models

type AccessToken struct {
	ID              string `gorm:"primaryKey"`
	Token           string `gorm:"uniqueIndex;not null"`
	TokenType       string `gorm:"not null;default:'Bearer'"`
	TokenCategory   string `gorm:"not null;default:'access';index"` // 'access' or 'refresh'
	Status          string `gorm:"not null;default:'active';index"` // 'active', 'disabled', 'revoked'
	UserID          string `gorm:"not null;index"`
	ClientID        string `gorm:"not null;index"`
	Scopes          string `gorm:"not null"` // space-separated scopes
	ExpiresAt       time.Time
	CreatedAt       time.Time
	LastUsedAt      *time.Time `gorm:"index"` // Last time token was used (for refresh tokens)
	ParentTokenID   string     `gorm:"index"` // Links access tokens to their refresh token
	AuthorizationID *uint      `gorm:"index"` // FK → UserAuthorization.ID (nil for device_code grants)
}

type AuditDetails map[string]any

type AuditLog struct {
	ID string `gorm:"primaryKey;type:varchar(36)" json:"id"`

	// Event information
	EventType EventType     `gorm:"type:varchar(50);index;not null" json:"event_type"`
	EventTime time.Time     `gorm:"index;not null"                  json:"event_time"`
	Severity  EventSeverity `gorm:"type:varchar(20);not null"       json:"severity"`

	// Actor information
	ActorUserID   string `gorm:"type:varchar(36);index" json:"actor_user_id"`
	ActorUsername string `gorm:"type:varchar(100)"      json:"actor_username"`
	ActorIP       string `gorm:"type:varchar(45);index" json:"actor_ip"` // Support IPv6

	// Resource information
	ResourceType ResourceType `gorm:"type:varchar(50);index" json:"resource_type"`
	ResourceID   string       `gorm:"type:varchar(36);index" json:"resource_id"`
	ResourceName string       `gorm:"type:varchar(255)"      json:"resource_name"`

	// Operation details
	Action       string       `gorm:"type:varchar(255);not null" json:"action"`
	Details      AuditDetails `gorm:"type:json"                  json:"details"`
	Success      bool         `gorm:"index;not null"             json:"success"`
	ErrorMessage string       `gorm:"type:text"                  json:"error_message,omitempty"`

	// Request metadata
	UserAgent     string `gorm:"type:varchar(500)" json:"user_agent,omitempty"`
	RequestPath   string `gorm:"type:varchar(500)" json:"request_path,omitempty"`
	RequestMethod string `gorm:"type:varchar(10)"  json:"request_method,omitempty"`

	// Timestamps (no UpdatedAt - immutable logs)
	CreatedAt time.Time `gorm:"index;not null" json:"created_at"`
}

type AuthorizationCode struct {
	ID   uint   `gorm:"primaryKey;autoIncrement"`
	UUID string `gorm:"uniqueIndex;size:36;not null"` // Public UUID for API/UI identification

	// Code storage: SHA256 hash for security, prefix for quick lookup
	CodeHash   string `gorm:"uniqueIndex;not null"`  // SHA256(plainCode)
	CodePrefix string `gorm:"index;not null;size:8"` // First 8 chars for quick lookup

	// Relations (int PK for fast JOIN, string ClientID for OAuth protocol)
	ApplicationID int64  `gorm:"not null;index"` // FK → OAuthApplication.ID
	ClientID      string `gorm:"not null;index"` // Denormalized ClientID UUID (OAuth protocol use)
	UserID        string `gorm:"not null;index"` // FK → User.ID

	RedirectURI string `gorm:"not null"`
	Scopes      string `gorm:"not null"`

	// PKCE (RFC 7636)
	CodeChallenge       string `gorm:"default:''"`     // code_challenge (empty = PKCE not used)
	CodeChallengeMethod string `gorm:"default:'S256'"` // "S256" or "plain"

	// OIDC (OpenID Connect Core 1.0 §3.1.2.1)
	Nonce string `gorm:"default:''"` // nonce from authorization request (empty if not provided)

	ExpiresAt time.Time
	UsedAt    *time.Time // Set immediately upon exchange; prevents replay attacks
	CreatedAt time.Time
}

type DeviceCode struct {
	ID             int64  `gorm:"primaryKey;autoIncrement"`
	DeviceCode     string `gorm:"-"`                    // Not stored in DB, only for in-memory use
	DeviceCodeHash string `gorm:"uniqueIndex;not null"` // PBKDF2 hash of device code
	DeviceCodeSalt string `gorm:"not null"`             // Random salt for hashing
	DeviceCodeID   string `gorm:"index;not null"`       // Last 8 chars for quick lookup
	UserCode       string `gorm:"uniqueIndex;not null"`
	ClientID       string `gorm:"not null;index"`
	Scopes         string `gorm:"not null"` // space-separated scopes
	ExpiresAt      time.Time
	Interval       int    // polling interval in seconds
	UserID         string // filled after authorization
	Authorized     bool   `gorm:"default:false"`
	AuthorizedAt   time.Time
	CreatedAt      time.Time
	UpdatedAt      time.Time
}

type EventSeverity string

type EventType string

type OAuthApplication struct {
	ID                          int64       `gorm:"primaryKey;autoIncrement"`
	ClientID                    string      `gorm:"uniqueIndex;not null"`
	ClientSecret                string      `gorm:"not null"` // bcrypt hashed secret
	ClientName                  string      `gorm:"not null"`
	Description                 string      `gorm:"type:text"`
	UserID                      string      `gorm:"not null"`
	Scopes                      string      `gorm:"not null"`
	GrantTypes                  string      `gorm:"not null;default:'device_code'"`
	RedirectURIs                StringArray `gorm:"type:json"`
	ClientType                  string      `gorm:"not null;default:'public'"` // "confidential" or "public"
	EnableDeviceFlow            bool        `gorm:"not null;default:true"`
	EnableAuthCodeFlow          bool        `gorm:"not null;default:false"`
	EnableClientCredentialsFlow bool        `gorm:"not null;default:false"` // Client Credentials Grant (RFC 6749 §4.4); confidential clients only
	IsActive                    bool        `gorm:"not null;default:true"`
	CreatedBy                   string
	CreatedAt                   time.Time
	UpdatedAt                   time.Time
}

type OAuthConnection struct {
	ID             string `gorm:"primaryKey"`
	UserID         string `gorm:"not null;uniqueIndex:idx_oauth_user_provider,priority:1"`
	Provider       string `gorm:"not null;uniqueIndex:idx_oauth_provider_user,priority:1;uniqueIndex:idx_oauth_user_provider,priority:2"` // "github", "gitea", "gitlab"
	ProviderUserID string `gorm:"not null;uniqueIndex:idx_oauth_provider_user,priority:2"`                                                // Provider's user ID

	// OAuth metadata (snapshot for audit/reference)
	ProviderUsername string // Provider's username
	ProviderEmail    string // Provider's email (snapshot)
	AvatarURL        string // User avatar URL from provider

	// Token storage (should be encrypted in production)
	AccessToken  string    `gorm:"type:text"` // OAuth access token
	RefreshToken string    `gorm:"type:text"` // OAuth refresh token
	TokenExpiry  time.Time // Token expiration time

	// Activity tracking
	LastUsedAt time.Time

	CreatedAt time.Time
	UpdatedAt time.Time
}

type ResourceType string

type StringArray []string

type User struct {
	ID           string `gorm:"primaryKey"`
	Username     string `gorm:"uniqueIndex;not null"`
	Email        string `gorm:"uniqueIndex;not null"` // Email is unique and required
	PasswordHash string // OAuth-only users have empty password
	Role         string `gorm:"not null;default:'user'"` // "admin" or "user"
	FullName     string // User full name
	AvatarURL    string // User avatar URL (from OAuth or manual)

	// External authentication support
	ExternalID string `gorm:"index"`           // External user ID (e.g., from HTTP API)
	AuthSource string `gorm:"default:'local'"` // "local" or "http_api"

	CreatedAt time.Time
	UpdatedAt time.Time
}

type UserAuthorization struct {
	ID   uint   `gorm:"primaryKey;autoIncrement"`
	UUID string `gorm:"uniqueIndex;size:36;not null"` // Public UUID for API/UI identification

	// Relations (composite unique index ensures one grant per user+app)
	UserID        string `gorm:"not null;uniqueIndex:idx_user_app"` // FK → User.ID
	ApplicationID int64  `gorm:"not null;uniqueIndex:idx_user_app"` // FK → OAuthApplication.ID
	ClientID      string `gorm:"not null;index"`                    // Denormalized ClientID UUID (for UI display and API responses)

	Scopes    string `gorm:"not null"`
	GrantedAt time.Time
	RevokedAt *time.Time
	IsActive  bool `gorm:"not null;default:true"`

	CreatedAt time.Time
	UpdatedAt time.Time
}