auth

type Claims struct {
	jwt.RegisteredClaims
	UserID   string    `json:"uid"`
	Username string    `json:"username"`
	Role     auth.Role `json:"role"`
	// PasswordChangedAt is the Unix nanosecond timestamp of the user's last password
	// change at token issuance. Zero means the user had never changed their password.
	// Tokens issued before a subsequent password change are rejected.
	PasswordChangedAt int64 `json:"pwd_changed_at_ns,omitempty"`
}

type Config struct {
	// TokenSecret is the opaque JWT signing key.
	TokenSecret auth.TokenSecret
	// TokenTTL is the token time-to-live.
	TokenTTL time.Duration
	// BcryptCost is the cost factor for bcrypt hashing.
	BcryptCost int
}

type CreateAPIKeyInput struct {
	Name               string
	Description        string
	Role               auth.Role
	WorkspaceAccess    *auth.WorkspaceAccess
	AllowedSurfaces    []auth.APIKeySurface
	AttributionClass   auth.APIKeyAttributionClass
	OwnerUserID        string
	ServiceAccountName string
}

type CreateAPIKeyResult struct {
	APIKey  *auth.APIKey
	FullKey string // Only returned once at creation
}

type CreateUserInput struct {
	Username        string
	Password        string
	Role            auth.Role
	WorkspaceAccess *auth.WorkspaceAccess
}

type CreateWebhookResult struct {
	Webhook   *auth.Webhook
	FullToken string // Only returned once at creation
}

type Option func(*Service)

type Service struct {
	// contains filtered or unexported fields
}

type TokenResult struct {
	Token     string
	ExpiresAt time.Time
}

type UpdateAPIKeyInput struct {
	Name               *string
	Description        *string
	Role               *auth.Role
	WorkspaceAccess    *auth.WorkspaceAccess
	AllowedSurfaces    *[]auth.APIKeySurface
	AttributionClass   *auth.APIKeyAttributionClass
	OwnerUserID        *string
	ServiceAccountName *string
}

type UpdateUserInput struct {
	Username        *string
	Role            *auth.Role
	WorkspaceAccess *auth.WorkspaceAccess
	Password        *string
	IsDisabled      *bool
}

type WebhookHMACSecretResult struct {
	Webhook    *auth.Webhook
	FullSecret string // Only returned once at creation or rotation
}