auth

type Authenticator interface {
	Authenticate(ctx context.Context, username, password string) (accountID interface{}, err error)
}

type Authorizer interface {
	// Authorize if the 'accountID' is allowed to access the resource. The resourceID is a unique resource identifier.
	Authorize(ctx context.Context, accountID interface{}, scopes ...string) error
}

type Option func(o *Options)

type Options struct {
	PasswordCost int
	// Secret is the authorization secret.
	Secret string
	// PublicKey is used for decoding the token public key.
	PublicKey string
	// PrivateKey is used for encoding the token private key.
	PrivateKey string
	// TokenExpiration is the default token expiration time.
	TokenExpiration time.Duration
	// RefreshTokenExpiration is the default refresh token expiration time,.
	RefreshTokenExpiration time.Duration
}

type Role interface {
	RoleName() string
}

type RoleAuthorizer interface {
	// CreateRole creates a 'role'. An additional optional description might be provided for given role.
	CreateRole(ctx context.Context, role, description string) (Role, error)
	// FindRoles finds all stored roles. An optional argument(s) might be provided
	// to specify the resource id(s) for which the roles should be taken.
	FindRoles(ctx context.Context, options ...RoleFindOption) (roles []Role, err error)
	// GetRoles gets stored roles for provided accountID.
	GetRoles(ctx context.Context, accountID interface{}) (roles []Role, err error)
	// DeleteRole removes the 'role'
	DeleteRole(ctx context.Context, role string) error

	// GrantRole grants given 'role' access to given 'scope'.
	GrantRole(ctx context.Context, db database.DB, role, scope string) error
	// RevokeRole revokes access to given 'scope' for the 'role'.
	RevokeRole(ctx context.Context, db database.DB, role, scope string) error

	// AddRole adds the role to the given accountID.
	AddRole(ctx context.Context, db database.DB, accountID interface{}, role string) error
	// ClearRoles clears all roles for given account.
	ClearRoles(ctx context.Context, db database.DB, accountID interface{}) error
	// RemoveRole removes the role for given account.
	RemoveRole(ctx context.Context, db database.DB, accountID interface{}, role string) error
	// SetRoles clears and sets the role for the account with id.
	SetRoles(ctx context.Context, db database.DB, accountID interface{}, roles ...string) error
}

type RoleFindOption func(o *RoleFindOptions)

type RoleFindOptions struct {
	AccountIDs []interface{}
	Scopes     []string
}

type Scope interface {
	ScopeName() string
}

type ScopeCollection interface {
	CreateScope(ctx context.Context, db database.DB, scope, description string) (Scope, error)
	GetScope(ctx context.Context, db database.DB, scope string) (Scope, error)
	DeleteScope(ctx context.Context, db database.DB, scope string) error
}

type Token struct {
	// AccessToken is the string access token.
	AccessToken string
	// RefreshToken defines the token
	RefreshToken string
}

type TokenOption func(o *TokenOptions)

type TokenOptions struct {
	// AccountIdentifier is the account identifier (email, account id etc.)
	AccountID interface{}
	// RefreshToken is the token used to refresh the new token.
	RefreshToken string
	// ExpirationTime is the expiration time of the token.
	ExpirationTime time.Duration
}

type Tokener interface {
	// InspectToken extracts claims from the token.
	InspectToken(token string) (claims interface{}, err error)
	// Token creates the token for provided options.
	Token(ctx context.Context, options ...TokenOption) (Token, error)
	// RefreshToken creates the token based on provided 'refreshToken'.
	RefreshToken(ctx context.Context, refreshToken string) (Token, error)
}

type TwoFactorAuthenticator interface {
	HasTwoFactorAuth(accountID interface{}) (bool, error)
	GenerateTwoFactorAuth(accountID interface{}) (secret string, err error)
	TwoFactorCreate(accountID interface{}) (err error)
	TwoFactorVerify(accountID interface{}, code string) error
}