auth

type AutoLoginConfig struct {
	Enabled  bool   `json:"enabled" doc:"Whether auto-login is enabled"`
	Username string `json:"username" doc:"Username for auto-login (only returned if enabled)"`
}

type Login struct {
	Username string `json:"username" minLength:"1" maxLength:"255" doc:"Username of the user" example:"admin"`
	Password string `json:"password" minLength:"1" doc:"Password of the user"` //nolint:gosec // API schema requires password field name
}

type LoginResponse struct {
	Token        string    `json:"token" doc:"JWT access token"`
	RefreshToken string    `json:"refreshToken" doc:"Refresh token for obtaining new access tokens"` //nolint:gosec // API schema requires refreshToken field name
	ExpiresAt    time.Time `json:"expiresAt" doc:"Expiration time of the access token"`
	User         user.User `json:"user" doc:"Authenticated user information"`
}

type OidcAuthUrlRequest struct {
	// RedirectUri is the URI to redirect to after successful authentication.
	//
	// Required: true
	RedirectUri string `json:"redirectUri"`

	// MobileRedirectUri is the OAuth redirect URI for native mobile clients
	// (e.g., "arcane-mobile://oidc-callback"). When provided, it must match an
	// entry in the server's configured mobile redirect allowlist and is used
	// as the OAuth redirect_uri sent to the OIDC provider.
	//
	// Required: false
	MobileRedirectUri string `json:"mobileRedirectUri,omitempty"`
}

type OidcAuthUrlResponse struct {
	// AuthUrl is the URL to redirect the user to for OIDC authentication.
	//
	// Required: true
	AuthUrl string `json:"authUrl"`
}

type OidcCallbackRequest struct {
	// Code is the authorization code from the OIDC provider.
	//
	// Required: true
	Code string `json:"code"`

	// State is the state parameter from the OIDC provider for CSRF protection.
	//
	// Required: true
	State string `json:"state"`

	// MobileRedirectUri must match the value sent with the original
	// OidcAuthUrlRequest. OAuth requires the redirect_uri to be identical
	// across the auth code request and the token exchange.
	//
	// Required: false
	MobileRedirectUri string `json:"mobileRedirectUri,omitempty"`
}

type OidcCallbackResponse struct {
	// Success indicates if the authentication was successful.
	//
	// Required: true
	Success bool `json:"success"`

	// Token is the JWT access token.
	//
	// Required: true
	Token string `json:"token"`

	// RefreshToken is the refresh token for obtaining new access tokens.
	//
	// Required: true
	RefreshToken string `json:"refreshToken"` //nolint:gosec // API schema requires refreshToken field name

	// ExpiresAt is the expiration time of the access token.
	//
	// Required: true
	ExpiresAt time.Time `json:"expiresAt"`

	// User contains the authenticated user information.
	//
	// Required: true
	User user.User `json:"user"`
}

type OidcConfigResponse struct {
	// ClientID is the OAuth 2.0 client identifier.
	//
	// Required: true
	ClientID string `json:"clientId"`

	// RedirectUri is the URI to redirect to after authentication.
	//
	// Required: true
	RedirectUri string `json:"redirectUri"`

	// IssuerUrl is the OIDC provider's issuer URL.
	//
	// Required: true
	IssuerUrl string `json:"issuerUrl"`

	// AuthorizationEndpoint is the URL of the authorization endpoint.
	//
	// Required: true
	AuthorizationEndpoint string `json:"authorizationEndpoint"`

	// TokenEndpoint is the URL of the token endpoint.
	//
	// Required: true
	TokenEndpoint string `json:"tokenEndpoint"`

	// UserinfoEndpoint is the URL of the userinfo endpoint.
	//
	// Required: true
	UserinfoEndpoint string `json:"userinfoEndpoint"`

	// DeviceAuthorizationEndpoint is the URL of the device authorization endpoint.
	//
	// Required: false
	DeviceAuthorizationEndpoint string `json:"deviceAuthorizationEndpoint,omitempty"`

	// Scopes is the space-separated list of OAuth scopes requested.
	//
	// Required: true
	Scopes string `json:"scopes"`
}

type OidcDeviceAuthRequest struct {
	// RedirectUri is optional and kept for consistency with other auth flows.
	//
	// Required: false
	RedirectUri string `json:"redirectUri,omitempty"`
}

type OidcDeviceAuthResponse struct {
	// DeviceCode is the device verification code.
	//
	// Required: true
	DeviceCode string `json:"deviceCode"`

	// UserCode is the end-user verification code.
	//
	// Required: true
	UserCode string `json:"userCode"`

	// VerificationUri is the end-user verification URI.
	//
	// Required: true
	VerificationUri string `json:"verificationUri"`

	// VerificationUriComplete is the end-user verification URI with user code included.
	//
	// Required: false
	VerificationUriComplete string `json:"verificationUriComplete,omitempty"`

	// ExpiresIn is the lifetime of the device_code and user_code in seconds.
	//
	// Required: true
	ExpiresIn int `json:"expiresIn"`

	// Interval is the minimum polling interval in seconds.
	//
	// Required: false
	Interval int `json:"interval,omitempty"`
}

type OidcDeviceTokenRequest struct {
	// DeviceCode is the device verification code from the authorization response.
	//
	// Required: true
	DeviceCode string `json:"deviceCode"`
}

type OidcDeviceTokenResponse struct {
	// Success indicates if the authentication was successful.
	//
	// Required: true
	Success bool `json:"success"`

	// Token is the JWT access token.
	//
	// Required: true
	Token string `json:"token"`

	// RefreshToken is the refresh token for obtaining new access tokens.
	//
	// Required: true
	RefreshToken string `json:"refreshToken"` //nolint:gosec // API schema requires refreshToken field name

	// ExpiresAt is the expiration time of the access token.
	//
	// Required: true
	ExpiresAt time.Time `json:"expiresAt"`

	// User contains the authenticated user information.
	//
	// Required: true
	User user.User `json:"user"`
}

type OidcStatusInfo struct {
	// EnvForced indicates if OIDC is forced via environment configuration.
	//
	// Required: true
	EnvForced bool `json:"envForced"`

	// EnvConfigured indicates if OIDC is configured via environment variables.
	//
	// Required: true
	EnvConfigured bool `json:"envConfigured"`

	// MergeAccounts indicates if accounts should be merged when using OIDC.
	//
	// Required: true
	MergeAccounts bool `json:"mergeAccounts"`

	// ProviderName is the custom display name for the OIDC provider.
	//
	// Required: false
	ProviderName string `json:"providerName,omitempty"`

	// ProviderLogoUrl is the custom logo URL for the OIDC provider.
	//
	// Required: false
	ProviderLogoUrl string `json:"providerLogoUrl,omitempty"`
}

type OidcTokenResponse struct {
	// AccessToken is the OAuth 2.0 access token.
	//
	// Required: true
	AccessToken string `json:"access_token"` //nolint:gosec // OAuth/OIDC schema requires access_token field name

	// TokenType specifies the type of the access token (typically "Bearer").
	//
	// Required: true
	TokenType string `json:"token_type"`

	// RefreshToken is the OAuth 2.0 refresh token.
	//
	// Required: false
	RefreshToken string `json:"refresh_token,omitempty"` //nolint:gosec // OAuth/OIDC schema requires refresh_token field name

	// ExpiresIn is the lifetime of the access token in seconds.
	//
	// Required: false
	ExpiresIn int `json:"expires_in,omitempty"`

	// IDToken is the OpenID Connect ID token.
	//
	// Required: false
	IDToken string `json:"id_token,omitempty"`
}

type OidcUserInfo struct {
	// Subject is the unique identifier for the user at the OIDC provider.
	//
	// Required: true
	Subject string `json:"sub"`

	// Name is the full name of the user.
	//
	// Required: false
	Name string `json:"name,omitempty"`

	// Email is the email address of the user.
	//
	// Required: false
	Email string `json:"email,omitempty"`

	// EmailVerified indicates if the user's email has been verified.
	//
	// Required: false
	EmailVerified bool `json:"email_verified,omitempty"`

	// PreferredUsername is the user's preferred username.
	//
	// Required: false
	PreferredUsername string `json:"preferred_username,omitempty"`

	// GivenName is the user's given name (first name).
	//
	// Required: false
	GivenName string `json:"given_name,omitempty"`

	// FamilyName is the user's family name (last name).
	//
	// Required: false
	FamilyName string `json:"family_name,omitempty"`

	// Admin indicates if the user is an administrator.
	//
	// Required: false
	Admin bool `json:"admin,omitempty"`

	// Roles is a list of roles assigned to the user.
	//
	// Required: false
	Roles []string `json:"roles,omitempty"`

	// Groups is a list of groups the user belongs to.
	//
	// Required: false
	Groups []string `json:"groups,omitempty"`

	// Extra contains additional claims from the userinfo endpoint that are not
	// part of the standard OIDC claims. This field is not serialized to JSON.
	//
	// Required: false
	Extra map[string]any `json:"-"`
}

type PasswordChange struct {
	CurrentPassword string `json:"currentPassword,omitempty" doc:"Current password of the user (required for non-OIDC users)"`
	NewPassword     string `json:"newPassword" minLength:"8" doc:"New password for the user"`
}

type Refresh struct {
	RefreshToken string `json:"refreshToken" minLength:"1" doc:"Refresh token used to obtain a new access token"` //nolint:gosec // API schema requires refreshToken field name
}

type SessionMeta struct {
	UserAgent string
	IPAddress string
}

type TokenRefreshResponse struct {
	Token        string    `json:"token" doc:"New JWT access token"`
	RefreshToken string    `json:"refreshToken" doc:"New refresh token"` //nolint:gosec // API schema requires refreshToken field name
	ExpiresAt    time.Time `json:"expiresAt" doc:"Expiration time of the new access token"`
}