operator

type Operator struct {
	PasswordHash string
	DisplayName  *string
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type PasswordVerifier struct{ Service *Service }

type Service struct {
	Store Store
	// SessionTTL is the lifetime of a session; DefaultSessionTTL if zero.
	SessionTTL time.Duration
	// Now is the clock; time.Now if nil.
	Now func() time.Time
}

type Session struct {
	IDHash    []byte
	CreatedAt time.Time
	ExpiresAt time.Time
}

type SessionMinter struct{ Service *Service }

type SessionVerifier struct{ Service *Service }

type Store interface {
	// GetOperator returns ErrNoOperator when no password has been set.
	GetOperator(ctx context.Context) (*Operator, error)
	// SetOperator creates or replaces the single operator row.
	SetOperator(ctx context.Context, op Operator) error

	// CreateSession persists a session (hash only).
	CreateSession(ctx context.Context, s Session) error
	// GetSession returns ErrSessionUnknown when no session has that hash.
	// Expiry is the domain's judgement, not the store's.
	GetSession(ctx context.Context, idHash []byte) (*Session, error)
	// DeleteSession removes a session; an unknown hash is not an error.
	DeleteSession(ctx context.Context, idHash []byte) error
	// DeleteExpiredSessions removes every session whose expiry is at or
	// before now and reports how many.
	DeleteExpiredSessions(ctx context.Context, now time.Time) (int64, error)

	// CreateOperatorToken persists a minted token (hash only).
	CreateOperatorToken(ctx context.Context, t Token) error
	// FindOperatorTokenByHash returns ErrTokenUnknown when no token has that hash.
	FindOperatorTokenByHash(ctx context.Context, hash []byte) (*Token, error)
	// ListOperatorTokens returns every token, newest first.
	ListOperatorTokens(ctx context.Context) ([]Token, error)
	// RevokeOperatorToken marks a token revoked at instant now. It returns
	// ErrTokenUnknown for an unknown id and ErrTokenRevoked if it already was.
	RevokeOperatorToken(ctx context.Context, id uuid.UUID, now time.Time) error
	// RecordOperatorTokenUse stores the instant a token last authenticated a call.
	RecordOperatorTokenUse(ctx context.Context, id uuid.UUID, now time.Time) error
}

type Token struct {
	ID         uuid.UUID
	Hash       []byte
	Prefix     string
	Name       string
	CreatedAt  time.Time
	ExpiresAt  *time.Time
	RevokedAt  *time.Time
	LastUsedAt *time.Time
}

type TokenVerifier struct{ Service *Service }