auth

type APIKey struct {
	ID          string    `json:"id"`
	UserID      string    `json:"user_id"`
	Name        string    `json:"name"`
	Permissions []string  `json:"permissions"`
	Environment string    `json:"environment"` // "live" or "test"
	KeyHash     string    `json:"-"`           // Never serialize key hash
	Prefix      string    `json:"prefix"`
	CreatedAt   time.Time `json:"created_at"`
	ExpiresAt   time.Time `json:"expires_at,omitempty"` // Zero value means no expiration
	LastUsed    time.Time `json:"last_used,omitempty"`
	Revoked     bool      `json:"revoked"`
}

type APIKeyHandler struct {
	// contains filtered or unexported fields
}

type APIKeyStore struct {
	// contains filtered or unexported fields
}

type AuthHandler struct {
	// contains filtered or unexported fields
}

type AuthProvider string

type ChangePasswordRequest struct {
	NewPassword string `json:"new_password"`
}

type ChangePasswordResponse struct {
	Success bool `json:"success"`
}

type Claims struct {
	UserID    string    `json:"user_id"`
	Username  string    `json:"username"`
	Role      string    `json:"role"`
	TenantID  string    `json:"tenant_id,omitempty"` // Multi-tenancy: empty defaults to "default" tenant
	ExpiresAt time.Time `json:"expires_at"`
	IssuedAt  time.Time `json:"issued_at"`
	// TokenGeneration is the user's token-generation counter at issue time
	// (security audit M-7). requireAuth rejects a token whose generation is
	// older than the user's current counter, so bumping the counter (on
	// password change, role change, or explicit revoke) invalidates every
	// outstanding token without rotating the global JWT secret. Absent on
	// legacy / offline-minted tokens → 0.
	TokenGeneration int `json:"gen,omitempty"`
}

type CompositeTokenValidator struct {
	// contains filtered or unexported fields
}

type CreateAPIKeyRequest struct {
	Name        string   `json:"name"`
	Permissions []string `json:"permissions"`
	ExpiresIn   int64    `json:"expires_in"` // seconds, 0 = never expires
}

type CreateAPIKeyResponse struct {
	Key    string  `json:"key"` // Only returned once!
	APIKey *APIKey `json:"api_key"`
}

type CreateUserRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
	Role     string `json:"role"`
}

type CreateUserResponse struct {
	User UserListItem `json:"user"`
}

type DeleteUserResponse struct {
	Success bool `json:"success"`
}

type ErrorResponse struct {
	Error   string `json:"error"`
	Message string `json:"message"`
}

type GetUserResponse struct {
	User UserListItem `json:"user"`
}

type JWTManager struct {
	// contains filtered or unexported fields
}

type ListUsersResponse struct {
	Users []UserListItem `json:"users"`
}

type LoginRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

type LoginResponse struct {
	AccessToken  string       `json:"access_token"`
	RefreshToken string       `json:"refresh_token"`
	User         UserResponse `json:"user"`
}

type MeResponse struct {
	User UserResponse `json:"user"`
}

type OIDCUserInfo struct {
	Subject           string // OIDC 'sub' claim (required)
	Issuer            string // OIDC issuer URL (required)
	Email             string
	EmailVerified     bool
	Name              string // Display name
	PreferredUsername string
	Picture           string
	Role              string // Mapped GraphDB role
}

type RefreshClaims struct {
	UserID    string    `json:"user_id"`
	ExpiresAt time.Time `json:"expires_at"`
	IssuedAt  time.Time `json:"issued_at"`
}

type RefreshRequest struct {
	RefreshToken string `json:"refresh_token"`
}

type RefreshResponse struct {
	AccessToken string `json:"access_token"`
}

type RegisterRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
	Role     string `json:"role"`
}

type RegisterResponse struct {
	User UserResponse `json:"user"`
}

type TokenValidator interface {
	// ValidateToken validates a token and returns claims.
	// Returns error if token is invalid, expired, or malformed.
	ValidateToken(ctx context.Context, token string) (*Claims, error)

	// Name returns the validator name for logging/debugging
	Name() string
}

type UpdateUserRequest struct {
	Role string `json:"role"`
}

type UpdateUserResponse struct {
	User UserListItem `json:"user"`
}

type User struct {
	ID           string `json:"id"`
	Username     string `json:"username"`
	PasswordHash string `json:"-"` // Never serialize password hash
	Role         string `json:"role"`
	CreatedAt    int64  `json:"created_at"`
	// TokenGeneration is the user's revocation counter (security audit
	// M-7). It is embedded in every login-issued JWT; requireAuth rejects
	// a token whose generation is older than this. Bumped on password
	// change, role change, or explicit RevokeUserTokens — invalidating all
	// outstanding tokens for the user without rotating the global JWT
	// secret. Serializes with the user (persists wherever SaveUsers runs).
	TokenGeneration int `json:"token_generation,omitempty"`

	// OIDC-specific fields (populated for OIDC users)
	AuthProvider  AuthProvider `json:"auth_provider,omitempty"`
	OIDCSubject   string       `json:"oidc_subject,omitempty"` // OIDC 'sub' claim - unique per issuer
	OIDCIssuer    string       `json:"oidc_issuer,omitempty"`  // OIDC issuer URL
	Email         string       `json:"email,omitempty"`        // User's email (from OIDC or manual)
	EmailVerified bool         `json:"email_verified,omitempty"`
	DisplayName   string       `json:"display_name,omitempty"`  // Full name from OIDC
	Picture       string       `json:"picture,omitempty"`       // Profile picture URL
	LastLoginAt   int64        `json:"last_login_at,omitempty"` // Last successful login timestamp
}

type UserListItem struct {
	ID        string `json:"id"`
	Username  string `json:"username"`
	Role      string `json:"role"`
	CreatedAt int64  `json:"created_at"`
}

type UserManagementHandler struct {
	// contains filtered or unexported fields
}

type UserResponse struct {
	ID       string `json:"id"`
	Username string `json:"username"`
	Role     string `json:"role"`
}

type UserStore struct {
	// contains filtered or unexported fields
}