auth

type AuthService interface {
	// Authenticate validates credentials and returns the user if successful.
	// Returns ErrInvalidCredentials, ErrAccountLocked, or ErrUserNotFound on failure.
	Authenticate(ctx context.Context, username, password string) (*session.User, error)
	// CheckLockout returns true if the account is locked.
	CheckLockout(ctx context.Context, username string) (bool, error)
	// RecordFailedAttempt records a failed login attempt.
	RecordFailedAttempt(ctx context.Context, username string) error
	// ClearAttempts clears failed login attempts.
	ClearAttempts(ctx context.Context, username string) error
	// UpdateCredentials validates and updates admin credentials.
	UpdateCredentials(ctx context.Context, opts CredentialUpdateOptions, store CredentialStore) (*CredentialUpdateResult, error)
}

type CredentialStore interface {
	UserStore
	// UpdateUsername updates the admin username.
	UpdateUsername(ctx context.Context, username string) error
	// UpdatePassword updates the admin password hash.
	UpdatePassword(ctx context.Context, passwordHash string) error
}

type CredentialUpdateOptions struct {
	CurrentUsername string
	NewUsername     string
	CurrentPassword string
	NewPassword     string
	ConfirmPassword string
}

type CredentialUpdateResult struct {
	// ChangingUsername is true if the username is being changed.
	ChangingUsername bool
	// ChangingPassword is true if the password is being changed.
	ChangingPassword bool
	// ValidationErrors contains validation errors keyed by field name.
	ValidationErrors map[string]string
}

type Service struct {
	// contains filtered or unexported fields
}

type UserStore interface {
	// CheckAccountLockout returns true if the account is locked.
	CheckAccountLockout(ctx context.Context, username string) (locked bool, err error)
	// GetUser retrieves a user by username.
	GetUser(ctx context.Context, username string) (*session.User, error)
	// RecordFailedLoginAttempt records a failed login attempt.
	RecordFailedLoginAttempt(ctx context.Context, username string) error
	// ClearLoginAttempts clears failed login attempts for a user.
	ClearLoginAttempts(ctx context.Context, username string) error
}