	AMR          []string       `json:"amr,omitempty"`
	SessionID    string         `json:"sid,omitempty"`
	Claims       map[string]any `json:"claims,omitempty"`
	Resource     []string       `json:"resource,omitempty"`
	DPoPJKT      string         `json:"dpop_jkt,omitempty"`
	ResponseType string         `json:"response_type,omitempty"`
	ConsentedAt  int64          `json:"consented_at,omitempty"`
}

type OAuthServerClient struct {
	ClientID                string   `json:"client_id"`
	RedirectURIs            []string `json:"redirect_uris"`
	ClientName              string   `json:"client_name,omitempty"`
	GrantTypes              []string `json:"grant_types"`
	AllowedScopes           []string `json:"allowed_scopes,omitempty"`
	ClientSecretHash        string   `json:"client_secret_hash,omitempty"`
	TokenEndpointAuthMethod string   `json:"token_endpoint_auth_method,omitempty"`

	ResponseTypes               []string        `json:"response_types,omitempty"`
	ClientURI                   string          `json:"client_uri,omitempty"`
	LogoURI                     string          `json:"logo_uri,omitempty"`
	Contacts                    []string        `json:"contacts,omitempty"`
	PostLogoutRedirectURIs      []string        `json:"post_logout_redirect_uris,omitempty"`
	BackchannelLogoutURI        string          `json:"backchannel_logout_uri,omitempty"`
	JWKS                        json.RawMessage `json:"jwks,omitempty"`
	JWKSURI                     string          `json:"jwks_uri,omitempty"`
	IDTokenSignedResponseAlg    string          `json:"id_token_signed_response_alg,omitempty"`
	UserinfoSignedResponseAlg   string          `json:"userinfo_signed_response_alg,omitempty"`
	TokenEndpointAuthSigningAlg string          `json:"token_endpoint_auth_signing_alg,omitempty"`
	RequireConsent              bool            `json:"require_consent,omitempty"`
	FirstParty                  bool            `json:"first_party,omitempty"`
	RequirePAR                  bool            `json:"require_pushed_authorization_requests,omitempty"`
	DPoPBoundAccessTokens       bool            `json:"dpop_bound_access_tokens,omitempty"`
	RegistrationAccessTokenHash string          `json:"registration_access_token_hash,omitempty"`
	ClientSecretExpiresAt       int64           `json:"client_secret_expires_at,omitempty"`
	ClientIDIssuedAt            int64           `json:"client_id_issued_at,omitempty"`
}

type OAuthTokenInfo struct {
	Active    bool     `json:"active"`
	Sub       string   `json:"sub,omitempty"`
	Username  string   `json:"username,omitempty"`
	Email     string   `json:"email,omitempty"`
	UserLevel int      `json:"user_level,omitempty"`
	Roles     []string `json:"roles,omitempty"`
	Exp       int64    `json:"exp,omitempty"`
	Iat       int64    `json:"iat,omitempty"`

	// Filled in by the OAuth server, not by the stores.
	Scope     string         `json:"scope,omitempty"`
	ClientID  string         `json:"client_id,omitempty"`
	TokenType string         `json:"token_type,omitempty"`
	Iss       string         `json:"iss,omitempty"`
	Aud       []string       `json:"aud,omitempty"`
	Jti       string         `json:"jti,omitempty"`
	Cnf       map[string]any `json:"cnf,omitempty"`
}

type PasskeyAuthenticationOptions struct {
	Challenge        []byte                        `json:"challenge"`
	Timeout          int64                         `json:"timeout,omitempty"`
	RelyingPartyID   string                        `json:"rpId,omitempty"`
	AllowCredentials []PasskeyCredentialDescriptor `json:"allowCredentials,omitempty"`
	UserVerification string                        `json:"userVerification,omitempty"` // required, preferred, discouraged
	Extensions       map[string]any                `json:"extensions,omitempty"`
}

type PasskeyAuthenticationResponse struct {
	ID                     string                                `json:"id"`    // Base64URL encoded credential ID
	RawID                  []byte                                `json:"rawId"` // Raw credential ID
	Type                   string                                `json:"type"`  // "public-key"
	Response               PasskeyAuthenticatorAssertionResponse `json:"response"`
	ClientExtensionResults map[string]any                        `json:"clientExtensionResults,omitempty"`
}

type PasskeyAuthenticatorAssertionResponse struct {
	ClientDataJSON    []byte `json:"clientDataJSON"`
	AuthenticatorData []byte `json:"authenticatorData"`
	Signature         []byte `json:"signature"`
	UserHandle        []byte `json:"userHandle,omitempty"`
}

type PasskeyAuthenticatorAttestationResponse struct {
	ClientDataJSON    []byte   `json:"clientDataJSON"`
	AttestationObject []byte   `json:"attestationObject"`
	Transports        []string `json:"transports,omitempty"`
}

type PasskeyAuthenticatorSelection struct {
	AuthenticatorAttachment string `json:"authenticatorAttachment,omitempty"` // platform, cross-platform
	RequireResidentKey      bool   `json:"requireResidentKey,omitempty"`
	ResidentKey             string `json:"residentKey,omitempty"`      // discouraged, preferred, required
	UserVerification        string `json:"userVerification,omitempty"` // required, preferred, discouraged
}

type PasskeyCredential struct {
	ID              string    `json:"id"`
	UserID          int       `json:"user_id"`
	CredentialID    []byte    `json:"credential_id"`        // Raw credential ID from authenticator
	PublicKey       []byte    `json:"public_key"`           // COSE public key
	AttestationType string    `json:"attestation_type"`     // none, indirect, direct
	AAGUID          []byte    `json:"aaguid"`               // Authenticator AAGUID
	SignCount       uint32    `json:"sign_count"`           // Signature counter
	CloneWarning    bool      `json:"clone_warning"`        // True if cloning detected
	Transports      []string  `json:"transports,omitempty"` // usb, nfc, ble, internal
	BackupEligible  bool      `json:"backup_eligible"`      // Credential can be backed up
	BackupState     bool      `json:"backup_state"`         // Credential is currently backed up
	Name            string    `json:"name,omitempty"`       // User-friendly name
	CreatedAt       time.Time `json:"created_at"`
	LastUsedAt      time.Time `json:"last_used_at"`
}

type PasskeyCredentialDescriptor struct {
	Type       string   `json:"type"`                 // "public-key"
	ID         []byte   `json:"id"`                   // Credential ID
	Transports []string `json:"transports,omitempty"` // usb, nfc, ble, internal
}

type PasskeyCredentialParam struct {
	Type string `json:"type"` // "public-key"
	Alg  int    `json:"alg"`  // COSE algorithm identifier (e.g., -7 for ES256, -257 for RS256)
}

type PasskeyRegistrationOptions struct {
	Challenge              []byte                         `json:"challenge"`
	RelyingParty           PasskeyRelyingParty            `json:"rp"`
	User                   PasskeyUser                    `json:"user"`
	PubKeyCredParams       []PasskeyCredentialParam       `json:"pubKeyCredParams"`
	Timeout                int64                          `json:"timeout,omitempty"` // Milliseconds
	ExcludeCredentials     []PasskeyCredentialDescriptor  `json:"excludeCredentials,omitempty"`
	AuthenticatorSelection *PasskeyAuthenticatorSelection `json:"authenticatorSelection,omitempty"`
	Attestation            string                         `json:"attestation,omitempty"` // none, indirect, direct, enterprise
	Extensions             map[string]any                 `json:"extensions,omitempty"`
}

type PasskeyRegistrationResponse struct {
	ID                     string                                  `json:"id"`    // Base64URL encoded credential ID
	RawID                  []byte                                  `json:"rawId"` // Raw credential ID
	Type                   string                                  `json:"type"`  // "public-key"
	Response               PasskeyAuthenticatorAttestationResponse `json:"response"`
	ClientExtensionResults map[string]any                          `json:"clientExtensionResults,omitempty"`
	Transports             []string                                `json:"transports,omitempty"`
}

type PasskeyRelyingParty struct {
	ID   string `json:"id"`   // Domain (e.g., "example.com")
	Name string `json:"name"` // Display name
}

type PasskeyUser struct {
	ID          []byte `json:"id"`          // User handle (unique, persistent)
	Name        string `json:"name"`        // Username
	DisplayName string `json:"displayName"` // Display name
}

type PasswordResetCompleteRequest struct {
	Token       string `json:"token"`
	NewPassword string `json:"new_password"`
}

type PasswordResetRequest struct {
	Email    string `json:"email,omitempty"`
	Username string `json:"username,omitempty"`
}

type PasswordResetResponse struct {
	// Token is the reset token to be delivered out-of-band (e.g. email).
	// The stored procedure may return it for delivery or leave it empty
	// if the delivery is handled entirely in the database.
	Token     string `json:"token"`
	ExpiresIn int64  `json:"expires_in"` // seconds
}

type RegisterRequest struct {
	Username  string         `json:"username"`
	Password  string         `json:"password"`
	Email     string         `json:"email"`
	UserLevel int            `json:"user_level"`
	Roles     []string       `json:"roles"`
	Claims    map[string]any `json:"claims"` // Additional registration data
	Meta      map[string]any `json:"meta"`   // Additional metadata
}

type RowSecurity struct {
	Schema    string `json:"schema"`
	Tablename string `json:"tablename"`
	Template  string `json:"template"`
	HasBlock  bool   `json:"has_block"`
	// UserID is the opaque user reference the security rules were loaded for.
	// It may be an int, a string/UUID, or a *UserContext, depending on what the
	// RowSecurityProvider/SecurityContext.GetUserRef implementation returns.
	UserID any `json:"user_id"`
}

type TwoFactorSecret struct {
	Secret      string   `json:"secret"`       // Base32 encoded secret
	QRCodeURL   string   `json:"qr_code_url"`  // URL for QR code generation
	BackupCodes []string `json:"backup_codes"` // One-time backup codes
	Issuer      string   `json:"issuer"`       // Application name
	AccountName string   `json:"account_name"` // User identifier (email/username)
}

type UserContext struct {
	UserID           int            `json:"user_id"`
	UserName         string         `json:"user_name"`
	UserLevel        int            `json:"user_level"`
	SessionID        string         `json:"session_id"`
	SessionRID       int64          `json:"session_rid"`
	RemoteID         string         `json:"remote_id"`
	Roles            []string       `json:"roles"`
	Email            string         `json:"email"`
	Claims           map[string]any `json:"claims"`
	Meta             map[string]any `json:"meta"`               // Additional metadata that can hold any JSON-serializable values
	TwoFactorEnabled bool           `json:"two_factor_enabled"` // Indicates if 2FA is enabled for this user
	ProgramUserID    int            `json:"program_user_id"`
	ProgramUserTable string         `json:"program_user_table"`
}

type UserKey struct {
	ID         int64          `json:"id"`
	UserID     int            `json:"user_id"`
	KeyType    KeyType        `json:"key_type"`
	KeyHash    string         `json:"key_hash"` // SHA-256 hex; never the raw key
	Name       string         `json:"name"`
	Scopes     []string       `json:"scopes,omitempty"`
	Meta       map[string]any `json:"meta,omitempty"`
	ExpiresAt  *time.Time     `json:"expires_at,omitempty"`
	CreatedAt  time.Time      `json:"created_at"`
	LastUsedAt *time.Time     `json:"last_used_at,omitempty"`
	IsActive   bool           `json:"is_active"`
}