types

type AuthPasswordInterface interface {
	AuthSharedInterface

	// Password reset URLs (web and API).
	LinkPasswordRestore() string
	LinkPasswordReset(token string) string
	LinkApiPasswordRestore() string
	LinkApiPasswordReset() string
}

type AuthPasswordlessInterface interface {
	AuthSharedInterface

	// Passwordless-only URL helpers.
	LinkLoginCodeVerify() string
	LinkApiLoginCodeVerify() string
}

type AuthSharedInterface interface {
	// Router returns an HTTP mux that serves all auth routes.
	Router() *http.ServeMux

	IsRegistrationEnabled() bool
	IsPasswordless() bool
	IsVerificationEnabled() bool

	// Middlewares for protecting or enriching routes.
	WebAuthOrRedirectMiddleware(next http.Handler) http.Handler
	// ApiAuthOrErrorMiddleware(next http.Handler) http.Handler
	WebAppendUserIdIfExistsMiddleware(next http.Handler) http.Handler

	// Current user lookup from the request context.
	GetCurrentUserID(r *http.Request) string

	// Web URL helpers
	LinkLogin() string
	LinkLogout() string
	LinkRegister() string
	LinkRegisterCodeVerify() string
	LinkRedirectOnSuccess() string

	// API URL helpers
	LinkApiLogin() string
	LinkApiLogout() string
	LinkApiRegister() string
	LinkApiRegisterCodeVerify() string
	LinkApiImpersonateStart() string
	LinkApiImpersonateStop() string

	GetEndpoint() string
	SetEndpoint(endpoint string)

	GetLogger() *slog.Logger
	SetLogger(logger *slog.Logger)

	GetLayout() func(content string) string
	SetLayout(layout func(content string) string)

	GetFuncTemporaryKeyGet() func(key string) (string, error)
	SetFuncTemporaryKeyGet(fn func(key string) (string, error))

	GetFuncTemporaryKeySet() func(key string, value string, expiresSeconds int) error
	SetFuncTemporaryKeySet(fn func(key string, value string, expiresSeconds int) error)

	GetUseCookies() bool
	SetUseCookies(useCookies bool)

	GetCookieName() string
	SetCookieName(name string)

	GetFuncUserFindByAuthToken() func(ctx context.Context, token string, options UserAuthOptions) (userID string, err error)
	SetFuncUserFindByAuthToken(fn func(ctx context.Context, token string, options UserAuthOptions) (userID string, err error))

	// Additional accessors used by internal API flows.
	GetDisableRateLimit() bool
	SetDisableRateLimit(disable bool)

	GetPasswordStrength() *PasswordStrengthConfig
	SetPasswordStrength(cfg *PasswordStrengthConfig)

	GetFuncUserLogin() func(ctx context.Context, username, password string, options UserAuthOptions) (string, error)
	SetFuncUserLogin(fn func(ctx context.Context, username, password string, options UserAuthOptions) (string, error))

	GetPasswordlessUserRegister() func(ctx context.Context, email, firstName, lastName string, options UserAuthOptions) error
	SetPasswordlessUserRegister(fn func(ctx context.Context, email, firstName, lastName string, options UserAuthOptions) error)

	GetFuncUserRegister() func(ctx context.Context, username, password, firstName, lastName string, options UserAuthOptions) error
	SetFuncUserRegister(fn func(ctx context.Context, username, password, firstName, lastName string, options UserAuthOptions) error)

	GetFuncUserPasswordChange() func(ctx context.Context, userID, password string, options UserAuthOptions) error
	SetFuncUserPasswordChange(fn func(ctx context.Context, userID, password string, options UserAuthOptions) error)

	GetFuncUserLogout() func(ctx context.Context, userID string, options UserAuthOptions) error
	SetFuncUserLogout(fn func(ctx context.Context, userID string, options UserAuthOptions) error)

	GetPasswordlessUserFindByEmail() func(ctx context.Context, email string, options UserAuthOptions) (string, error)
	SetPasswordlessUserFindByEmail(fn func(ctx context.Context, email string, options UserAuthOptions) (string, error))

	GetFuncUserFindByUsername() func(ctx context.Context, username, firstName, lastName string, options UserAuthOptions) (string, error)
	SetFuncUserFindByUsername(fn func(ctx context.Context, username, firstName, lastName string, options UserAuthOptions) (string, error))

	GetFuncEmailTemplatePasswordRestore() func(ctx context.Context, userID string, passwordRestoreLink string, options UserAuthOptions) string
	SetFuncEmailTemplatePasswordRestore(fn func(ctx context.Context, userID string, passwordRestoreLink string, options UserAuthOptions) string)

	GetFuncEmailTemplateRegisterCode() func(ctx context.Context, email string, passwordRestoreLink string, options UserAuthOptions) string
	SetFuncEmailTemplateRegisterCode(fn func(ctx context.Context, email string, passwordRestoreLink string, options UserAuthOptions) string)

	GetFuncEmailSend() func(ctx context.Context, userID, emailSubject, emailBody string) error
	SetFuncEmailSend(fn func(ctx context.Context, userID, emailSubject, emailBody string) error)

	GetPasswordlessFuncEmailTemplateLoginCode() func(ctx context.Context, email string, passwordRestoreLink string, options UserAuthOptions) string
	SetPasswordlessFuncEmailTemplateLoginCode(fn func(ctx context.Context, email string, passwordRestoreLink string, options UserAuthOptions) string)

	GetPasswordlessFuncEmailTemplateRegisterCode() func(ctx context.Context, email string, passwordRestoreLink string, options UserAuthOptions) string
	SetPasswordlessFuncEmailTemplateRegisterCode(fn func(ctx context.Context, email string, passwordRestoreLink string, options UserAuthOptions) string)

	GetPasswordlessFuncEmailSend() func(ctx context.Context, email string, emailSubject, emailBody string) error
	SetPasswordlessFuncEmailSend(fn func(ctx context.Context, email string, emailSubject, emailBody string) error)

	GetFuncUserStoreAuthToken() func(ctx context.Context, token, userID string, options UserAuthOptions) error
	SetFuncUserStoreAuthToken(fn func(ctx context.Context, token, userID string, options UserAuthOptions) error)

	SetAuthCookie(w http.ResponseWriter, r *http.Request, token string)
	RemoveAuthCookie(w http.ResponseWriter, r *http.Request)

	// Observability hooks for metrics and tracing (optional).
	GetObservabilityHooks() ObservabilityHooks
	SetObservabilityHooks(hooks ObservabilityHooks)

	// Final authentication step helpers used by internal API flows.
	AuthenticateViaUsername(w http.ResponseWriter, r *http.Request, email, firstName, lastName string)

	IsImpersonationEnabled() bool

	GetFuncCanImpersonate() func(ctx context.Context, adminUserID string, targetUserID string) (bool, error)
	SetFuncCanImpersonate(fn func(ctx context.Context, adminUserID string, targetUserID string) (bool, error))

	GetFuncImpersonationStart() func(ctx context.Context, adminUserID string, targetUserID string) error
	SetFuncImpersonationStart(fn func(ctx context.Context, adminUserID string, targetUserID string) error)

	GetFuncImpersonationStop() func(ctx context.Context, adminUserID string, targetUserID string) error
	SetFuncImpersonationStop(fn func(ctx context.Context, adminUserID string, targetUserID string) error)
}

type AuthenticatedUserID struct{}

type ConfigPasswordless struct {

	// ===== START: shared by all implementations
	EnableRegistration      bool
	Endpoint                string
	FuncLayout              func(content string) string
	FuncTemporaryKeyGet     func(key string) (value string, err error)
	FuncTemporaryKeySet     func(key string, value string, expiresSeconds int) (err error)
	FuncUserFindByAuthToken func(ctx context.Context, sessionID string, options UserAuthOptions) (userID string, err error)
	FuncUserLogout          func(ctx context.Context, userID string, options UserAuthOptions) (err error)
	FuncUserStoreAuthToken  func(ctx context.Context, sessionID string, userID string, options UserAuthOptions) error
	UrlRedirectOnSuccess    string
	UseCookies              bool
	UseLocalStorage         bool
	CookieConfig            *CookieConfig
	// Rate limiting options
	DisableRateLimit   bool                                                                                 // Set to true to disable rate limiting (not recommended for production)
	FuncCheckRateLimit func(ip string, endpoint string) (allowed bool, retryAfter time.Duration, err error) // Optional: override default rate limiter
	MaxLoginAttempts   int                                                                                  // Maximum attempts before lockout (default: 5)
	LockoutDuration    time.Duration                                                                        // Duration to lock after max attempts (default: 15 minutes)
	// CSRF Protection
	EnableCSRFProtection bool
	CSRFSecret           string
	Logger               *slog.Logger

	// Impersonation
	EnableImpersonation    bool
	FuncCanImpersonate     func(ctx context.Context, adminUserID string, targetUserID string) (bool, error)
	FuncImpersonationStart func(ctx context.Context, adminUserID string, targetUserID string) error // optional
	FuncImpersonationStop  func(ctx context.Context, adminUserID string, targetUserID string) error // optional

	// ===== START: passwordless options
	FuncUserFindByEmail           func(ctx context.Context, email string, options UserAuthOptions) (userID string, err error)
	FuncEmailTemplateLoginCode    func(ctx context.Context, email string, logingLink string, options UserAuthOptions) string   // optional
	FuncEmailTemplateRegisterCode func(ctx context.Context, email string, registerLink string, options UserAuthOptions) string // optional
	FuncEmailSend                 func(ctx context.Context, email string, emailSubject string, emailBody string) (err error)
	FuncUserRegister              func(ctx context.Context, email string, firstName string, lastName string, options UserAuthOptions) (err error)
	// Observability hooks for metrics and tracing (optional)
	ObservabilityHooks ObservabilityHooks
}

type ConfigUsernameAndPassword struct {
	// ===== START: shared by all implementations
	EnableRegistration      bool
	Endpoint                string
	FuncLayout              func(content string) string
	FuncTemporaryKeyGet     func(key string) (value string, err error)
	FuncTemporaryKeySet     func(key string, value string, expiresSeconds int) (err error)
	FuncUserStoreAuthToken  func(ctx context.Context, sessionID string, userID string, options UserAuthOptions) error
	FuncUserFindByAuthToken func(ctx context.Context, sessionID string, options UserAuthOptions) (userID string, err error)
	UrlRedirectOnSuccess    string
	UseCookies              bool
	UseLocalStorage         bool
	CookieConfig            *CookieConfig
	// Rate limiting options
	DisableRateLimit   bool                                                                                 // Set to true to disable rate limiting (not recommended for production)
	FuncCheckRateLimit func(ip string, endpoint string) (allowed bool, retryAfter time.Duration, err error) // Optional: override default rate limiter
	MaxLoginAttempts   int                                                                                  // Maximum attempts before lockout (default: 5)
	LockoutDuration    time.Duration                                                                        // Duration to lock after max attempts (default: 15 minutes)
	// CSRF Protection
	EnableCSRFProtection bool
	CSRFSecret           string
	Logger               *slog.Logger

	// Impersonation
	EnableImpersonation    bool
	FuncCanImpersonate     func(ctx context.Context, adminUserID string, targetUserID string) (bool, error)
	FuncImpersonationStart func(ctx context.Context, adminUserID string, targetUserID string) error // optional
	FuncImpersonationStop  func(ctx context.Context, adminUserID string, targetUserID string) error // optional

	// ===== START: username(email) and password options
	EnableVerification               bool
	FuncEmailTemplatePasswordRestore func(ctx context.Context, userID string, passwordRestoreLink string, options UserAuthOptions) string // optional
	FuncEmailTemplateRegisterCode    func(ctx context.Context, userID string, passwordRestoreLink string, options UserAuthOptions) string // optional
	FuncEmailSend                    func(ctx context.Context, userID string, emailSubject string, emailBody string) (err error)
	FuncUserFindByUsername           func(ctx context.Context, username string, firstName string, lastName string, options UserAuthOptions) (userID string, err error)
	FuncUserLogin                    func(ctx context.Context, username string, password string, options UserAuthOptions) (userID string, err error)
	FuncUserLogout                   func(ctx context.Context, userID string, options UserAuthOptions) (err error)
	FuncUserPasswordChange           func(ctx context.Context, username string, newPassword string, options UserAuthOptions) (err error)
	FuncUserRegister                 func(ctx context.Context, username string, password string, first_name string, last_name string, options UserAuthOptions) (err error)
	PasswordStrength                 *PasswordStrengthConfig
	LabelUsername                    string
	// Observability hooks for metrics and tracing (optional)
	ObservabilityHooks ObservabilityHooks
}

type CookieConfig struct {
	Name     string
	HttpOnly string
	Secure   string
	SameSite http.SameSite
	MaxAge   int
	Domain   string
	Path     string
}

type CookieOption func(*CookieConfig)

type ImpersonatorUserID struct{}

type IsImpersonating struct{}

type NoopObservabilityHooks struct{}

type ObservabilityHooks interface {
	// RecordLoginAttempt is called after every login attempt (success or
	// failure). method is "password" or "passwordless". err is nil on
	// success.
	RecordLoginAttempt(method string, success bool, err error)

	// RecordRegistrationAttempt is called after every registration attempt.
	// err is nil on success.
	RecordRegistrationAttempt(success bool, err error)

	// RecordRateLimitHit is called when a request is denied due to rate
	// limiting.
	RecordRateLimitHit(endpoint string, ip string)

	// RecordSessionCreated is called when a new session/token is issued
	// for a user.
	RecordSessionCreated(userID string)

	// RecordPasswordReset is called after a password reset attempt.
	// err is nil on success.
	RecordPasswordReset(success bool, err error)

	// RecordImpersonationStart is called when an admin begins impersonating
	// another user.
	RecordImpersonationStart(adminUserID string, targetUserID string)

	// RecordImpersonationStop is called when an admin stops impersonating
	// another user.
	RecordImpersonationStop(adminUserID string, targetUserID string)
}

type PasswordStrengthConfig struct {
	MinLength         int
	RequireUppercase  bool
	RequireLowercase  bool
	RequireDigit      bool
	RequireSpecial    bool
	ForbidCommonWords bool
}

type UserAuthOptions struct {
	UserIp    string
	UserAgent string
}