pluginsv1

type ChangePasswordRequest struct {
	UserID          string `json:"user_id"`
	CurrentPassword string `json:"current_password"`
	NewPassword     string `json:"new_password"`
}

type ChangePasswordResponse struct {
	Error *PluginError `json:"error,omitempty"`
}

type EnsureAdminRequest struct{}

type EnsureAdminResponse struct {
	Error *PluginError `json:"error,omitempty"`
}

type ErrorCode int32

type GetCapabilitiesRequest struct{}

type GetCapabilitiesResponse struct {
	Capabilities []string `json:"capabilities"`
}

type GetOIDCConfigRequest struct{}

type GetOIDCConfigResponse struct {
	Config *OIDCConfig  `json:"config,omitempty"`
	Error  *PluginError `json:"error,omitempty"`
}

type GetRoutesRequest struct{}

type GetRoutesResponse struct {
	Routes []*Route     `json:"routes"`
	Error  *PluginError `json:"error,omitempty"`
}

type GetUIManifestRequest struct{}

type GetUIManifestResponse struct {
	Manifest *UIManifest  `json:"manifest,omitempty"`
	Error    *PluginError `json:"error,omitempty"`
}

type GetUserRequest struct {
	UserID string `json:"user_id"`
}

type GetUserResponse struct {
	User  *UserInfo    `json:"user,omitempty"`
	Error *PluginError `json:"error,omitempty"`
}

type HTTPRequest struct {
	Method   string            `json:"method"`
	Path     string            `json:"path"`
	RawQuery string            `json:"raw_query,omitempty"`
	Headers  map[string]string `json:"headers,omitempty"`
	Body     []byte            `json:"body,omitempty"`
	UserID   string            `json:"user_id,omitempty"`
	Roles    []string          `json:"roles,omitempty"`
}

type HTTPResponse struct {
	StatusCode int               `json:"status_code"`
	Headers    map[string]string `json:"headers,omitempty"`
	Body       []byte            `json:"body"`
}

type HandleHTTPRequest struct {
	Request *HTTPRequest `json:"request"`
}

type HandleHTTPResponse struct {
	Response *HTTPResponse `json:"response,omitempty"`
	Error    *PluginError  `json:"error,omitempty"`
}

type HealthRequest struct{}

type HealthResponse struct {
	Status  HealthStatus `json:"status"`
	Message string       `json:"message,omitempty"`
}

type HealthStatus int32

type IdentityPluginClient interface {
	Login(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
	GetUser(ctx context.Context, in *GetUserRequest, opts ...grpc.CallOption) (*GetUserResponse, error)
	Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error)
	// ValidateToken verifies a bearer token and returns its claims.
	// The platform calls this on every authenticated request.
	ValidateToken(ctx context.Context, in *ValidateTokenRequest, opts ...grpc.CallOption) (*ValidateTokenResponse, error)
	// GetOIDCConfig returns the OIDC configuration for the frontend.
	GetOIDCConfig(ctx context.Context, in *GetOIDCConfigRequest, opts ...grpc.CallOption) (*GetOIDCConfigResponse, error)
	// RefreshToken exchanges a refresh token for a new token set.
	RefreshToken(ctx context.Context, in *RefreshTokenRequest, opts ...grpc.CallOption) (*RefreshTokenResponse, error)
	// EnsureAdmin seeds the IDP's admin user and assigns the platform "admin"
	// role. The platform calls this once after installing an IDP plugin.
	EnsureAdmin(ctx context.Context, in *EnsureAdminRequest, opts ...grpc.CallOption) (*EnsureAdminResponse, error)
	// ChangePassword verifies the current password and sets a new one.
	// The plugin is responsible for verifying CurrentPassword before applying NewPassword.
	ChangePassword(ctx context.Context, in *ChangePasswordRequest, opts ...grpc.CallOption) (*ChangePasswordResponse, error)
	// ListSessions returns all active sessions for a user.
	ListSessions(ctx context.Context, in *ListSessionsRequest, opts ...grpc.CallOption) (*ListSessionsResponse, error)
	// RevokeSession terminates a specific session by ID.
	RevokeSession(ctx context.Context, in *RevokeSessionRequest, opts ...grpc.CallOption) (*RevokeSessionResponse, error)
}

type IdentityPluginServer interface {
	Login(context.Context, *LoginRequest) (*LoginResponse, error)
	Register(context.Context, *RegisterRequest) (*RegisterResponse, error)
	GetUser(context.Context, *GetUserRequest) (*GetUserResponse, error)
	Health(context.Context, *HealthRequest) (*HealthResponse, error)
	ValidateToken(context.Context, *ValidateTokenRequest) (*ValidateTokenResponse, error)
	GetOIDCConfig(context.Context, *GetOIDCConfigRequest) (*GetOIDCConfigResponse, error)
	RefreshToken(context.Context, *RefreshTokenRequest) (*RefreshTokenResponse, error)
	EnsureAdmin(context.Context, *EnsureAdminRequest) (*EnsureAdminResponse, error)
	ChangePassword(context.Context, *ChangePasswordRequest) (*ChangePasswordResponse, error)
	ListSessions(context.Context, *ListSessionsRequest) (*ListSessionsResponse, error)
	RevokeSession(context.Context, *RevokeSessionRequest) (*RevokeSessionResponse, error)
}

type JWTClaims struct {
	Subject  string
	Username string
	Email    string
	Roles    []string
	// SessionID is the value of the "sid" claim, if present.
	// Used for session revocation: after RevokeSession is called with this ID,
	// ValidateToken will return an error for any token carrying the same sid.
	SessionID string
	// ExpiresAt is the token expiry (unix seconds), used to auto-evict
	// the revocation entry once the token can no longer be used anyway.
	ExpiresAt int64
}

type JWTValidator struct {
	// contains filtered or unexported fields
}

type ListSessionsRequest struct {
	UserID           string `json:"user_id"`
	CurrentSessionID string `json:"current_session_id,omitempty"` // hints which session to mark current
}

type ListSessionsResponse struct {
	Sessions []*Session   `json:"sessions,omitempty"`
	Error    *PluginError `json:"error,omitempty"`
}

type LoginConfig struct {
	// DisableSignupLink hides the "Create account" link on the login page.
	DisableSignupLink bool `json:"disable_signup_link,omitempty"`
}

type LoginRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

type LoginResponse struct {
	Token *TokenSet    `json:"token,omitempty"`
	Error *PluginError `json:"error,omitempty"`
}

type MiddlewareRequest struct {
	UserID  string            `json:"user_id"`
	Roles   []string          `json:"roles,omitempty"`
	Method  string            `json:"method"`
	Path    string            `json:"path"`
	Headers map[string]string `json:"headers,omitempty"`
}

type MiddlewareResponse struct {
	Allow bool         `json:"allow"`
	Error *PluginError `json:"error,omitempty"`
}

type NavItem struct {
	Label      string     `json:"label"`
	Icon       string     `json:"icon,omitempty"`       // Lucide icon name
	Path       string     `json:"path"`                 // panel route path
	Permission string     `json:"permission,omitempty"` // required role; empty = all authenticated users
	Children   []*NavItem `json:"children,omitempty"`
}

type OIDCConfig struct {
	Authority string   `json:"authority"`
	ClientID  string   `json:"client_id"`
	JwksURI   string   `json:"jwks_uri"`
	Scopes    []string `json:"scopes,omitempty"`
	// AuthMode controls whether the panel uses a headless login form or an
	// OIDC Authorization Code redirect to the IDP. Valid values: "headless"
	// (default) or "redirect".
	AuthMode string `json:"auth_mode,omitempty"`
	// Pre-fetched OIDC endpoint URLs. When set, the frontend passes them as
	// metadata to oidc-client-ts so it skips the cross-origin discovery fetch.
	TokenEndpoint         string `json:"token_endpoint,omitempty"`
	AuthorizationEndpoint string `json:"authorization_endpoint,omitempty"`
	UserinfoEndpoint      string `json:"userinfo_endpoint,omitempty"`
	EndSessionEndpoint    string `json:"end_session_endpoint,omitempty"`
	// InternalTokenEndpoint is the Docker-internal token endpoint URL.
	// The platform uses it to proxy PKCE token exchanges server-side so the
	// browser never has to POST cross-origin to the IDP.
	InternalTokenEndpoint string `json:"internal_token_endpoint,omitempty"`
}

type PluginError struct {
	Code    ErrorCode `json:"code"`
	Message string    `json:"message,omitempty"`
}

type PluginHTTPClient interface {
	GetRoutes(ctx context.Context, in *GetRoutesRequest, opts ...grpc.CallOption) (*GetRoutesResponse, error)
	Handle(ctx context.Context, in *HandleHTTPRequest, opts ...grpc.CallOption) (*HandleHTTPResponse, error)
}

type PluginHTTPServer interface {
	GetRoutes(context.Context, *GetRoutesRequest) (*GetRoutesResponse, error)
	Handle(context.Context, *HandleHTTPRequest) (*HandleHTTPResponse, error)
}

type PluginHealthClient interface {
	Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error)
	GetCapabilities(ctx context.Context, in *GetCapabilitiesRequest, opts ...grpc.CallOption) (*GetCapabilitiesResponse, error)
}

type PluginHealthServer interface {
	Health(context.Context, *HealthRequest) (*HealthResponse, error)
	// GetCapabilities declares which optional extension points this plugin implements.
	// Return an empty list (not an error) if the plugin has no extra capabilities.
	GetCapabilities(context.Context, *GetCapabilitiesRequest) (*GetCapabilitiesResponse, error)
}

type PluginMiddlewareClient interface {
	OnRequest(ctx context.Context, in *MiddlewareRequest, opts ...grpc.CallOption) (*MiddlewareResponse, error)
}

type PluginMiddlewareServer interface {
	OnRequest(context.Context, *MiddlewareRequest) (*MiddlewareResponse, error)
}

type PluginUIClient interface {
	GetUIManifest(ctx context.Context, in *GetUIManifestRequest, opts ...grpc.CallOption) (*GetUIManifestResponse, error)
}

type PluginUIServer interface {
	GetUIManifest(context.Context, *GetUIManifestRequest) (*GetUIManifestResponse, error)
}

type ProfileSection struct {
	ID          string `json:"id"`
	Title       string `json:"title"`
	Description string `json:"description,omitempty"`
	// IframeURL, if set, embeds the URL in an iframe inside the section card.
	IframeURL string `json:"iframe_url,omitempty"`
	// Actions lists the native actions this section supports (e.g. "change_password").
	// The panel renders built-in Kleff-styled forms for each declared action.
	Actions []string `json:"actions,omitempty"`
}

type RefreshTokenRequest struct {
	RefreshToken string `json:"refresh_token"`
}

type RefreshTokenResponse struct {
	Token *TokenSet    `json:"token,omitempty"`
	Error *PluginError `json:"error,omitempty"`
}

type RegisterRequest struct {
	Username  string `json:"username"`
	Email     string `json:"email"`
	Password  string `json:"password"`
	FirstName string `json:"first_name,omitempty"`
	LastName  string `json:"last_name,omitempty"`
}

type RegisterResponse struct {
	UserID string       `json:"user_id,omitempty"`
	Error  *PluginError `json:"error,omitempty"`
}

type RevokeSessionRequest struct {
	UserID    string `json:"user_id"`
	SessionID string `json:"session_id"`
}

type RevokeSessionResponse struct {
	Error *PluginError `json:"error,omitempty"`
}

type Route struct {
	Method string `json:"method"` // HTTP method ("GET", "POST", …) or "*" for any
	Path   string `json:"path"`   // exact path or prefix ending in "*" (e.g. "/api/v1/auth/*")
	Public bool   `json:"public"` // reserved for future use; all auth is handled by plugin middleware
}

type Session struct {
	ID         string `json:"id"`
	IPAddress  string `json:"ip_address,omitempty"`
	UserAgent  string `json:"user_agent,omitempty"`
	StartedAt  int64  `json:"started_at,omitempty"`  // unix seconds
	LastAccess int64  `json:"last_access,omitempty"` // unix seconds
	Current    bool   `json:"current"`
}

type SettingsPage struct {
	Label     string `json:"label"`
	Path      string `json:"path"`                 // panel route, e.g. /settings/keycloak
	IframeURL string `json:"iframe_url,omitempty"` // if set, embed as iframe
}

type SignupConfig struct {
	// Disabled replaces the signup form with a message directing the user to
	// register through the identity provider directly.
	Disabled bool `json:"disabled,omitempty"`
	// HideFirstName omits the first-name field.
	HideFirstName bool `json:"hide_first_name,omitempty"`
	// HideLastName omits the last-name field.
	HideLastName bool `json:"hide_last_name,omitempty"`
	// HideUsername omits the username field.
	HideUsername bool `json:"hide_username,omitempty"`
}

type TokenClaims struct {
	Subject  string   `json:"subject"`
	Username string   `json:"username,omitempty"`
	Email    string   `json:"email,omitempty"`
	Roles    []string `json:"roles,omitempty"`
}

type TokenSet struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int64  `json:"expires_in"`
	Scope        string `json:"scope,omitempty"`
}

type UIManifest struct {
	PluginID        string            `json:"plugin_id"`
	NavItems        []*NavItem        `json:"nav_items,omitempty"`
	SettingsPages   []*SettingsPage   `json:"settings_pages,omitempty"`
	LoginConfig     *LoginConfig      `json:"login_config,omitempty"`
	SignupConfig    *SignupConfig     `json:"signup_config,omitempty"`
	ProfileSections []*ProfileSection `json:"profile_sections,omitempty"`
}

type UnimplementedIdentityPluginServer struct{}

type UnimplementedPluginHTTPServer struct{}

type UnimplementedPluginHealthServer struct{}

type UnimplementedPluginMiddlewareServer struct{}

type UnimplementedPluginUIServer struct{}

type UserInfo struct {
	UserID    string `json:"user_id"`
	Email     string `json:"email"`
	Username  string `json:"username"`
	FirstName string `json:"first_name,omitempty"`
	LastName  string `json:"last_name,omitempty"`
}

type ValidateTokenRequest struct {
	Token string `json:"token"`
}

type ValidateTokenResponse struct {
	Claims *TokenClaims `json:"claims,omitempty"`
	Error  *PluginError `json:"error,omitempty"`
}