localauth

type AccountExistsEmailSender interface {
	SendAccountExistsEmail(to string, link string) error
}

type ConsoleEmailSender struct{}

type CreateUserFunc func(creds *Credentials) (accounts.User, error)

type CreateVerificationTokenRequest struct {
	Subject        string
	Email          string
	Type           VerificationType
	ExpiryDuration time.Duration
}

type CreateVerificationTokenResponse struct {
	Token *VerificationToken
}

type Credentials struct {
	Username string  // Required for signup, can be username/email/phone for login
	Email    *string // Optional for signup
	Phone    *string // Optional for signup
	Password string  // Required
}

type CredentialsValidator = accounts.CredentialsValidator

type DeleteSubjectVerificationTokensRequest struct {
	Subject string
	Type    VerificationType
}

type DeleteSubjectVerificationTokensResponse struct{}

type DeleteVerificationTokenRequest struct {
	Token string
}

type DeleteVerificationTokenResponse struct {
	// Deleted is true when this call removed the token, and false when it
	// was already gone. Only one of two concurrent deletes sees true, which
	// is what makes a token single-use: consume it by deleting it, and act
	// only when Deleted.
	Deleted bool
}

type GetLoggedInUserFunc func(r *http.Request) (userID string, err error)

type GetVerificationTokenRequest struct {
	Token string
}

type GetVerificationTokenResponse struct {
	Token *VerificationToken
}

type LinkCredentialsConfig struct {
	UserStore     accounts.UserStore
	IdentityStore accounts.IdentityStore
	ChannelStore  accounts.ChannelStore
	UsernameStore accounts.UsernameStore // Optional
}

type LinkLocalCredentialsConfig struct {
	UserStore     accounts.UserStore
	IdentityStore accounts.IdentityStore
	ChannelStore  accounts.ChannelStore
	UsernameStore accounts.UsernameStore
}

type LocalAuth struct {
	// Validates credentials during login
	ValidateCredentials CredentialsValidator

	// Validates credentials during signup (deprecated: use SignupPolicy instead)
	ValidateSignup SignupValidator

	// Creates a new user (for signup)
	CreateUser CreateUserFunc

	// Optional email sender for verification emails
	EmailSender SendEmail

	// Optional token store for email verification and password reset
	TokenStore VerificationTokenStore

	// Base URL for generating verification/reset links
	BaseURL string

	// Whether email verification is required before login
	RequireEmailVerification bool

	// Provider name (defaults to "local")
	Provider string

	// Form field names
	UsernameField string
	PasswordField string
	EmailField    string
	PhoneField    string

	// Handler called after successful authentication
	HandleUser accounts.HandleUserFunc

	// Callback to verify email by token
	VerifyEmail VerifyEmailFunc

	// Callback to update password
	UpdatePassword UpdatePasswordFunc

	// AfterPasswordReset runs after a reset succeeds, with the account's
	// email. Use it to end the account's other sessions (revoke its
	// refresh tokens): whoever had the old password may still hold one
	// (CWE-613). An error is logged; the password is already changed.
	AfterPasswordReset func(ctx context.Context, email string) error

	// SignupPolicy defines what is required for signup (overrides ValidateSignup if set)
	SignupPolicy *SignupPolicy

	// OnSignupError is called when signup fails. If nil, returns JSON error.
	OnSignupError accounts.AuthErrorHandler

	// OnLoginError is called when login fails. If nil, returns JSON error.
	OnLoginError accounts.AuthErrorHandler

	// SignupURL is used for redirects on error (if OnSignupError uses redirects)
	SignupURL string

	// LoginURL is used for redirects on error (if OnLoginError uses redirects)
	LoginURL string

	// Optional UsernameStore for enforcing username uniqueness
	UsernameStore accounts.UsernameStore

	// ForgotPasswordURL: if set, GET /forgot-password redirects here and
	// POST /forgot-password redirects here with ?sent=true on success.
	// If empty, GET renders a basic HTML form and POST returns JSON.
	ForgotPasswordURL string

	// ResetPasswordURL: if set, GET /reset-password redirects here (with ?token=...)
	// and POST redirects here with ?success=true on success or ?error=... on failure.
	// If empty, GET renders a basic HTML form and POST returns JSON.
	ResetPasswordURL string

	// RateLimiter limits login attempts per key (IP:username). Optional.
	// When set, rate-limited requests receive 429 Too Many Requests.
	RateLimiter core.RateLimiter

	// Lockout locks accounts after consecutive failed login attempts. Optional.
	// When set, locked accounts receive 429 Too Many Requests until the lockout expires.
	Lockout *core.AccountLockout

	// TrustedProxies are the reverse proxies whose X-Forwarded-For is
	// believed when keying rate limits. Empty keys on the TCP peer, which
	// is right when nothing sits in front of this process; behind a proxy
	// every client would otherwise share the proxy's bucket.
	TrustedProxies core.TrustedProxies
}

type SendEmail interface {
	SendVerificationEmail(to string, verificationLink string) error
	SendPasswordResetEmail(to string, resetLink string) error
}

type SignupPolicy struct {
	RequireUsername       bool   // Is username required? (default: false)
	RequireEmail          bool   // Is email required? (default: true)
	RequirePhone          bool   // Is phone required? (default: false)
	RequirePassword       bool   // Is password required for local? (default: true)
	EnforceUsernameUnique bool   // Check UsernameStore? (default: true if username required)
	EnforceEmailUnique    bool   // Check IdentityStore? (default: true)
	MinPasswordLength     int    // Minimum password (default: 8)
	UsernamePattern       string // Regex for username (default: ^[a-zA-Z0-9_-]{3,20}$)
}

type SignupValidator func(creds *Credentials) error

type UpdatePasswordFunc func(email, newPassword string) error

type VerificationToken struct {
	Token     string           `json:"token"`
	Type      VerificationType `json:"type"`
	Subject   string           `json:"subject"`
	Email     string           `json:"email"`
	CreatedAt time.Time        `json:"created_at"`
	ExpiresAt time.Time        `json:"expires_at"`
}

type VerificationTokenStore interface {
	CreateToken(ctx context.Context, req *CreateVerificationTokenRequest) (*CreateVerificationTokenResponse, error)
	GetToken(ctx context.Context, req *GetVerificationTokenRequest) (*GetVerificationTokenResponse, error)
	DeleteToken(ctx context.Context, req *DeleteVerificationTokenRequest) (*DeleteVerificationTokenResponse, error)
	DeleteSubjectTokens(ctx context.Context, req *DeleteSubjectVerificationTokensRequest) (*DeleteSubjectVerificationTokensResponse, error)
}

type VerificationType string

type VerifyEmailFunc func(token string) error