domain

type ActivityType string

type AddTeamUserRequest struct {
	OrganizationUserID uint `json:"organization_user_id" validate:"required"`
	IsManager          bool `json:"is_manager"`
}

type AuthResponse struct {
	AccessToken           string       `json:"access_token"`
	RefreshToken          string       `json:"refresh_token"`
	Type                  string       `json:"type"`                               // "Bearer"
	AccessTokenExpiresAt  int64        `json:"access_token_expires_at,omitempty"`  // unix seconds
	RefreshTokenExpiresAt int64        `json:"refresh_token_expires_at,omitempty"` // unix seconds
	ProtectedUserKey      string       `json:"protected_user_key"`
	KdfConfig             *KdfConfig   `json:"kdf_config"`
	User                  *UserAuthDTO `json:"user"`
}

type BillingCycle string

type BillingInfo struct {
	Organization *OrganizationDTO `json:"organization"`
	Subscription *SubscriptionDTO `json:"subscription,omitempty"`

	// Current usage
	CurrentUsers       int `json:"current_users"`
	CurrentCollections int `json:"current_collections"`
	CurrentItems       int `json:"current_items"`

	// Invoices
	Invoices []*InvoiceDTO `json:"invoices,omitempty"`
}

type CancelSubscriptionRequest struct {
	Immediate bool `json:"immediate"` // Cancel immediately or at period end
}

type ChangeMasterPasswordRequest struct {
	// NOTE: This endpoint is authenticated (JWT). The server will use the
	// authenticated user (context) and ignore any client-provided email.
	Email string `json:"email,omitempty"`

	OldMasterPasswordHash string `json:"old_master_password_hash" validate:"required"`

	NewMasterPasswordHash string `json:"new_master_password_hash" validate:"required"`
	NewProtectedUserKey   string `json:"new_protected_user_key" validate:"required"`

	// Optional: rotate KDF settings and salt
	NewKdfConfig *KdfConfig `json:"new_kdf_config,omitempty"`
	NewKdfSalt   string     `json:"new_kdf_salt,omitempty"`
}

type Collection struct {
	ID        uint       `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID  `gorm:"type:uuid;not null" json:"uuid"`
	CreatedAt time.Time  `json:"created_at"`
	UpdatedAt time.Time  `json:"updated_at"`
	DeletedAt *time.Time `json:"deleted_at,omitempty" gorm:"index"`

	OrganizationID uint `json:"organization_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`

	// Collection details
	Name        string `json:"name" gorm:"type:varchar(255);not null"`
	Description string `json:"description,omitempty" gorm:"type:text"`

	// System defaults
	IsDefault bool `json:"is_default" gorm:"not null;default:false"`

	// Access control
	IsPrivate bool `json:"is_private" gorm:"default:false"` // Only assigned users can access

	// External ID for LDAP/AD sync
	ExternalID *string `json:"external_id,omitempty" gorm:"type:varchar(255);index"`

	// Stats (runtime calculated, not stored in DB)
	ItemCount *int `json:"item_count,omitempty" gorm:"-"`
	UserCount *int `json:"user_count,omitempty" gorm:"-"`
	TeamCount *int `json:"team_count,omitempty" gorm:"-"`

	// Associations
	Organization *Organization      `json:"organization,omitempty" gorm:"foreignKey:OrganizationID"`
	UserAccess   []CollectionUser   `json:"user_access,omitempty" gorm:"foreignKey:CollectionID"`
	TeamAccess   []CollectionTeam   `json:"team_access,omitempty" gorm:"foreignKey:CollectionID"`
	Items        []OrganizationItem `json:"items,omitempty" gorm:"foreignKey:CollectionID"`
}

type CollectionDTO struct {
	ID             uint      `json:"id"`
	UUID           uuid.UUID `json:"uuid"`
	OrganizationID uint      `json:"organization_id"`
	Name           string    `json:"name"`
	Description    string    `json:"description,omitempty"`
	IsPrivate      bool      `json:"is_private"`
	ExternalID     *string   `json:"external_id,omitempty"`
	IsDefault      bool      `json:"is_default"`
	CreatedAt      time.Time `json:"created_at"`
	UpdatedAt      time.Time `json:"updated_at"`

	// Stats (optional)
	ItemCount *int `json:"item_count,omitempty"`
	UserCount *int `json:"user_count,omitempty"`
	TeamCount *int `json:"team_count,omitempty"`
}

type CollectionTeam struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	CollectionID uint `json:"collection_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`
	TeamID       uint `json:"team_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`

	// Permissions
	CanRead       bool `json:"can_read" gorm:"default:true"`
	CanWrite      bool `json:"can_write" gorm:"default:false"`
	CanAdmin      bool `json:"can_admin" gorm:"default:false"`
	HidePasswords bool `json:"hide_passwords" gorm:"default:false"`

	// Associations
	Collection *Collection `json:"collection,omitempty" gorm:"foreignKey:CollectionID"`
	Team       *Team       `json:"team,omitempty" gorm:"foreignKey:TeamID"`
}

type CollectionTeamDTO struct {
	ID            uint      `json:"id"`
	CollectionID  uint      `json:"collection_id"`
	TeamID        uint      `json:"team_id"`
	TeamName      string    `json:"team_name"`
	CanRead       bool      `json:"can_read"`
	CanWrite      bool      `json:"can_write"`
	CanAdmin      bool      `json:"can_admin"`
	HidePasswords bool      `json:"hide_passwords"`
	CreatedAt     time.Time `json:"created_at"`
}

type CollectionUser struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	CollectionID       uint `json:"collection_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`
	OrganizationUserID uint `json:"organization_user_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`

	// Permissions
	CanRead       bool `json:"can_read" gorm:"default:true"`
	CanWrite      bool `json:"can_write" gorm:"default:false"`
	CanAdmin      bool `json:"can_admin" gorm:"default:false"`
	HidePasswords bool `json:"hide_passwords" gorm:"default:false"` // Can view metadata but not passwords

	// Associations
	Collection       *Collection       `json:"collection,omitempty" gorm:"foreignKey:CollectionID"`
	OrganizationUser *OrganizationUser `json:"organization_user,omitempty" gorm:"foreignKey:OrganizationUserID"`
}

type CollectionUserDTO struct {
	ID                 uint      `json:"id"`
	CollectionID       uint      `json:"collection_id"`
	OrganizationUserID uint      `json:"organization_user_id"`
	UserID             uint      `json:"user_id"`
	UserEmail          string    `json:"user_email"`
	UserName           string    `json:"user_name"`
	CanRead            bool      `json:"can_read"`
	CanWrite           bool      `json:"can_write"`
	CanAdmin           bool      `json:"can_admin"`
	HidePasswords      bool      `json:"hide_passwords"`
	CreatedAt          time.Time `json:"created_at"`
}

type CreateActivityRequest struct {
	UserID       uint
	ActivityType ActivityType
	IPAddress    string
	UserAgent    string
	Details      string
}

type CreateCollectionRequest struct {
	Name        string  `json:"name" validate:"required,max=255"`
	Description string  `json:"description,omitempty" validate:"max=1000"`
	IsPrivate   bool    `json:"is_private"`
	ExternalID  *string `json:"external_id,omitempty"`
}

type CreateExcludedDomainRequest struct {
	Domain string `json:"domain" validate:"required"`
}

type CreateInvitationRequest struct {
	Email       string  `json:"email" validate:"required,email"`
	RoleID      uint    `json:"role_id" validate:"required"`
	Description *string `json:"description,omitempty"` // Optional personal note

	// Organization invitation fields (optional)
	OrganizationID  *uint   `json:"organization_id,omitempty"`
	OrgRole         *string `json:"org_role,omitempty"`
	EncryptedOrgKey *string `json:"encrypted_org_key,omitempty"`
	AccessAll       *bool   `json:"access_all,omitempty"`
}

type CreateItemShareRequest struct {
	ItemUUID         string     `json:"item_uuid" validate:"required"`
	SharedWithUserID *uint      `json:"shared_with_user_id,omitempty"`
	SharedWithTeamID *uint      `json:"shared_with_team_id,omitempty"`
	CanView          bool       `json:"can_view"`
	CanEdit          bool       `json:"can_edit"`
	CanShare         bool       `json:"can_share"`
	EncryptedKey     string     `json:"encrypted_key" validate:"required"` // Item key wrapped for recipient
	ExpiresAt        *time.Time `json:"expires_at,omitempty"`
}

type CreateOrganizationFolderRequest struct {
	Name string `json:"name" validate:"required,max=255"`
}

type CreateOrganizationItemRequest struct {
	CollectionID *uint        `json:"collection_id,omitempty"`
	ItemType     ItemType     `json:"item_type" validate:"required"`
	Data         string       `json:"data" validate:"required"` // Encrypted with Org Key
	Metadata     ItemMetadata `json:"metadata" validate:"required"`
	IsFavorite   bool         `json:"is_favorite"`
	FolderID     *uint        `json:"folder_id,omitempty"`
	Reprompt     bool         `json:"reprompt"`
	AutoFill     *bool        `json:"auto_fill,omitempty"`
	AutoLogin    *bool        `json:"auto_login,omitempty"`
}

type CreateOrganizationRequest struct {
	Name            string `json:"name" validate:"required,max=255"`
	BillingEmail    string `json:"billing_email" validate:"required,email"`
	Plan            string `json:"plan" validate:"omitempty,oneof=free business enterprise"`
	EncryptedOrgKey string `json:"encrypted_org_key" validate:"required"` // Owner's copy of org key
}

type CreateSCIMTokenRequest struct {
	Label     string     `json:"label" binding:"required,max=255"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
}

type CreateSSOConnectionRequest struct {
	Protocol        SSOProtocol      `json:"protocol" binding:"required,oneof=saml oidc"`
	Name            string           `json:"name" binding:"required,max=255"`
	Domain          string           `json:"domain" binding:"required,max=255"`
	SAMLConfig      *SAMLConfig      `json:"saml_config,omitempty"`
	OIDCConfig      *OIDCConfig      `json:"oidc_config,omitempty"`
	AutoProvision   *bool            `json:"auto_provision,omitempty"`
	DefaultRole     OrganizationRole `json:"default_role,omitempty"`
	JITProvisioning *bool            `json:"jit_provisioning,omitempty"`
}

type CreateSubscriptionRequest struct {
	PlanCode string `json:"plan_code" validate:"required"`
}

type CreateTeamRequest struct {
	Name                 string  `json:"name" validate:"required,max=255"`
	Description          string  `json:"description,omitempty" validate:"max=1000"`
	AccessAllCollections bool    `json:"access_all_collections"`
	ExternalID           *string `json:"external_id,omitempty"`
}

type CreateUserByAdminRequest struct {
	Name               string     `json:"name" validate:"required,max=100"`
	Email              string     `json:"email" validate:"required,email"`
	MasterPasswordHash string     `json:"master_password_hash" validate:"required"` // HKDF(masterKey, info="auth")
	ProtectedUserKey   string     `json:"protected_user_key" validate:"required"`   // EncString: "2.iv|ct|mac"
	EncryptedOrgKey    string     `json:"encrypted_org_key" validate:"required"`    // Organization key encrypted with User Key
	KdfConfig          *KdfConfig `json:"kdf_config" validate:"required"`
	KdfSalt            string     `json:"kdf_salt" validate:"required"` // hex-encoded random salt
	RoleID             *uint      `json:"role_id,omitempty"`
}

type Credentials struct {
	Email              string `json:"email" validate:"required,email"`
	MasterPasswordHash string `json:"master_password_hash" validate:"required"`
	// Optional device identifier to keep a stable session per app/device.
	// Example: Vault can persist this in localStorage to avoid orphan sessions after tab close.
	DeviceID string `json:"device_id,omitempty"`
	// Optional app identifier (used with device_id). Expected: vault|extension|mobile|desktop
	App string `json:"app,omitempty"`
	// Optional login override:
	// when true and free-plan device limit is hit, revoke all active sessions and continue login.
	LogoutOtherDevices bool `json:"logout_other_devices,omitempty"`
}

type DeleteWithOrganizationsRequest struct {
	OrganizationIDs []uint `json:"organization_ids" binding:"required"`
}

type ErrValidation struct {
	Field   string
	Message string
}

type ExcludedDomain struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;type:varchar(100);" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	UserID uint   `json:"user_id" gorm:"not null;index"`
	Domain string `json:"domain" gorm:"type:varchar(255);not null"`
}

type ExcludedDomainDTO struct {
	ID        uint      `json:"id"`
	UUID      uuid.UUID `json:"uuid"`
	Domain    string    `json:"domain"`
	CreatedAt time.Time `json:"created_at"`
}

type FieldType int

type GrantCollectionAccessRequest struct {
	CanRead       bool `json:"can_read"`
	CanWrite      bool `json:"can_write"`
	CanAdmin      bool `json:"can_admin"`
	HidePasswords bool `json:"hide_passwords"`
}

type Invitation struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	// NOTE: Email is NOT unique because a user can have multiple invitations
	// (e.g. multiple organization invites). Code remains unique.
	Email     string     `json:"email" gorm:"type:varchar(255);index;not null"`
	Code      string     `json:"code" gorm:"type:varchar(64);uniqueIndex;not null"`
	RoleID    uint       `json:"role_id" gorm:"not null"`
	CreatedBy uint       `json:"created_by" gorm:"not null"` // Admin user ID
	ExpiresAt time.Time  `json:"expires_at" gorm:"not null"`
	UsedAt    *time.Time `json:"used_at,omitempty"`

	// Organization invitation fields (optional)
	OrganizationID  *uint   `json:"organization_id,omitempty" gorm:"index"`
	OrgRole         *string `json:"org_role,omitempty" gorm:"type:varchar(50)"`
	EncryptedOrgKey *string `json:"encrypted_org_key,omitempty" gorm:"type:text"`
	AccessAll       bool    `json:"access_all" gorm:"default:false"`
}

type InviteUserToOrgRequest struct {
	Email           string           `json:"email" binding:"required,email"`
	Role            OrganizationRole `json:"role" binding:"required,oneof=owner admin manager member"`
	EncryptedOrgKey string           `json:"encrypted_org_key" binding:"required"` // Org key wrapped for invitee
	AccessAll       bool             `json:"access_all"`
	Collections     []uint           `json:"collections,omitempty"` // Collection IDs to grant access
}

type InvoiceDTO struct {
	ID               uint          `json:"id,omitempty"`              // Not used (no DB)
	UUID             string        `json:"uuid,omitempty"`            // Not used (no DB)
	SubscriptionID   uint          `json:"subscription_id,omitempty"` // Not used (no DB)
	Status           InvoiceStatus `json:"status"`
	AmountCents      int           `json:"amount_cents"`
	AmountDisplay    string        `json:"amount_display"`
	Currency         string        `json:"currency"`
	IssuedAt         time.Time     `json:"issued_at"`
	PaidAt           *time.Time    `json:"paid_at,omitempty"`
	DueDate          *time.Time    `json:"due_date,omitempty"`
	StripeInvoiceID  *string       `json:"stripe_invoice_id,omitempty"`
	InvoicePDFURL    *string       `json:"invoice_pdf_url,omitempty"`
	HostedInvoiceURL *string       `json:"hosted_invoice_url,omitempty"`
	CreatedAt        time.Time     `json:"created_at,omitempty"` // Not used (no DB)
}

type InvoiceStatus string

type Item struct {
	ID        uint       `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID  `gorm:"type:uuid;uniqueIndex" json:"uuid"`
	SupportID int64      `gorm:"uniqueIndex;not null" json:"support_id"` // Human-readable ID for support
	CreatedAt time.Time  `json:"created_at"`
	UpdatedAt time.Time  `json:"updated_at"`
	DeletedAt *time.Time `json:"deleted_at,omitempty" gorm:"index"`

	// Sync
	Revision    int64 `json:"revision" gorm:"not null;default:0"`
	SyncVersion int   `json:"sync_version" gorm:"not null;default:1"`

	ItemType ItemType `json:"item_type" gorm:"not null"`
	Data     string   `json:"data" gorm:"type:text;not null"` // Encrypted JSON
	// Optional: encrypted item key (for per-item key envelope encryption)
	ItemKeyEnc *string      `json:"item_key_enc,omitempty" gorm:"type:text"`
	Metadata   ItemMetadata `json:"metadata" gorm:"type:jsonb;not null"`

	// User preferences
	IsFavorite bool  `json:"is_favorite" gorm:"default:false"`
	FolderID   *uint `json:"folder_id,omitempty"`
	Reprompt   bool  `json:"reprompt" gorm:"default:false"`

	// Browser extension features (Password items only)
	AutoFill  bool `json:"auto_fill" gorm:"default:true"`   // Enable auto-fill
	AutoLogin bool `json:"auto_login" gorm:"default:false"` // Enable auto-submit

	ArchivedAt *time.Time `json:"archived_at,omitempty"`
}

type ItemMetadata struct {
	Name     string   `json:"name"`                // Required: display name
	URIHint  string   `json:"uri_hint,omitempty"`  // For passwords: domain for autofill
	Brand    string   `json:"brand,omitempty"`     // For cards: Visa, Mastercard, etc.
	Category string   `json:"category,omitempty"`  // Custom category
	Tags     []string `json:"tags,omitempty"`      // User tags for organization
	IconHint string   `json:"icon_hint,omitempty"` // For UI (favicon URL hint)
}

type ItemShare struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;not null" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	// Item reference (organization item)
	ItemUUID       uuid.UUID `json:"item_uuid" gorm:"type:uuid;not null;index"`
	OrganizationID uint      `json:"organization_id" gorm:"not null;index"`

	OwnerID uint `json:"owner_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`

	// Share target (either user or team)
	SharedWithUserID *uint `json:"shared_with_user_id,omitempty" gorm:"index;constraint:OnDelete:CASCADE"`
	SharedWithTeamID *uint `json:"shared_with_team_id,omitempty" gorm:"index;constraint:OnDelete:CASCADE"`

	// Permissions
	CanView  bool `json:"can_view" gorm:"default:true"`
	CanEdit  bool `json:"can_edit" gorm:"default:false"`
	CanShare bool `json:"can_share" gorm:"default:false"` // Can re-share to others

	// Encrypted item key wrapped for recipient
	EncryptedKey string `json:"-" gorm:"type:text;not null"`

	// Expiration
	ExpiresAt *time.Time `json:"expires_at,omitempty"`

	// Associations
	Owner          *User `json:"owner,omitempty" gorm:"foreignKey:OwnerID"`
	SharedWithUser *User `json:"shared_with_user,omitempty" gorm:"foreignKey:SharedWithUserID"`
	SharedWithTeam *Team `json:"shared_with_team,omitempty" gorm:"foreignKey:SharedWithTeamID"`
}

type ItemShareDTO struct {
	ID               uint       `json:"id"`
	UUID             uuid.UUID  `json:"uuid"`
	ItemUUID         uuid.UUID  `json:"item_uuid"`
	OwnerID          uint       `json:"owner_id"`
	OwnerEmail       string     `json:"owner_email,omitempty"`
	SharedWithUserID *uint      `json:"shared_with_user_id,omitempty"`
	SharedWithTeamID *uint      `json:"shared_with_team_id,omitempty"`
	SharedWithEmail  string     `json:"shared_with_email,omitempty"`
	SharedWithName   string     `json:"shared_with_name,omitempty"`
	CanView          bool       `json:"can_view"`
	CanEdit          bool       `json:"can_edit"`
	CanShare         bool       `json:"can_share"`
	ExpiresAt        *time.Time `json:"expires_at,omitempty"`
	CreatedAt        time.Time  `json:"created_at"`
}

type ItemType int16

type KdfConfig struct {
	Type        KdfType `json:"kdf_type"`
	Iterations  int     `json:"kdf_iterations"`
	Memory      *int    `json:"kdf_memory,omitempty"`      // For Argon2id (MB)
	Parallelism *int    `json:"kdf_parallelism,omitempty"` // For Argon2id (threads)
	Salt        string  `json:"kdf_salt,omitempty"`        // hex-encoded random salt
}

type KdfType int

type MoveItemToCollectionRequest struct {
	CollectionID *uint `json:"collection_id"` // NULL to move to org-wide
}

type OIDCConfig struct {
	Issuer       string   `json:"issuer"`
	ClientID     string   `json:"client_id"`
	ClientSecret string   `json:"client_secret"`
	AuthURL      string   `json:"auth_url,omitempty"`
	TokenURL     string   `json:"token_url,omitempty"`
	UserInfoURL  string   `json:"user_info_url,omitempty"`
	JwksURI      string   `json:"jwks_uri,omitempty"`
	Scopes       []string `json:"scopes,omitempty"`
	UseDiscovery bool     `json:"use_discovery"`
	PKCEEnabled  bool     `json:"pkce_enabled"`
	EmailClaim   string   `json:"email_claim,omitempty"`
	NameClaim    string   `json:"name_claim,omitempty"`
	GroupsClaim  string   `json:"groups_claim,omitempty"`
}

type OIDCConfigDTO struct {
	Issuer       string   `json:"issuer"`
	ClientID     string   `json:"client_id"`
	AuthURL      string   `json:"auth_url,omitempty"`
	TokenURL     string   `json:"token_url,omitempty"`
	Scopes       []string `json:"scopes,omitempty"`
	UseDiscovery bool     `json:"use_discovery"`
	PKCEEnabled  bool     `json:"pkce_enabled"`
}

type Organization struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;not null" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	// Organization info
	Name         string `json:"name" gorm:"type:varchar(255);not null"`
	BillingEmail string `json:"billing_email" gorm:"type:varchar(255);not null"`

	// System defaults
	// IsDefault is a legacy concept kept for backward compatibility.
	// Do not use it for default-org resolution; use users.default_organization_id instead.
	IsDefault bool `json:"is_default" gorm:"not null;default:false"`

	// Personal Vault model (new)
	IsPersonal          bool  `json:"is_personal" gorm:"not null;default:false"`
	PersonalOwnerUserID *uint `json:"personal_owner_user_id,omitempty" gorm:"index"`

	// Creator snapshot (denormalized).
	// Users can be hard-deleted, so we keep immutable creator identity fields here.
	CreatedByUserID    *uint   `json:"created_by_user_id,omitempty" gorm:"index"`
	CreatedByUserEmail *string `json:"created_by_user_email,omitempty" gorm:"type:varchar(255)"`
	CreatedByUserName  *string `json:"created_by_user_name,omitempty" gorm:"type:varchar(255)"`

	// Encryption
	// Organization symmetric key (AES-256) encrypted with owner's User Key
	EncryptedOrgKey string `json:"-" gorm:"type:text;not null"`

	// RSA key pair for organization (optional, for advanced key management)
	OrgPublicKey       *string `json:"-" gorm:"type:text"` // RSA-2048 public key (PEM)
	OrgPrivateKeyEnc   *string `json:"-" gorm:"type:text"` // RSA private key encrypted with recovery key
	KeyRotationCounter int     `json:"key_rotation_counter" gorm:"default:0"`

	// Status
	Status              OrganizationStatus `json:"status" gorm:"type:varchar(20);not null;default:'active'"`
	IsActive            bool               `json:"is_active" gorm:"default:true"`
	SuspendedAt         *time.Time         `json:"suspended_at,omitempty"`
	DeletedAt           *time.Time         `json:"deleted_at,omitempty" gorm:"index"`
	ScheduledDeletionAt *time.Time         `json:"scheduled_deletion_at,omitempty"`

	// Billing & Stripe Integration
	StripeCustomerID *string `json:"stripe_customer_id,omitempty" gorm:"type:varchar(255);index"`

	// Stats (runtime calculated, not stored in DB)
	MemberCount     *int `json:"member_count,omitempty" gorm:"-"`
	TeamCount       *int `json:"team_count,omitempty" gorm:"-"`
	CollectionCount *int `json:"collection_count,omitempty" gorm:"-"`
	ItemCount       *int `json:"item_count,omitempty" gorm:"-"`

	// Associations (not loaded by default)
	Members     []OrganizationUser `json:"members,omitempty" gorm:"foreignKey:OrganizationID"`
	Teams       []Team             `json:"teams,omitempty" gorm:"foreignKey:OrganizationID"`
	Collections []Collection       `json:"collections,omitempty" gorm:"foreignKey:OrganizationID"`
}

type OrganizationDTO struct {
	ID                 uint               `json:"id"`
	UUID               uuid.UUID          `json:"uuid"`
	Name               string             `json:"name"`
	BillingEmail       string             `json:"billing_email"`
	IsDefault          bool               `json:"is_default"`
	CreatedByUserID    *uint              `json:"created_by_user_id,omitempty"`
	CreatedByUserEmail *string            `json:"created_by_user_email,omitempty"`
	CreatedByUserName  *string            `json:"created_by_user_name,omitempty"`
	Plan               OrganizationPlan   `json:"plan"`
	MaxUsers           int                `json:"max_users"`
	MaxCollections     int                `json:"max_collections"`
	Status             OrganizationStatus `json:"status"`
	IsActive           bool               `json:"is_active"`
	CreatedAt          time.Time          `json:"created_at"`
	UpdatedAt          time.Time          `json:"updated_at"`

	// Subscription (optional)
	Subscription *SubscriptionDTO `json:"subscription,omitempty"`

	// Stats (optional)
	MemberCount     *int `json:"member_count,omitempty"`
	TeamCount       *int `json:"team_count,omitempty"`
	CollectionCount *int `json:"collection_count,omitempty"`
	ItemCount       *int `json:"item_count,omitempty"`

	// Encrypted org key (safe to send - user's own copy, encrypted with their User Key)
	EncryptedOrgKey string `json:"encrypted_org_key,omitempty"`
}

type OrganizationFolder struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;type:varchar(100);" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	OrganizationID  uint   `json:"organization_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`
	CreatedByUserID uint   `json:"created_by_user_id" gorm:"not null;index"`
	Name            string `json:"name" gorm:"type:varchar(255);not null"`
}

type OrganizationFolderDTO struct {
	ID        uint      `json:"id"`
	UUID      uuid.UUID `json:"uuid"`
	Name      string    `json:"name"`
	CreatedAt time.Time `json:"created_at"`
}

type OrganizationItem struct {
	ID        uint       `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID  `gorm:"type:uuid;not null" json:"uuid"`
	SupportID int64      `gorm:"not null" json:"support_id"` // Human-readable ID for support
	CreatedAt time.Time  `json:"created_at"`
	UpdatedAt time.Time  `json:"updated_at"`
	DeletedAt *time.Time `json:"deleted_at,omitempty" gorm:"index"`

	// Organization and collection
	OrganizationID uint  `json:"organization_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`
	CollectionID   *uint `json:"collection_id,omitempty" gorm:"index;constraint:OnDelete:SET NULL"` // NULL means org-wide item

	// Sync
	Revision    int64 `json:"revision" gorm:"not null;default:0"`
	SyncVersion int   `json:"sync_version" gorm:"not null;default:1"`

	// Item type and data
	ItemType ItemType     `json:"item_type" gorm:"not null"`
	Data     string       `json:"data" gorm:"type:text;not null"` // Encrypted with Org Key
	Metadata ItemMetadata `json:"metadata" gorm:"type:jsonb;not null"`

	// User preferences
	IsFavorite bool  `json:"is_favorite" gorm:"default:false"`
	FolderID   *uint `json:"folder_id,omitempty"` // Organization folder (future feature)
	Reprompt   bool  `json:"reprompt" gorm:"default:false"`

	// Browser extension features (Password items only)
	AutoFill  bool `json:"auto_fill" gorm:"default:true"`
	AutoLogin bool `json:"auto_login" gorm:"default:false"`

	ArchivedAt *time.Time `json:"archived_at,omitempty"`

	// Creator info
	CreatedByUserID uint `json:"created_by_user_id" gorm:"not null;index"`

	// Associations
	Organization *Organization `json:"organization,omitempty" gorm:"foreignKey:OrganizationID"`
	Collection   *Collection   `json:"collection,omitempty" gorm:"foreignKey:CollectionID"`
	CreatedBy    *User         `json:"created_by,omitempty" gorm:"foreignKey:CreatedByUserID"`
}

type OrganizationItemDTO struct {
	ID                 uint         `json:"id"`
	UUID               uuid.UUID    `json:"uuid"`
	SupportID          int64        `json:"support_id"`
	SupportIDFormatted string       `json:"support_id_formatted"`
	OrganizationID     uint         `json:"organization_id"`
	CollectionID       *uint        `json:"collection_id,omitempty"`
	ItemType           ItemType     `json:"item_type"`
	Data               string       `json:"data"` // Still encrypted
	Metadata           ItemMetadata `json:"metadata"`
	IsFavorite         bool         `json:"is_favorite"`
	FolderID           *uint        `json:"folder_id,omitempty"`
	Reprompt           bool         `json:"reprompt"`
	AutoFill           bool         `json:"auto_fill"`
	AutoLogin          bool         `json:"auto_login"`
	Revision           int64        `json:"revision"`
	SyncVersion        int          `json:"sync_version"`
	CreatedByUserID    uint         `json:"created_by_user_id"`
	CreatedByUserEmail string       `json:"created_by_user_email,omitempty"`
	CreatedAt          time.Time    `json:"created_at"`
	UpdatedAt          time.Time    `json:"updated_at"`
	ArchivedAt         *time.Time   `json:"archived_at,omitempty"`
}

type OrganizationPlan string

type OrganizationRole string

type OrganizationStatus string

type OrganizationUser struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;not null" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	OrganizationID uint `json:"organization_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`
	UserID         uint `json:"user_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`

	// Role in organization
	Role OrganizationRole `json:"role" gorm:"type:varchar(20);not null;default:'member'"`

	// Organization key wrapped for this user
	// Encrypted with user's RSA public key (or User Key if RSA not available)
	EncryptedOrgKey string `json:"-" gorm:"type:text;not null"`

	// Permissions
	AccessAll   bool   `json:"access_all" gorm:"default:false"` // Access all collections
	Permissions string `json:"permissions,omitempty" gorm:"type:text"`

	// Status
	Status     OrganizationUserStatus `json:"status" gorm:"type:varchar(20);default:'invited'"`
	InvitedAt  *time.Time             `json:"invited_at,omitempty"`
	AcceptedAt *time.Time             `json:"accepted_at,omitempty"`

	// External ID for LDAP/AD sync
	ExternalID *string `json:"external_id,omitempty" gorm:"type:varchar(255);index"`

	// Associations
	Organization *Organization `json:"organization,omitempty" gorm:"foreignKey:OrganizationID"`
	User         *User         `json:"user,omitempty" gorm:"foreignKey:UserID"`
}

type OrganizationUserDTO struct {
	ID             uint                   `json:"id"`
	UUID           uuid.UUID              `json:"uuid"`
	OrganizationID uint                   `json:"organization_id"`
	UserID         uint                   `json:"user_id"`
	UserEmail      string                 `json:"user_email"`
	UserName       string                 `json:"user_name"`
	Role           OrganizationRole       `json:"role"`
	AccessAll      bool                   `json:"access_all"`
	Status         OrganizationUserStatus `json:"status"`
	InvitedAt      *time.Time             `json:"invited_at,omitempty"`
	AcceptedAt     *time.Time             `json:"accepted_at,omitempty"`
	CreatedAt      time.Time              `json:"created_at"`
}

type OrganizationUserStatus string

type OwnershipCheckResult struct {
	IsSoleOwner   bool                    `json:"is_sole_owner"`
	Organizations []SoleOwnerOrganization `json:"organizations"`
}

type PaymentProvider string

type Permission struct {
	ID          uint      `gorm:"primary_key" json:"id"`
	Name        string    `json:"name" gorm:"type:varchar(100);uniqueIndex;not null"`
	DisplayName string    `json:"display_name" gorm:"type:varchar(100);not null"`
	Description string    `json:"description" gorm:"type:text"`
	Resource    string    `json:"resource" gorm:"type:varchar(50);not null"` // e.g., "users", "logins"
	Action      string    `json:"action" gorm:"type:varchar(50);not null"`   // e.g., "read", "create", "update", "delete"
	CreatedAt   time.Time `json:"created_at"`
	UpdatedAt   time.Time `json:"updated_at"`
}

type Plan struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;not null" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	Code         string       `json:"code" gorm:"type:varchar(50);uniqueIndex;not null"`
	Name         string       `json:"name" gorm:"type:varchar(100);not null"`
	BillingCycle BillingCycle `json:"billing_cycle" gorm:"type:varchar(20);not null"`
	PriceCents   int          `json:"price_cents" gorm:"not null"`
	Currency     string       `json:"currency" gorm:"type:varchar(3);not null;default:'USD'"`
	TrialDays    int          `json:"trial_days" gorm:"not null;default:0"`

	// Limits (null = unlimited)
	MaxUsers       *int `json:"max_users,omitempty"`
	MaxCollections *int `json:"max_collections,omitempty"`
	MaxItems       *int `json:"max_items,omitempty"`

	// Feature flags
	Features PlanFeatures `json:"features" gorm:"type:jsonb;not null"`

	// Status
	IsActive bool `json:"is_active" gorm:"default:true"`

	// Stripe integration
	StripeProductID *string `json:"stripe_product_id,omitempty" gorm:"type:varchar(255)"`
	StripePriceID   *string `json:"stripe_price_id,omitempty" gorm:"type:varchar(255)"`
}

type PlanChangePreview struct {
	CurrentPlan       string `json:"current_plan"`
	NewPlan           string `json:"new_plan"`
	ProratedAmount    int64  `json:"prorated_amount"` // cents
	Currency          string `json:"currency"`
	NextBillingDate   string `json:"next_billing_date"`
	NextBillingAmount int64  `json:"next_billing_amount"`
	ImmediateCharge   bool   `json:"immediate_charge"` // true if user will be charged now
}

type PlanChangeResult struct {
	Success bool   `json:"success"`
	Message string `json:"message"`
}

type PlanDTO struct {
	ID             uint         `json:"id"`
	UUID           uuid.UUID    `json:"uuid"`
	Code           string       `json:"code"`
	Name           string       `json:"name"`
	BillingCycle   BillingCycle `json:"billing_cycle"`
	PriceCents     int          `json:"price_cents"`
	PriceDisplay   string       `json:"price_display"`
	Currency       string       `json:"currency"`
	TrialDays      int          `json:"trial_days"`
	MaxUsers       *int         `json:"max_users,omitempty"`
	MaxCollections *int         `json:"max_collections,omitempty"`
	MaxItems       *int         `json:"max_items,omitempty"`
	Features       PlanFeatures `json:"features"`
	IsActive       bool         `json:"is_active"`
	CreatedAt      time.Time    `json:"created_at"`
	UpdatedAt      time.Time    `json:"updated_at"`
}

type PlanFeatures struct {
	Items           *int `json:"items"`            // Max items (null = unlimited)
	Sharing         bool `json:"sharing"`          // Item sharing enabled
	Teams           bool `json:"teams"`            // Team management enabled
	Audit           bool `json:"audit"`            // Audit logs enabled
	SSO             bool `json:"sso"`              // Single Sign-On enabled
	APIAccess       bool `json:"api_access"`       // API access enabled
	PrioritySupport bool `json:"priority_support"` // Priority support enabled
}

type PreLoginRequest struct {
	Email string `json:"email" validate:"required,email"`
}

type PreLoginResponse struct {
	KdfType        KdfType `json:"kdf_type"`
	KdfIterations  int     `json:"kdf_iterations"`
	KdfMemory      *int    `json:"kdf_memory,omitempty"`
	KdfParallelism *int    `json:"kdf_parallelism,omitempty"`
	KdfSalt        string  `json:"kdf_salt"` // hex-encoded salt for master key derivation
}

type Preference struct {
	ID uint `json:"id" gorm:"primaryKey"`

	OwnerType string `` /* 153-byte string literal not displayed */
	OwnerID   uint   `` /* 134-byte string literal not displayed */

	Section string `` /* 150-byte string literal not displayed */
	Key     string `json:"key" gorm:"type:varchar(64);not null;uniqueIndex:uq_preferences_owner_section_key,priority:4"`

	// Value is stored as text; interpretation depends on Type.
	// Type can be: string | number | boolean | json
	Value string `json:"value" gorm:"type:text;not null;default:''"`
	Type  string `json:"type" gorm:"type:varchar(16);not null;default:'string'"`

	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type PreferenceDTO struct {
	Section string `json:"section"`
	Key     string `json:"key"`
	Type    string `json:"type"`
	Value   string `json:"value"`
}

type ResendVerificationRequest struct {
	Email string `json:"email" binding:"required,email"`
}

type Role struct {
	ID          uint         `gorm:"primary_key" json:"id"`
	Name        string       `json:"name" gorm:"type:varchar(50);uniqueIndex;not null"`
	DisplayName string       `json:"display_name" gorm:"type:varchar(100);not null"`
	Description string       `json:"description" gorm:"type:text"`
	CreatedAt   time.Time    `json:"created_at"`
	UpdatedAt   time.Time    `json:"updated_at"`
	Permissions []Permission `gorm:"many2many:role_permissions;" json:"permissions,omitempty"`
}

type SAMLConfig struct {
	EntityID            string `json:"entity_id"`
	SSOURL              string `json:"sso_url"`
	SLOURL              string `json:"slo_url,omitempty"`
	Certificate         string `json:"certificate"`
	SignAuthnRequests   bool   `json:"sign_authn_requests"`
	WantAssertionSigned bool   `json:"want_assertion_signed"`
	NameIDFormat        string `json:"name_id_format,omitempty"`
}

type SAMLConfigDTO struct {
	EntityID            string `json:"entity_id"`
	SSOURL              string `json:"sso_url"`
	SLOURL              string `json:"slo_url,omitempty"`
	HasCertificate      bool   `json:"has_certificate"`
	SignAuthnRequests   bool   `json:"sign_authn_requests"`
	WantAssertionSigned bool   `json:"want_assertion_signed"`
	NameIDFormat        string `json:"name_id_format,omitempty"`
}

type SCIMEmail struct {
	Value   string `json:"value"`
	Type    string `json:"type,omitempty"`
	Primary bool   `json:"primary,omitempty"`
}

type SCIMError struct {
	Schemas  []string `json:"schemas"`
	Detail   string   `json:"detail"`
	Status   string   `json:"status"`
	ScimType string   `json:"scimType,omitempty"`
}

type SCIMGroup struct {
	Schemas     []string        `json:"schemas"`
	ID          string          `json:"id"`
	ExternalID  string          `json:"externalId,omitempty"`
	DisplayName string          `json:"displayName"`
	Members     []SCIMMemberRef `json:"members,omitempty"`
	Meta        *SCIMMeta       `json:"meta,omitempty"`
}

type SCIMGroupRef struct {
	Value   string `json:"value"`
	Display string `json:"display,omitempty"`
	Ref     string `json:"$ref,omitempty"`
}

type SCIMListResponse struct {
	Schemas      []string    `json:"schemas"`
	TotalResults int         `json:"totalResults"`
	StartIndex   int         `json:"startIndex"`
	ItemsPerPage int         `json:"itemsPerPage"`
	Resources    interface{} `json:"Resources"`
}

type SCIMMemberRef struct {
	Value   string `json:"value"`
	Display string `json:"display,omitempty"`
	Ref     string `json:"$ref,omitempty"`
}

type SCIMMeta struct {
	ResourceType string `json:"resourceType"`
	Created      string `json:"created,omitempty"`
	LastModified string `json:"lastModified,omitempty"`
	Location     string `json:"location,omitempty"`
}

type SCIMName struct {
	Formatted  string `json:"formatted,omitempty"`
	FamilyName string `json:"familyName,omitempty"`
	GivenName  string `json:"givenName,omitempty"`
}

type SCIMPatchOp struct {
	Schemas    []string          `json:"schemas"`
	Operations []SCIMPatchOpItem `json:"Operations"`
}

type SCIMPatchOpItem struct {
	Op    string      `json:"op"`
	Path  string      `json:"path,omitempty"`
	Value interface{} `json:"value,omitempty"`
}

type SCIMToken struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;not null;uniqueIndex" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	OrganizationID uint   `json:"organization_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`
	Label          string `json:"label" gorm:"type:varchar(255);not null"`

	// Token value (hashed for storage, plain text returned only on creation)
	TokenHash string     `json:"-" gorm:"type:varchar(512);not null;uniqueIndex"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`

	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
	IsActive   bool       `json:"is_active" gorm:"not null;default:true"`

	// Associations
	Organization *Organization `json:"organization,omitempty" gorm:"foreignKey:OrganizationID"`
}

type SCIMTokenCreatedDTO struct {
	SCIMTokenDTO
	Token string `json:"token"`
}

type SCIMTokenDTO struct {
	ID             uint       `json:"id"`
	UUID           uuid.UUID  `json:"uuid"`
	OrganizationID uint       `json:"organization_id"`
	Label          string     `json:"label"`
	ExpiresAt      *time.Time `json:"expires_at,omitempty"`
	LastUsedAt     *time.Time `json:"last_used_at,omitempty"`
	IsActive       bool       `json:"is_active"`
	CreatedAt      time.Time  `json:"created_at"`
}

type SCIMUser struct {
	Schemas    []string       `json:"schemas"`
	ID         string         `json:"id"`
	ExternalID string         `json:"externalId,omitempty"`
	UserName   string         `json:"userName"`
	Name       *SCIMName      `json:"name,omitempty"`
	Emails     []SCIMEmail    `json:"emails,omitempty"`
	Active     bool           `json:"active"`
	Groups     []SCIMGroupRef `json:"groups,omitempty"`
	Meta       *SCIMMeta      `json:"meta,omitempty"`
}

type SSOCallbackResult struct {
	User         *User         `json:"user"`
	Organization *Organization `json:"organization"`
	IsNewUser    bool          `json:"is_new_user"`
	AccessToken  string        `json:"access_token"`
	RefreshToken string        `json:"refresh_token"`
}

type SSOConnection struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;not null;uniqueIndex" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	OrganizationID uint        `json:"organization_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`
	Protocol       SSOProtocol `json:"protocol" gorm:"type:varchar(10);not null"`

	// Display
	Name   string `json:"name" gorm:"type:varchar(255);not null"`
	Domain string `json:"domain" gorm:"type:varchar(255);not null;uniqueIndex"`

	// Protocol-specific configuration (stored as JSONB)
	SAMLConfig *SAMLConfig `json:"saml_config,omitempty" gorm:"type:jsonb"`
	OIDCConfig *OIDCConfig `json:"oidc_config,omitempty" gorm:"type:jsonb"`

	// SP (Passwall) metadata — generated at creation, read-only for admin
	SPEntityID string `json:"sp_entity_id" gorm:"type:varchar(512)"`
	SPAcsURL   string `json:"sp_acs_url" gorm:"type:varchar(512)"`
	SPMetadata string `json:"-" gorm:"type:text"`

	// Behaviour
	AutoProvision   bool                `json:"auto_provision" gorm:"default:true"`
	DefaultRole     OrganizationRole    `json:"default_role" gorm:"type:varchar(20);default:'member'"`
	JITProvisioning bool                `json:"jit_provisioning" gorm:"default:true"`
	Status          SSOConnectionStatus `json:"status" gorm:"type:varchar(20);not null;default:'draft'"`

	// Associations
	Organization *Organization `json:"organization,omitempty" gorm:"foreignKey:OrganizationID"`
}

type SSOConnectionDTO struct {
	ID              uint                `json:"id"`
	UUID            uuid.UUID           `json:"uuid"`
	OrganizationID  uint                `json:"organization_id"`
	Protocol        SSOProtocol         `json:"protocol"`
	Name            string              `json:"name"`
	Domain          string              `json:"domain"`
	SPEntityID      string              `json:"sp_entity_id"`
	SPAcsURL        string              `json:"sp_acs_url"`
	AutoProvision   bool                `json:"auto_provision"`
	DefaultRole     OrganizationRole    `json:"default_role"`
	JITProvisioning bool                `json:"jit_provisioning"`
	Status          SSOConnectionStatus `json:"status"`
	CreatedAt       time.Time           `json:"created_at"`
	UpdatedAt       time.Time           `json:"updated_at"`

	// Protocol-specific (admin-visible only)
	SAMLConfig *SAMLConfigDTO `json:"saml_config,omitempty"`
	OIDCConfig *OIDCConfigDTO `json:"oidc_config,omitempty"`
}

type SSOConnectionStatus string

type SSOInitiateRequest struct {
	Domain      string `json:"domain" binding:"required"`
	RedirectURL string `json:"redirect_url,omitempty"`
}

type SSOProtocol string

type SSOState struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	CreatedAt time.Time `json:"created_at"`

	State          string    `json:"state" gorm:"type:varchar(512);not null;uniqueIndex"`
	ConnectionID   uint      `json:"connection_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`
	OrganizationID uint      `json:"organization_id" gorm:"not null;index"`
	RedirectURL    string    `json:"redirect_url" gorm:"type:varchar(2048)"`
	CodeVerifier   string    `json:"-" gorm:"type:varchar(512)"`
	Nonce          string    `json:"-" gorm:"type:varchar(512)"`
	ExpiresAt      time.Time `json:"expires_at" gorm:"not null;index"`
}

type SeatChangePreview struct {
	CurrentSeats      int    `json:"current_seats"`
	RequestedSeats    int    `json:"requested_seats"`
	ProratedAmount    int64  `json:"prorated_amount"`     // cents – positive means charge, negative means credit
	Currency          string `json:"currency"`            // e.g. "usd"
	NextBillingDate   string `json:"next_billing_date"`   // ISO-8601
	NextBillingAmount int64  `json:"next_billing_amount"` // cents – full amount at next renewal
}

type SharePersonalItemRequest struct {
	PersonalItemUUID string `json:"personal_item_uuid" validate:"required"`
	CollectionID     *uint  `json:"collection_id,omitempty"`
	Data             string `json:"data" validate:"required"` // Re-encrypted with Org Key
}

type SignUpRequest struct {
	Name               string     `json:"name" validate:"max=100"`
	Email              string     `json:"email" validate:"required,email"`
	MasterPasswordHash string     `json:"master_password_hash" validate:"required"` // HKDF(masterKey, info="auth")
	ProtectedUserKey   string     `json:"protected_user_key" validate:"required"`   // EncString: "2.iv|ct|mac"
	KdfConfig          *KdfConfig `json:"kdf_config" validate:"required"`
	KdfSalt            string     `json:"kdf_salt" validate:"required"`          // hex-encoded random salt from client
	EncryptedOrgKey    string     `json:"encrypted_org_key" validate:"required"` // Organization key encrypted with User Key
}

type SoleOwnerOrganization struct {
	ID          uint   `json:"id"`
	Name        string `json:"name"`
	MemberCount int    `json:"member_count"`
	CanTransfer bool   `json:"can_transfer"` // True if there are other members to transfer to
}

type Subscription struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;not null" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	OrganizationID uint              `json:"organization_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`
	PlanID         uint              `json:"plan_id" gorm:"not null;index"`
	State          SubscriptionState `json:"state" gorm:"type:varchar(20);not null;default:'draft'"`

	// Lifecycle timestamps
	StartedAt         *time.Time `json:"started_at,omitempty"`
	RenewAt           *time.Time `json:"renew_at,omitempty"`
	CancelAt          *time.Time `json:"cancel_at,omitempty"`
	EndedAt           *time.Time `json:"ended_at,omitempty"`
	GracePeriodEndsAt *time.Time `json:"grace_period_ends_at,omitempty"`
	TrialEndsAt       *time.Time `json:"trial_ends_at,omitempty"`

	// Stripe integration
	StripeSubscriptionID *string `json:"stripe_subscription_id,omitempty" gorm:"type:varchar(255);uniqueIndex"`

	// Seat-based billing (quantity-based Stripe subscriptions)
	// Null means "not seat-based / unknown". When set, it becomes the effective user limit.
	SeatsPurchased *int `json:"seats_purchased,omitempty" gorm:"index"`

	// Associations
	Organization *Organization `json:"organization,omitempty" gorm:"foreignKey:OrganizationID"`
	Plan         *Plan         `json:"plan,omitempty" gorm:"foreignKey:PlanID"`
}

type SubscriptionDTO struct {
	ID                   uint              `json:"id"`
	UUID                 uuid.UUID         `json:"uuid"`
	OrganizationID       uint              `json:"organization_id"`
	Plan                 *PlanDTO          `json:"plan,omitempty"`
	State                SubscriptionState `json:"state"`
	StartedAt            *time.Time        `json:"started_at,omitempty"`
	RenewAt              *time.Time        `json:"renew_at,omitempty"`
	CancelAt             *time.Time        `json:"cancel_at,omitempty"`
	EndedAt              *time.Time        `json:"ended_at,omitempty"`
	GracePeriodEndsAt    *time.Time        `json:"grace_period_ends_at,omitempty"`
	TrialEndsAt          *time.Time        `json:"trial_ends_at,omitempty"`
	StripeSubscriptionID *string           `json:"stripe_subscription_id,omitempty"`
	SeatsPurchased       *int              `json:"seats_purchased,omitempty"`
	CreatedAt            time.Time         `json:"created_at"`
	UpdatedAt            time.Time         `json:"updated_at"`
}

type SubscriptionState string

type Team struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;not null" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	OrganizationID uint `json:"organization_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`

	// Team details
	Name        string `json:"name" gorm:"type:varchar(255);not null"`
	Description string `json:"description,omitempty" gorm:"type:text"`

	// System defaults
	IsDefault bool `json:"is_default" gorm:"not null;default:false"`

	// Access control
	AccessAllCollections bool `json:"access_all_collections" gorm:"default:false"`

	// External ID for LDAP/AD sync
	ExternalID *string `json:"external_id,omitempty" gorm:"type:varchar(255);index"`

	// Associations
	Organization *Organization `json:"organization,omitempty" gorm:"foreignKey:OrganizationID"`
	Members      []TeamUser    `json:"members,omitempty" gorm:"foreignKey:TeamID"`
}

type TeamDTO struct {
	ID                   uint      `json:"id"`
	UUID                 uuid.UUID `json:"uuid"`
	OrganizationID       uint      `json:"organization_id"`
	Name                 string    `json:"name"`
	Description          string    `json:"description,omitempty"`
	AccessAllCollections bool      `json:"access_all_collections"`
	ExternalID           *string   `json:"external_id,omitempty"`
	IsDefault            bool      `json:"is_default"`
	CreatedAt            time.Time `json:"created_at"`
	UpdatedAt            time.Time `json:"updated_at"`

	// Stats (optional)
	MemberCount *int `json:"member_count,omitempty"`
}

type TeamUser struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	CreatedAt time.Time `json:"created_at"`

	TeamID             uint `json:"team_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`
	OrganizationUserID uint `json:"organization_user_id" gorm:"not null;index;constraint:OnDelete:CASCADE"`

	// Role in team
	IsManager bool `json:"is_manager" gorm:"default:false"`

	// Associations
	Team             *Team             `json:"team,omitempty" gorm:"foreignKey:TeamID"`
	OrganizationUser *OrganizationUser `json:"organization_user,omitempty" gorm:"foreignKey:OrganizationUserID"`
}

type TeamUserDTO struct {
	ID                 uint      `json:"id"`
	TeamID             uint      `json:"team_id"`
	OrganizationUserID uint      `json:"organization_user_id"`
	UserID             uint      `json:"user_id"`
	UserEmail          string    `json:"user_email"`
	UserName           string    `json:"user_name"`
	IsManager          bool      `json:"is_manager"`
	CreatedAt          time.Time `json:"created_at"`
}

type Token struct {
	ID     int       `gorm:"primary_key" json:"id"`
	UserID int       `json:"user_id" gorm:"index;not null"`
	UUID   uuid.UUID `gorm:"type:uuid;type:varchar(100);uniqueIndex;not null" json:"uuid"`
	// SessionUUID groups access+refresh tokens belonging to the same login/session.
	// This allows multiple concurrent sessions (e.g. vault + extension) without revoking each other.
	SessionUUID uuid.UUID `gorm:"type:uuid;index" json:"-"`
	// DeviceID is an optional stable identifier for a device/app installation.
	// For Vault we currently align DeviceID with SessionUUID to avoid orphan sessions after tab close.
	DeviceID uuid.UUID `gorm:"type:uuid;index" json:"-"`
	// App identifies the client type: vault|extension|mobile|desktop
	App string `gorm:"type:varchar(16);index" json:"-"`
	// Kind is either "access" or "refresh" (optional for legacy rows).
	Kind       string    `gorm:"type:varchar(16);index" json:"-"`
	Token      string    `gorm:"type:text;not null" json:"-"`
	ExpiryTime time.Time `json:"expiry_time" gorm:"index;not null"`
}

type TokenClaims struct {
	UserID uint      `json:"user_id"`
	Email  string    `json:"email"`
	Schema string    `json:"schema"`
	Role   string    `json:"role"`
	UUID   uuid.UUID `json:"uuid"`
	Exp    int64     `json:"exp"`
}

type TokenDetails struct {
	AccessToken           string    `json:"access_token"`
	RefreshToken          string    `json:"refresh_token"`
	AccessTokenExpiresAt  int64     `json:"access_token_expires_at,omitempty"`  // unix seconds
	RefreshTokenExpiresAt int64     `json:"refresh_token_expires_at,omitempty"` // unix seconds
	AtExpiresTime         time.Time `json:"-"`
	RtExpiresTime         time.Time `json:"-"`
	AtUUID                uuid.UUID `json:"-"`
	RtUUID                uuid.UUID `json:"-"`
	SessionUUID           uuid.UUID `json:"-"`
}

type TransferOwnershipRequest struct {
	UserID         uint `json:"user_id" binding:"required"`
	OrganizationID uint `json:"organization_id" binding:"required"`
	NewOwnerUserID uint `json:"new_owner_user_id" binding:"required"`
}

type UpdateCollectionRequest struct {
	Name        *string `json:"name,omitempty" validate:"omitempty,max=255"`
	Description *string `json:"description,omitempty" validate:"omitempty,max=1000"`
	IsPrivate   *bool   `json:"is_private,omitempty"`
}

type UpdateOrgUserRoleRequest struct {
	Role      OrganizationRole `json:"role" binding:"required,oneof=owner admin manager member"`
	AccessAll *bool            `json:"access_all,omitempty"`
}

type UpdateOrganizationFolderRequest struct {
	Name string `json:"name" validate:"required,max=255"`
}

type UpdateOrganizationItemRequest struct {
	CollectionID *uint         `json:"collection_id,omitempty"`
	Data         *string       `json:"data,omitempty"`
	Metadata     *ItemMetadata `json:"metadata,omitempty"`
	IsFavorite   *bool         `json:"is_favorite,omitempty"`
	FolderID     *uint         `json:"folder_id,omitempty"`
	Reprompt     *bool         `json:"reprompt,omitempty"`
	AutoFill     *bool         `json:"auto_fill,omitempty"`
	AutoLogin    *bool         `json:"auto_login,omitempty"`
}

type UpdateOrganizationRequest struct {
	Name         *string `json:"name,omitempty" validate:"omitempty,max=255"`
	BillingEmail *string `json:"billing_email,omitempty" validate:"omitempty,email"`
}

type UpdateSSOConnectionRequest struct {
	Name            *string              `json:"name,omitempty" binding:"omitempty,max=255"`
	Domain          *string              `json:"domain,omitempty" binding:"omitempty,max=255"`
	SAMLConfig      *SAMLConfig          `json:"saml_config,omitempty"`
	OIDCConfig      *OIDCConfig          `json:"oidc_config,omitempty"`
	AutoProvision   *bool                `json:"auto_provision,omitempty"`
	DefaultRole     *OrganizationRole    `json:"default_role,omitempty"`
	JITProvisioning *bool                `json:"jit_provisioning,omitempty"`
	Status          *SSOConnectionStatus `json:"status,omitempty" binding:"omitempty,oneof=draft active inactive"`
}

type UpdateSubscriptionRequest struct {
	PlanCode string `json:"plan_code" validate:"required"`
}

type UpdateTeamRequest struct {
	Name                 *string `json:"name,omitempty" validate:"omitempty,max=255"`
	Description          *string `json:"description,omitempty" validate:"omitempty,max=1000"`
	AccessAllCollections *bool   `json:"access_all_collections,omitempty"`
}

type UpdateTeamUserRequest struct {
	IsManager bool `json:"is_manager"`
}

type UpdateUserAppearancePreferencesRequest struct {
	Theme *string `json:"theme"`
	Font  *string `json:"font"`
}

type UpdateUserNotificationPreferencesRequest struct {
	CommunicationEmails *bool `json:"communication_emails"`
	MarketingEmails     *bool `json:"marketing_emails"`
	SocialEmails        *bool `json:"social_emails"`
	SecurityEmails      *bool `json:"security_emails"`
}

type UpdateUserRequest struct {
	Name        *string `json:"name,omitempty"`
	Email       *string `json:"email,omitempty"`
	RoleID      *uint   `json:"role_id,omitempty"`
	DateOfBirth *string `json:"date_of_birth,omitempty"`
	Language    *string `json:"language,omitempty"`
}

type UpsertPreferenceRequest struct {
	Section string `json:"section"`
	Key     string `json:"key"`
	Type    string `json:"type"`
	Value   string `json:"value"`
}

type UpsertPreferencesRequest struct {
	Preferences []UpsertPreferenceRequest `json:"preferences"`
}

type User struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;type:varchar(100);" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	Name   string `json:"name" gorm:"type:varchar(255)"`
	Email  string `json:"email" gorm:"type:varchar(255);uniqueIndex;not null"`
	Schema string `json:"schema" gorm:"type:varchar(255);uniqueIndex;not null"`

	// Organization pointers (per user)
	PersonalOrganizationID uint `json:"personal_organization_id" gorm:"not null"`
	DefaultOrganizationID  uint `json:"default_organization_id" gorm:"not null"`

	// Modern Zero-Knowledge Encryption Fields
	MasterPasswordHash string `json:"-" gorm:"type:varchar(255);not null"` // bcrypt(HKDF(masterKey, info="auth"))
	ProtectedUserKey   string `json:"-" gorm:"type:text;not null"`         // EncString: "2.iv|ct|mac"

	// KDF Configuration (per user, configurable)
	KdfType        KdfType `json:"kdf_type" gorm:"not null;default:0"`            // 0=PBKDF2, 1=Argon2id
	KdfIterations  int     `json:"kdf_iterations" gorm:"not null;default:600000"` // Default: 600K
	KdfMemory      *int    `json:"kdf_memory,omitempty"`                          // For Argon2 (MB)
	KdfParallelism *int    `json:"kdf_parallelism,omitempty"`                     // For Argon2 (threads)
	KdfSalt        string  `json:"-" gorm:"type:varchar(64);not null"`            // hex-encoded 32 bytes, random per user

	// RSA Keys for Organization Sharing (optional, generated when joining first org)
	RSAPublicKey     *string `json:"rsa_public_key,omitempty" gorm:"type:text"` // RSA-2048 public key (PEM format)
	RSAPrivateKeyEnc *string `json:"-" gorm:"type:text"`                        // RSA private key encrypted with User Key (EncString)

	// User metadata
	RoleID       uint   `json:"role_id" gorm:"not null;default:2;constraint:OnUpdate:CASCADE,OnDelete:RESTRICT"`
	Role         *Role  `json:"role,omitempty" gorm:"foreignKey:RoleID"`
	IsVerified   bool   `json:"is_verified" gorm:"default:false"`
	IsSystemUser bool   `json:"is_system_user" gorm:"default:false;index"` // System users (e.g., super admin) cannot be deleted
	Language     string `json:"language" gorm:"type:varchar(10);default:'en'"`

	// Stripe integration for personal subscriptions
	StripeCustomerID *string `json:"-" gorm:"type:varchar(255);index"` // Stripe customer ID for user-level billing

	// Stats (runtime calculated, not stored in DB)
	ItemCount *int `json:"item_count,omitempty" gorm:"-"`
}

type UserActivity struct {
	ID           uint         `gorm:"primary_key" json:"id"`
	UserID       uint         `gorm:"not null;index" json:"user_id"`
	ActivityType ActivityType `gorm:"type:varchar(50);not null;index" json:"activity_type"`
	IPAddress    string       `gorm:"type:varchar(45)" json:"ip_address"` // IPv4 or IPv6
	UserAgent    string       `gorm:"type:varchar(500)" json:"user_agent"`
	Details      string       `gorm:"type:text" json:"details,omitempty"` // JSON for additional info
	CreatedAt    time.Time    `gorm:"index" json:"created_at"`
}

type UserActivityDTO struct {
	ID           uint         `json:"id"`
	UserID       uint         `json:"user_id"`
	ActivityType ActivityType `json:"activity_type"`
	IPAddress    string       `json:"ip_address"`
	UserAgent    string       `json:"user_agent"`
	Details      string       `json:"details,omitempty"`
	CreatedAt    time.Time    `json:"created_at"`
}

type UserAppearancePreferences struct {
	UserID uint `json:"user_id" gorm:"primaryKey"`

	// Theme can be: dark | light | system
	Theme string `json:"theme" gorm:"not null;default:dark"`

	// Font is a UI hint (e.g. inter, manrope, system).
	Font string `json:"font" gorm:"not null;default:inter"`

	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type UserAppearancePreferencesDTO struct {
	Theme string `json:"theme"`
	Font  string `json:"font"`
}

type UserAuthDTO struct {
	ID                     uint   `json:"id"`
	UUID                   string `json:"uuid"`
	Email                  string `json:"email"`
	Name                   string `json:"name"`
	Schema                 string `json:"schema"`
	Role                   string `json:"role"`
	IsVerified             bool   `json:"is_verified"`
	Language               string `json:"language"`
	PersonalOrganizationID uint   `json:"personal_organization_id"`
	DefaultOrganizationID  uint   `json:"default_organization_id"`
}

type UserBillingInfo struct {
	UserID       uint                 `json:"user_id"`
	Email        string               `json:"email"`
	Name         string               `json:"name"`
	IsPro        bool                 `json:"is_pro"` // true if user has active Pro subscription
	Subscription *UserSubscriptionDTO `json:"subscription,omitempty"`
	CurrentPlan  string               `json:"current_plan"` // "free" or plan code like "pro-monthly"
	CurrentItems int                  `json:"current_items"`
	Invoices     []*InvoiceDTO        `json:"invoices,omitempty"`

	// Payment provider information
	Provider          PaymentProvider `json:"provider"`                     // "stripe", "revenuecat", "manual", "none"
	Store             string          `json:"store,omitempty"`              // "APP_STORE", "PLAY_STORE", etc. (only for revenuecat)
	StoreDisplayName  string          `json:"store_display_name,omitempty"` // "Apple App Store", "Google Play Store", etc.
	ManagedExternally bool            `json:"managed_externally"`           // true if subscription can only be canceled from external store
	CanCancel         bool            `json:"can_cancel"`                   // true if subscription can be canceled from our API
	CanUpgrade        bool            `json:"can_upgrade"`                  // true if plan can be changed from our API
}

type UserDTO struct {
	ID            uint      `json:"id"`
	UUID          uuid.UUID `json:"uuid"`
	CreatedAt     time.Time `json:"created_at"`
	UpdatedAt     time.Time `json:"updated_at"`
	Name          string    `json:"name"`
	Email         string    `json:"email"`
	Schema        string    `json:"schema"`
	Role          string    `json:"role"`
	IsVerified    bool      `json:"is_verified"`
	IsSystemUser  bool      `json:"is_system_user"` // System users cannot be deleted
	Language      string    `json:"language"`
	ItemCount     *int      `json:"item_count,omitempty"`
	KdfType       KdfType   `json:"kdf_type"`
	KdfIterations int       `json:"kdf_iterations"`
}

type UserNotificationPreferences struct {
	UserID uint `json:"user_id" gorm:"primaryKey"`

	CommunicationEmails bool `json:"communication_emails" gorm:"not null;default:false"`
	MarketingEmails     bool `json:"marketing_emails" gorm:"not null;default:false"`
	SocialEmails        bool `json:"social_emails" gorm:"not null;default:false"`

	// Security emails are mandatory and should not be disabled.
	SecurityEmails bool `json:"security_emails" gorm:"not null;default:true"`

	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type UserNotificationPreferencesDTO struct {
	CommunicationEmails bool `json:"communication_emails"`
	MarketingEmails     bool `json:"marketing_emails"`
	SocialEmails        bool `json:"social_emails"`
	SecurityEmails      bool `json:"security_emails"`
}

type UserSubscription struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	UUID      uuid.UUID `gorm:"type:uuid;not null" json:"uuid"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`

	UserID uint              `json:"user_id" gorm:"not null;uniqueIndex;constraint:OnDelete:CASCADE"`
	PlanID uint              `json:"plan_id" gorm:"not null;index"`
	State  SubscriptionState `json:"state" gorm:"type:varchar(20);not null;default:'draft'"`

	// Lifecycle timestamps
	StartedAt         *time.Time `json:"started_at,omitempty"`
	RenewAt           *time.Time `json:"renew_at,omitempty"`
	CancelAt          *time.Time `json:"cancel_at,omitempty"`
	EndedAt           *time.Time `json:"ended_at,omitempty"`
	GracePeriodEndsAt *time.Time `json:"grace_period_ends_at,omitempty"`
	TrialEndsAt       *time.Time `json:"trial_ends_at,omitempty"`

	// Stripe integration
	StripeSubscriptionID *string `json:"stripe_subscription_id,omitempty" gorm:"type:varchar(255);uniqueIndex"`

	// Associations
	User *User `json:"user,omitempty" gorm:"foreignKey:UserID"`
	Plan *Plan `json:"plan,omitempty" gorm:"foreignKey:PlanID"`
}

type UserSubscriptionDTO struct {
	ID                   uint              `json:"id"`
	UUID                 uuid.UUID         `json:"uuid"`
	UserID               uint              `json:"user_id"`
	Plan                 *PlanDTO          `json:"plan,omitempty"`
	State                SubscriptionState `json:"state"`
	StartedAt            *time.Time        `json:"started_at,omitempty"`
	RenewAt              *time.Time        `json:"renew_at,omitempty"`
	CancelAt             *time.Time        `json:"cancel_at,omitempty"`
	EndedAt              *time.Time        `json:"ended_at,omitempty"`
	GracePeriodEndsAt    *time.Time        `json:"grace_period_ends_at,omitempty"`
	TrialEndsAt          *time.Time        `json:"trial_ends_at,omitempty"`
	StripeSubscriptionID *string           `json:"stripe_subscription_id,omitempty"`
	CreatedAt            time.Time         `json:"created_at"`
	UpdatedAt            time.Time         `json:"updated_at"`
}

type VerificationCode struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	Email     string    `json:"email" gorm:"type:varchar(255);not null;index:idx_verification_code_email"`
	Code      string    `json:"code" gorm:"type:varchar(6);not null;index:idx_verification_code_email"`
	ExpiresAt time.Time `json:"expires_at" gorm:"not null;index:idx_verification_code_expires"`
	CreatedAt time.Time `json:"created_at"`
}

type VerificationCodeRequest struct {
	Name  string `json:"name" binding:"required,max=100"`
	Email string `json:"email" binding:"required,email"`
}

type VerificationCodeResponse struct {
	Message string `json:"message"`
}

type VerifyEmailRequest struct {
	Email string `json:"email" binding:"required,email"`
	Code  string `json:"code" binding:"required,len=6"`
}

type VerifyEmailResponse struct {
	Message string `json:"message"`
	Success bool   `json:"success"`
}

type WebhookEvent struct {
	ID        uint      `gorm:"primary_key" json:"id"`
	CreatedAt time.Time `json:"created_at"`

	StripeEventID string         `json:"stripe_event_id" gorm:"type:varchar(255);uniqueIndex;not null"`
	EventType     string         `json:"event_type" gorm:"type:varchar(100);not null"`
	Payload       WebhookPayload `json:"payload" gorm:"type:jsonb;not null"`
	ProcessedAt   *time.Time     `json:"processed_at,omitempty"`
	Error         *string        `json:"error,omitempty" gorm:"type:text"`
}

type WebhookPayload json.RawMessage