standalone

type Account struct {
	ID    uuid.UUID `json:"id"`
	Email string    `json:"email"`
	Name  string    `json:"name"`
}

type Auth struct {
	// contains filtered or unexported fields
}

type Config struct {
	// PublicURL is where people reach Timeclock: the links in its emails
	// start with it, and an OpenID Connect provider redirects back to it.
	PublicURL string
	// Mailer sends invitations and password resets. Without one they go to
	// the log, for whoever runs the server to pass on.
	Mailer host.Mailer
	// AdminEmails run payroll in every workspace they belong to, and are
	// invited to the default workspace when the server first starts.
	AdminEmails []string
	// AuditorEmails read History, every change to payroll data, in every
	// workspace they belong to. Being an admin doesn't make someone one.
	AuditorEmails []string
	// SecretKey seals what the server must read back but shouldn't sit in
	// the database in the clear: authenticator secrets and providers' client
	// secrets. At least 32 characters; keep it out of the database's backups.
	SecretKey string
	// TrustProxy says the server is behind a reverse proxy that sets
	// X-Forwarded-For, so sign-in is slowed per client rather than for
	// everyone behind the proxy at once. Leave it off when clients connect
	// directly: they could claim any address.
	TrustProxy bool
	// BreachURL is the range API the breach check asks; empty is the public one.
	BreachURL string
	// BreachCheck refuses passwords found in a public list of breached
	// ones. The lookup sends five characters of a hash, never the password.
	BreachCheck bool

	// Issuer, ClientID and ClientSecret are an OpenID Connect provider
	// people can sign in with besides a password, such as
	// https://accounts.google.com. Empty offers passwords only.
	Issuer       string
	ClientID     string
	ClientSecret string
	// AllowedDomain, if set, is the only email domain the provider may sign in.
	AllowedDomain string

	// DevUser, if set, is an email every request is signed in as, with no
	// sign-in at all. For development only.
	DevUser string
	Logger  *slog.Logger
}

type Invited struct {
	ID    uuid.UUID
	Email string
	// Link is where the person accepts it.
	Link string
}

type Membership struct {
	ID    uuid.UUID `json:"id"`
	Key   string    `json:"key"`
	Name  string    `json:"name"`
	Admin bool      `json:"admin"`
	// SSORequired means it is entered only through its own provider.
	SSORequired bool `json:"ssoRequired"`
}

type Passkey struct {
	ID         uuid.UUID  `json:"id"`
	Name       string     `json:"name"`
	CreatedAt  time.Time  `json:"createdAt"`
	LastUsedAt *time.Time `json:"lastUsedAt,omitempty"`
}

type SMTP struct {
	// Host and Port are the server, such as "smtp.example.com" and "587".
	Host, Port string
	// Username and Password sign in, when the server asks for it.
	Username, Password string
	// From is the address mail comes from, such as "Timeclock <time@example.com>".
	From string
	// Security is "starttls" (the default), "tls" for a TLS connection from
	// the start (port 465), or "none" for a server on a trusted network.
	Security string
}