auth

type AcceptInvitationWithRefreshTokenInput struct {
	RefreshToken    string `json:"refresh_token" validate:"required"`
	InvitationToken string `json:"invitation_token" validate:"required"`
}

type AcceptInvitationWithRefreshTokenResult struct {
	AccessToken  string               `json:"access_token"`
	RefreshToken string               `json:"refresh_token"` // Rotated refresh token
	ExpiresAt    time.Time            `json:"expires_at"`
	Tenant       TenantMembershipInfo `json:"tenant"`
	Role         string               `json:"role"`
}

type AuthService struct {
	// contains filtered or unexported fields
}

type AuthorizationURLInput struct {
	Provider      OAuthProvider
	RedirectURI   string // Frontend callback URL
	FinalRedirect string // Where to redirect after successful auth
}

type AuthorizationURLResult struct {
	AuthorizationURL string `json:"authorization_url"`
	State            string `json:"state"`
}

type CallbackInput struct {
	Provider    OAuthProvider
	Code        string
	State       string
	RedirectURI string
}

type CallbackResult struct {
	AccessToken  string        `json:"access_token"`
	RefreshToken string        `json:"refresh_token"`
	ExpiresIn    int64         `json:"expires_in"`
	TokenType    string        `json:"token_type"`
	User         *userdom.User `json:"user"`
}

type ChangePasswordInput struct {
	CurrentPassword string `json:"current_password" validate:"required"`
	NewPassword     string `json:"new_password" validate:"required,min=8,max=128"`
}

type CreateFirstTeamInput struct {
	RefreshToken string `json:"refresh_token" validate:"required"`
	TeamName     string `json:"team_name" validate:"required,min=2,max=100"`
	TeamSlug     string `json:"team_slug" validate:"required,min=3,max=50"`
}

type CreateFirstTeamResult struct {
	AccessToken  string               `json:"access_token"`
	RefreshToken string               `json:"refresh_token"` // Rotated refresh token
	ExpiresAt    time.Time            `json:"expires_at"`
	Tenant       TenantMembershipInfo `json:"tenant"`
}

type CreateProviderInput struct {
	TenantID         string
	Provider         string
	DisplayName      string
	ClientID         string
	ClientSecret     string // Plaintext - will be encrypted
	IssuerURL        string
	TenantIdentifier string
	Scopes           []string
	AllowedDomains   []string
	AutoProvision    bool
	DefaultRole      string
	CreatedBy        string
}

type EmailService struct {
	// contains filtered or unexported fields
}

type ExchangeTokenInput struct {
	RefreshToken string `json:"refresh_token" validate:"required"`
	TenantID     string `json:"tenant_id" validate:"required"`
}

type ExchangeTokenResult struct {
	AccessToken string
	TenantID    string
	TenantSlug  string
	Role        string
	ExpiresAt   time.Time
}

type ForgotPasswordInput struct {
	Email string `json:"email" validate:"required,email"`
}

type ForgotPasswordResult struct {
	Token string // Reset token (should be sent via email in production)
}

type IntegrationSMTPResolver struct {
	// contains filtered or unexported fields
}

type LoginInput struct {
	Email     string `json:"email" validate:"required,email"`
	Password  string `json:"password" validate:"required"`
	IPAddress string `json:"-"`
	UserAgent string `json:"-"`
}

type LoginResult struct {
	User         *userdom.User
	RefreshToken string // Global refresh token (no tenant context)
	ExpiresAt    time.Time
	SessionID    string
	Tenants      []TenantMembershipInfo // Active tenants user can access
	// SuspendedTenants lists tenants where this user has a suspended
	// membership. The user has zero access to these tenants — the field
	// exists purely so the UI can show "your access to {name} is
	// suspended" instead of bouncing the user to /onboarding/create-team
	// when they have no active memberships.
	SuspendedTenants []TenantMembershipInfo
}

type OAuthProvider string

type OAuthService struct {
	// contains filtered or unexported fields
}

type OAuthUserInfo struct {
	ID        string
	Email     string
	Name      string
	AvatarURL string
}

type ProviderInfo struct {
	ID      string `json:"id"`
	Name    string `json:"name"`
	Enabled bool   `json:"enabled"`
}

type RefreshTokenInput struct {
	RefreshToken string `json:"refresh_token" validate:"required"`
	TenantID     string `json:"tenant_id" validate:"required"`
	IPAddress    string `json:"-"`
	UserAgent    string `json:"-"`
}

type RefreshTokenResult struct {
	AccessToken      string    // Tenant-scoped access token
	RefreshToken     string    // New global refresh token (rotated)
	TenantID         string    // Tenant ID the access token is scoped to
	TenantSlug       string    // Tenant slug
	Role             string    // User's role in this tenant
	ExpiresAt        time.Time // Access token expiration
	RefreshExpiresAt time.Time // Refresh token expiration (for cookie)
}

type RegisterInput struct {
	Email    string `json:"email" validate:"required,email,max=255"`
	Password string `json:"password" validate:"required,min=8,max=128"`
	Name     string `json:"name" validate:"required,max=255"`
	// InvitationToken is optional: when a user registers via an
	// invitation link, the client passes the token here so the register
	// flow can resolve the target tenant and apply that tenant's email
	// verification rule (instead of the platform default). The token
	// itself is NOT consumed here — invitation acceptance still happens
	// in a separate POST /invitations/{token}/accept call.
	InvitationToken string `json:"invitation_token,omitempty"`
}

type RegisterResult struct {
	User                 *userdom.User
	VerificationToken    string // Only returned if email verification is required
	RequiresVerification bool
	EmailExisted         bool // Set to true if email already exists (for anti-enumeration)
}

type ResetPasswordInput struct {
	Token       string `json:"token" validate:"required"`
	NewPassword string `json:"new_password" validate:"required,min=8,max=128"`
}

type SMTPAvailabilityCheck interface {
	// HasSystemSMTP returns true if the platform has system-wide SMTP configured.
	HasSystemSMTP() bool
	// HasTenantSMTP returns true if the given tenant has a custom SMTP integration.
	// tenantID may be empty for self-registration (no tenant context yet).
	HasTenantSMTP(ctx context.Context, tenantID string) bool
}

type SSOAuthorizeInput struct {
	OrgSlug     string
	Provider    string
	RedirectURI string // Frontend callback URL
}

type SSOAuthorizeResult struct {
	AuthorizationURL string `json:"authorization_url"`
	State            string `json:"state"`
}

type SSOCallbackInput struct {
	Provider    string
	Code        string
	State       string
	RedirectURI string
}

type SSOCallbackResult struct {
	AccessToken  string        `json:"access_token"`
	RefreshToken string        `json:"refresh_token"`
	ExpiresIn    int64         `json:"expires_in"`
	TokenType    string        `json:"token_type"`
	User         *userdom.User `json:"user"`
	TenantID     string        `json:"tenant_id"`
	TenantSlug   string        `json:"tenant_slug"`
}

type SSOProviderInfo struct {
	ID          string `json:"id"`
	Provider    string `json:"provider"`
	DisplayName string `json:"display_name"`
}

type SSOService struct {
	// contains filtered or unexported fields
}

type SSOUserInfo struct {
	Email     string
	Name      string
	AvatarURL string
}

type SessionInfo struct {
	ID             string `json:"id"`
	IPAddress      string `json:"ip_address,omitempty"`
	UserAgent      string `json:"user_agent,omitempty"`
	LastActivityAt string `json:"last_activity_at"`
	CreatedAt      string `json:"created_at"`
	IsCurrent      bool   `json:"is_current"`
}

type SessionResult struct {
	AccessToken  string
	RefreshToken string
}

type SessionService struct {
	// contains filtered or unexported fields
}

type SettingsStorageResolver struct {
	// contains filtered or unexported fields
}

type TenantMemberCreator interface {
	CreateMembership(ctx context.Context, m *tenantdom.Membership) error
}

type TenantMembershipInfo struct {
	TenantID   string `json:"tenant_id"`
	TenantSlug string `json:"tenant_slug"`
	TenantName string `json:"tenant_name"`
	Role       string `json:"role"`
}

type TenantMembershipProvider interface {
	GetUserTenantIDs(ctx context.Context, userID shared.ID) ([]string, error)
}

type TenantSMTPResolver interface {
	GetTenantSMTPConfig(ctx context.Context, tenantID string) (*emaildom.Config, error)
}

type UpdateProviderInput struct {
	ID               string
	TenantID         string // For authorization check
	DisplayName      *string
	ClientID         *string
	ClientSecret     *string // Plaintext - will be encrypted if provided
	IssuerURL        *string
	TenantIdentifier *string
	Scopes           []string
	AllowedDomains   []string
	AutoProvision    *bool
	DefaultRole      *string
	IsActive         *bool
}

type WSTicketClaims struct {
	UserID   string `json:"user_id"`
	TenantID string `json:"tenant_id"`
	IssuedAt int64  `json:"iat"`
}

type WSTicketService struct {
	// contains filtered or unexported fields
}

type WSTicketStore interface {
	// Set stores value at key with TTL. Must overwrite existing keys
	// (the random ticket space is large enough that collisions are
	// negligible, and overwrite is safer than failing silently).
	Set(ctx context.Context, key, value string, ttl time.Duration) error
	// GetDel atomically reads and deletes a key, returning the stored value.
	// Returns ("", false, nil) when the key does not exist.
	GetDel(ctx context.Context, key string) (string, bool, error)
}