security

type AesPasswordDecryptor struct {
	// contains filtered or unexported fields
}

type AllDataScope struct{}

type AuthManager interface {
	// Authenticate attempts to authenticate the provided authentication information.
	// It delegates to the appropriate authenticator based on the authentication type.
	// Returns a Principal if authentication succeeds, or an error if it fails.
	Authenticate(ctx context.Context, authentication Authentication) (*Principal, error)
}

type AuthTokens struct {
	AccessToken  string `json:"accessToken"`  // AccessToken is the short-lived access token for Api requests
	RefreshToken string `json:"refreshToken"` // RefreshToken is the long-lived token used to refresh access tokens
}

type Authentication struct {
	Type        string `json:"type"`        // Type specifies the authentication method (e.g., "password", "jwt", "oauth")
	Principal   string `json:"principal"`   // Principal is the identifier of the entity being authenticated (e.g., username, email)
	Credentials any    `json:"credentials"` // Credentials contains the authentication data (e.g., password, token)
}

type Authenticator interface {
	// Supports checks if this authenticator can handle the given authentication type.
	Supports(authType string) bool
	// Authenticate validates the provided authentication information and returns a Principal.
	// Returns an error if authentication fails or the authenticator doesn't support the type.
	Authenticate(ctx context.Context, authentication Authentication) (*Principal, error)
}

type CachedRolePermissionsLoader struct {
	// contains filtered or unexported fields
}

type DataPermissionApplier interface {
	// Apply applies data permission filter conditions to the query.
	Apply(query orm.SelectQuery) error
}

type DataPermissionResolver interface {
	// ResolveDataScope loads the DataScope instance applicable to the principal.
	ResolveDataScope(ctx context.Context, principal *Principal, permToken string) (DataScope, error)
}

type DataScope interface {
	// Key returns the unique identifier of this data scope.
	Key() string
	// Priority returns the priority level of this data scope.
	// Higher values indicate broader access permissions.
	// When a user has multiple roles with the same permission token but different data scopes,
	// the framework will select the scope with the highest priority.
	Priority() int
	// Supports determines whether this data scope is applicable to the given table structure.
	// It checks if the table has the necessary fields required by this scope.
	Supports(principal *Principal, table *orm.Table) bool
	// Apply applies the data permission filter conditions using the provided SelectQuery.
	// This method should use the SelectQuery to add filtering conditions.
	Apply(principal *Principal, query orm.SelectQuery) error
}

type ExternalAppConfig struct {
	Enabled     bool   `json:"enabled"`     // Enabled indicates whether the external app is enabled
	IpWhitelist string `json:"ipWhitelist"` // IpWhitelist is a comma-separated whitelist (supports IP or CIDR)
}

type ExternalAppLoader interface {
	// LoadById loads an external application by appId and returns the associated Principal and app secret.
	// If the app does not exist, return (nil, "", nil) and the authenticator will treat it as invalid credentials.
	// If an internal error occurs, return a non-nil error.
	LoadById(ctx context.Context, id string) (*Principal, string, error)
}

type Gender string

type Jwt struct {
	// contains filtered or unexported fields
}

type JwtClaimsAccessor struct {
	// contains filtered or unexported fields
}

type JwtClaimsBuilder struct {
	// contains filtered or unexported fields
}

type JwtConfig struct {
	Secret   string `config:"secret"`   // Secret key for Jwt signing
	Audience string `config:"audience"` // Jwt audience
}

type PasswordDecryptor interface {
	// Decrypt decrypts the encrypted password string and returns the plaintext password.
	// The encryptedPassword parameter is typically a base64-encoded or hex-encoded string.
	// Returns an error if decryption fails (e.g., invalid format, wrong key, corrupted data).
	Decrypt(encryptedPassword string) (string, error)
}

type PermissionChecker interface {
	// HasPermission checks if the given principal has the specified permission.
	HasPermission(ctx context.Context, principal *Principal, permToken string) (bool, error)
}

type Principal struct {
	Type    PrincipalType `json:"type"`    // Type is the type of the principal.
	Id      string        `json:"id"`      // Id is the id of the user.
	Name    string        `json:"name"`    // Name is the name of the user.
	Roles   []string      `json:"roles"`   // Roles is the roles of the user.
	Details any           `json:"details"` // Details is the details of the user.
}

type PrincipalType string

type RequestScopedDataPermApplier struct {
	// contains filtered or unexported fields
}

type RolePermissionsChangedEvent struct {
	event.BaseEvent

	Roles []string `json:"roles"` // Affected role names (empty means all roles)
}

type RolePermissionsLoader interface {
	// LoadPermissions loads all permissions associated with the given role.
	// Returns a map of permission token to DataScope, allowing O(1) permission checks.
	LoadPermissions(ctx context.Context, role string) (map[string]DataScope, error)
}

type RsaPasswordDecryptor struct {
	// contains filtered or unexported fields
}

type SelfDataScope struct {
	// contains filtered or unexported fields
}

type Sm2PasswordDecryptor struct {
	// contains filtered or unexported fields
}

type Sm4PasswordDecryptor struct {
	// contains filtered or unexported fields
}

type TokenGenerator interface {
	// Generate creates authentication tokens for the given principal.
	// Returns both access and refresh tokens, or an error if generation fails.
	Generate(principal *Principal) (*AuthTokens, error)
}

type UserInfo struct {
	// Id of the user
	Id string `json:"id"`
	// Name of the user
	Name string `json:"name"`
	// Gender of the user
	Gender Gender `json:"gender"`
	// Avatar URL of the user (optional)
	Avatar null.String `json:"avatar"`
	// Authorized permission tokens
	PermTokens []string `json:"permTokens"`
	// Authorized menus
	Menus []UserMenu `json:"menus"`
}

type UserInfoLoader interface {
	// LoadUserInfo loads detailed information for the authenticated user.
	// The params parameter contains additional request parameters from the API request.
	// Returns UserInfo or an error if loading fails.
	LoadUserInfo(ctx context.Context, principal *Principal, params map[string]any) (*UserInfo, error)
}

type UserLoader interface {
	// LoadByUsername loads a user by username and returns the associated Principal and password hash.
	// If the username does not exist, return (nil, "", nil) and the authenticator will treat it as invalid credentials.
	// If an internal error occurs, return a non-nil error.
	LoadByUsername(ctx context.Context, username string) (*Principal, string, error)
	// LoadById loads a user by id and returns the associated Principal.
	// If the user does not exist, return nil.
	// If an internal error occurs, return a non-nil error.
	LoadById(ctx context.Context, id string) (*Principal, error)
}

type UserMenu struct {
	// Type of the menu
	Type UserMenuType `json:"type"`
	// Path of the menu
	Path string `json:"path"`
	// Name of the menu
	Name string `json:"name"`
	// Icon of the menu (optional)
	Icon null.String `json:"icon"`
	// Meta of the menu (optional)
	Meta map[string]any `json:"metadata"`
	// Children of the menu (optional)
	Children []UserMenu `json:"children"`
}

type UserMenuType string