types

type AuthAuthKnightInterface interface {
	AuthSharedInterface

	// LinkAuthKnightLogin returns the AuthKnight-hosted login URL
	// with back_url and next_url parameters set.
	LinkAuthKnightLogin(backURL, nextURL string) string

	// LinkAuthKnightRedirect builds the full AuthKnight login URL from the request,
	// deriving back_url (cancel) and next_url (callback) from the request scheme+host.
	LinkAuthKnightRedirect(r *http.Request) string

	// LinkAuthKnightCallback returns the callback URL on this server
	// that AuthKnight will redirect to after successful authentication.
	LinkAuthKnightCallback() string

	// IsAuthKnight returns true when the instance is configured for AuthKnight mode.
	IsAuthKnight() bool

	// AuthKnight-specific accessors
	GetAuthKnightUserFindByEmail() func(ctx context.Context, email string, options UserAuthOptions) (string, error)
	GetAuthKnightUserRegister() func(ctx context.Context, email, firstName, lastName string, options UserAuthOptions) (string, error)
	GetAuthKnightRedirectURL() func(ctx context.Context, userID string) string
	GetAuthKnightHTTPTimeout() time.Duration
}

type AuthPasswordInterface interface {
	AuthSharedInterface

	// Password reset URLs (web and API).
	LinkPasswordRestore() string
	LinkPasswordReset(token string) string
	LinkApiPasswordRestore() string
	LinkApiPasswordReset() string
}

type AuthPasswordlessInterface interface {
	AuthSharedInterface

	// Passwordless-only URL helpers.
	LinkLoginCodeVerify() string
	LinkApiLoginCodeVerify() string
}

type AuthSharedInterface interface {
	// Router returns an HTTP mux that serves all auth routes.
	Router() *http.ServeMux

	IsRegistrationEnabled() bool
	IsPasswordless() bool
	IsVerificationEnabled() bool

	// Middlewares for protecting or enriching routes.
	WebAuthOrRedirectMiddleware(next http.Handler) http.Handler
	// ApiAuthOrErrorMiddleware(next http.Handler) http.Handler
	WebAppendUserIdIfExistsMiddleware(next http.Handler) http.Handler

	// Current user lookup from the request context.
	GetCurrentUserID(r *http.Request) string

	// Web URL helpers
	LinkLogin() string
	LinkLogout() string
	LinkRegister() string
	LinkRegisterCodeVerify() string
	LinkRedirectOnSuccess() string

	// API URL helpers
	LinkApiLogin() string
	LinkApiLogout() string
	LinkApiRegister() string
	LinkApiRegisterCodeVerify() string
	LinkApiImpersonateStart() string
	LinkApiImpersonateStop() string

	GetEndpoint() string
	SetEndpoint(endpoint string)

	GetLogger() *slog.Logger
	SetLogger(logger *slog.Logger)

	GetLayout() func(content string) string
	SetLayout(layout func(content string) string)

	GetFuncTemporaryKeyGet() func(key string) (string, error)
	SetFuncTemporaryKeyGet(fn func(key string) (string, error))

	GetFuncTemporaryKeySet() func(key string, value string, expiresSeconds int) error
	SetFuncTemporaryKeySet(fn func(key string, value string, expiresSeconds int) error)

	GetUseCookies() bool
	SetUseCookies(useCookies bool)

	GetCookieName() string
	SetCookieName(name string)

	GetFuncUserFindByAuthToken() func(ctx context.Context, token string, options UserAuthOptions) (userID string, err error)
	SetFuncUserFindByAuthToken(fn func(ctx context.Context, token string, options UserAuthOptions) (userID string, err error))

	// Additional accessors used by internal API flows.
	GetDisableRateLimit() bool
	SetDisableRateLimit(disable bool)

	GetPasswordStrength() *PasswordStrengthConfig
	SetPasswordStrength(cfg *PasswordStrengthConfig)

	GetFuncUserLogin() func(ctx context.Context, username, password string, options UserAuthOptions) (string, error)
	SetFuncUserLogin(fn func(ctx context.Context, username, password string, options UserAuthOptions) (string, error))

	GetPasswordlessUserRegister() func(ctx context.Context, email, firstName, lastName string, options UserAuthOptions) error
	SetPasswordlessUserRegister(fn func(ctx context.Context, email, firstName, lastName string, options UserAuthOptions) error)

	GetFuncUserRegister() func(ctx context.Context, username, password, firstName, lastName string, options UserAuthOptions) error
	SetFuncUserRegister(fn func(ctx context.Context, username, password, firstName, lastName string, options UserAuthOptions) error)

	GetFuncUserPasswordChange() func(ctx context.Context, userID, password string, options UserAuthOptions) error
	SetFuncUserPasswordChange(fn func(ctx context.Context, userID, password string, options UserAuthOptions) error)

	GetFuncUserLogout() func(ctx context.Context, userID string, options UserAuthOptions) error
	SetFuncUserLogout(fn func(ctx context.Context, userID string, options UserAuthOptions) error)

	GetPasswordlessUserFindByEmail() func(ctx context.Context, email string, options UserAuthOptions) (string, error)
	SetPasswordlessUserFindByEmail(fn func(ctx context.Context, email string, options UserAuthOptions) (string, error))

	GetFuncUserFindByUsername() func(ctx context.Context, username, firstName, lastName string, options UserAuthOptions) (string, error)
	SetFuncUserFindByUsername(fn func(ctx context.Context, username, firstName, lastName string, options UserAuthOptions) (string, error))

	GetFuncEmailTemplatePasswordRestore() func(ctx context.Context, userID string, passwordRestoreLink string, options UserAuthOptions) string
	SetFuncEmailTemplatePasswordRestore(fn func(ctx context.Context, userID string, passwordRestoreLink string, options UserAuthOptions) string)

	GetFuncEmailTemplateRegisterCode() func(ctx context.Context, email string, registerLink string, options UserAuthOptions) string
	SetFuncEmailTemplateRegisterCode(fn func(ctx context.Context, email string, registerLink string, options UserAuthOptions) string)

	GetFuncEmailSend() func(ctx context.Context, userID, emailSubject, emailBody string) error
	SetFuncEmailSend(fn func(ctx context.Context, userID, emailSubject, emailBody string) error)

	GetPasswordlessFuncEmailTemplateLoginCode() func(ctx context.Context, email string, loginLink string, options UserAuthOptions) string
	SetPasswordlessFuncEmailTemplateLoginCode(fn func(ctx context.Context, email string, loginLink string, options UserAuthOptions) string)

	GetPasswordlessFuncEmailTemplateRegisterCode() func(ctx context.Context, email string, registerLink string, options UserAuthOptions) string
	SetPasswordlessFuncEmailTemplateRegisterCode(fn func(ctx context.Context, email string, registerLink string, options UserAuthOptions) string)

	GetPasswordlessFuncEmailSend() func(ctx context.Context, email string, emailSubject, emailBody string) error
	SetPasswordlessFuncEmailSend(fn func(ctx context.Context, email string, emailSubject, emailBody string) error)

	GetFuncUserStoreAuthToken() func(ctx context.Context, token, userID string, options UserAuthOptions) error
	SetFuncUserStoreAuthToken(fn func(ctx context.Context, token, userID string, options UserAuthOptions) error)

	SetAuthCookie(w http.ResponseWriter, r *http.Request, token string)
	RemoveAuthCookie(w http.ResponseWriter, r *http.Request)

	// Observability hooks for metrics and tracing (optional).
	GetObservabilityHooks() ObservabilityHooks
	SetObservabilityHooks(hooks ObservabilityHooks)

	// Final authentication step helpers used by internal API flows.
	AuthenticateViaUsername(w http.ResponseWriter, r *http.Request, email, firstName, lastName string)

	IsImpersonationEnabled() bool

	GetFuncCanImpersonate() func(ctx context.Context, adminUserID string, targetUserID string) (bool, error)
	SetFuncCanImpersonate(fn func(ctx context.Context, adminUserID string, targetUserID string) (bool, error))

	GetFuncImpersonationStart() func(ctx context.Context, adminUserID string, targetUserID string) error
	SetFuncImpersonationStart(fn func(ctx context.Context, adminUserID string, targetUserID string) error)

	GetFuncImpersonationStop() func(ctx context.Context, adminUserID string, targetUserID string) error
	SetFuncImpersonationStop(fn func(ctx context.Context, adminUserID string, targetUserID string) error)
}

type AuthenticatedUserID struct{}

type ConfigAuthKnight struct {
	ConfigShared
	ConfigRateLimiting
	ConfigCSRF
	ConfigImpersonation

	// FuncUserFindByEmail finds a user by email and returns their ID.
	// Required.
	FuncUserFindByEmail func(ctx context.Context, email string, options UserAuthOptions) (userID string, err error)

	// FuncUserRegister creates a new user with email, first name, and last name.
	// The email is already verified by AuthKnight — no verification step needed.
	// Called when the user submits the register form (first name + last name).
	// Required.
	FuncUserRegister func(ctx context.Context, email string, firstName string, lastName string, options UserAuthOptions) (userID string, err error)

	// FuncRedirectURL calculates the redirect URL after successful auth.
	// If nil, falls back to UrlRedirectOnSuccess.
	FuncRedirectURL func(ctx context.Context, userID string) string

	// HTTPTimeout for calls to the AuthKnight API. Defaults to 10 seconds.
	HTTPTimeout time.Duration
}

type ConfigCSRF struct {
	EnableCSRFProtection bool
	CSRFSecret           string
}

type ConfigImpersonation struct {
	EnableImpersonation    bool
	FuncCanImpersonate     func(ctx context.Context, adminUserID string, targetUserID string) (bool, error)
	FuncImpersonationStart func(ctx context.Context, adminUserID string, targetUserID string) error
	FuncImpersonationStop  func(ctx context.Context, adminUserID string, targetUserID string) error
}

type ConfigPasswordless struct {
	ConfigShared
	ConfigRateLimiting
	ConfigCSRF
	ConfigImpersonation

	// ===== START: passwordless options
	FuncUserFindByEmail           func(ctx context.Context, email string, options UserAuthOptions) (userID string, err error)
	FuncEmailTemplateLoginCode    func(ctx context.Context, email string, loginLink string, options UserAuthOptions) string    // optional
	FuncEmailTemplateRegisterCode func(ctx context.Context, email string, registerLink string, options UserAuthOptions) string // optional
	FuncEmailSend                 func(ctx context.Context, email string, emailSubject string, emailBody string) (err error)
	FuncUserRegister              func(ctx context.Context, email string, firstName string, lastName string, options UserAuthOptions) (err error)
}

type ConfigRateLimiting struct {
	DisableRateLimit   bool
	FuncCheckRateLimit func(ip string, endpoint string) (allowed bool, retryAfter time.Duration, err error)
	MaxLoginAttempts   int
	LockoutDuration    time.Duration
}

type ConfigShared struct {
	EnableRegistration      bool
	Endpoint                string
	FuncLayout              func(content string) string
	FuncTemporaryKeyGet     func(key string) (value string, err error)
	FuncTemporaryKeySet     func(key string, value string, expiresSeconds int) (err error)
	FuncUserStoreAuthToken  func(ctx context.Context, sessionID string, userID string, options UserAuthOptions) error
	FuncUserFindByAuthToken func(ctx context.Context, sessionID string, options UserAuthOptions) (userID string, err error)
	FuncUserLogout          func(ctx context.Context, userID string, options UserAuthOptions) (err error)
	UrlRedirectOnSuccess    string
	UseCookies              bool
	UseLocalStorage         bool
	CookieConfig            *CookieConfig
	Logger                  *slog.Logger
	ObservabilityHooks      ObservabilityHooks
}

type ConfigUsernameAndPassword struct {
	ConfigShared
	ConfigRateLimiting
	ConfigCSRF
	ConfigImpersonation

	// ===== START: username(email) and password options
	EnableVerification               bool
	FuncEmailTemplatePasswordRestore func(ctx context.Context, userID string, passwordRestoreLink string, options UserAuthOptions) string // optional
	FuncEmailTemplateRegisterCode    func(ctx context.Context, userID string, registerLink string, options UserAuthOptions) string        // optional
	FuncEmailSend                    func(ctx context.Context, userID string, emailSubject string, emailBody string) (err error)
	FuncUserFindByUsername           func(ctx context.Context, username string, firstName string, lastName string, options UserAuthOptions) (userID string, err error)
	FuncUserLogin                    func(ctx context.Context, username string, password string, options UserAuthOptions) (userID string, err error)
	FuncUserPasswordChange           func(ctx context.Context, username string, newPassword string, options UserAuthOptions) (err error)
	FuncUserRegister                 func(ctx context.Context, username string, password string, firstName string, lastName string, options UserAuthOptions) (err error)
	PasswordStrength                 *PasswordStrengthConfig
	LabelUsername                    string
}

type CookieConfig struct {
	Name     string
	HttpOnly string
	Secure   string
	SameSite http.SameSite
	MaxAge   int
	Domain   string
	Path     string
}

type CookieOption func(*CookieConfig)

type ImpersonatorUserID struct{}

type IsImpersonating struct{}

type NoopObservabilityHooks struct{}

type ObservabilityHooks interface {
	// RecordLoginAttempt is called after every login attempt (success or
	// failure). method is "password" or "passwordless". err is nil on
	// success.
	RecordLoginAttempt(method string, success bool, err error)

	// RecordRegistrationAttempt is called after every registration attempt.
	// err is nil on success.
	RecordRegistrationAttempt(success bool, err error)

	// RecordRateLimitHit is called when a request is denied due to rate
	// limiting.
	RecordRateLimitHit(endpoint string, ip string)

	// RecordSessionCreated is called when a new session/token is issued
	// for a user.
	RecordSessionCreated(userID string)

	// RecordPasswordReset is called after a password reset attempt.
	// err is nil on success.
	RecordPasswordReset(success bool, err error)

	// RecordImpersonationStart is called when an admin begins impersonating
	// another user.
	RecordImpersonationStart(adminUserID string, targetUserID string)

	// RecordImpersonationStop is called when an admin stops impersonating
	// another user.
	RecordImpersonationStop(adminUserID string, targetUserID string)
}

type PasswordStrengthConfig struct {
	MinLength         int
	RequireUppercase  bool
	RequireLowercase  bool
	RequireDigit      bool
	RequireSpecial    bool
	ForbidCommonWords bool
}

type UserAuthOptions struct {
	UserIp    string
	UserAgent string
}