identity

type Accounts interface {
	// FindUser returns the account with its devices and auth methods,
	// soft-deleted ones included.
	FindUser(ctx context.Context, id int64) (*user.User, error)
	// FindDeviceForAuth returns the device's owner, identifier and enabled
	// flag as stored now, bypassing the caches: request authentication reads
	// it, so a disabled or reassigned device loses its sessions at once.
	FindDeviceForAuth(ctx context.Context, id int64) (*user.Device, error)
	// FindUsersByIDs returns the live accounts among ids, without their
	// devices and auth methods.
	FindUsersByIDs(ctx context.Context, ids []int64) ([]*user.User, error)
	// FindAccountState returns the account gate (enabled, deleted) of the
	// request hot paths, soft-deleted accounts included.
	FindAccountState(ctx context.Context, id int64) (*user.AccountState, error)
	// FindAccountStateForAuth returns the account gate request
	// authentication applies (enabled, deleted, administrator) as stored
	// now, bypassing the caches, so a ban, deletion or demotion refuses the
	// account's sessions at once rather than after the cache's lifetime.
	FindAccountStateForAuth(ctx context.Context, id int64) (*user.AccountState, error)
	// FindEnabledUserIDs returns the ids among ids of live, enabled accounts.
	FindEnabledUserIDs(ctx context.Context, ids []int64) ([]int64, error)
	// CountEnabledUsers counts the live, enabled accounts.
	CountEnabledUsers(ctx context.Context) (int64, error)

	// CountRegisteredUsers counts the registered accounts; the On and InMonth
	// variants count those registered on day's day or in month's month.
	CountRegisteredUsers(ctx context.Context) (int64, error)
	CountRegisteredUsersOn(ctx context.Context, day time.Time) (int64, error)
	CountRegisteredUsersInMonth(ctx context.Context, month time.Time) (int64, error)
	// DailyUserStatistics counts the registrations and paying users per day,
	// from the first day of until's month to until; MonthlyUserStatistics
	// per month, from five months before date on.
	DailyUserStatistics(ctx context.Context, until time.Time) ([]user.UserStatisticsWithDate, error)
	MonthlyUserStatistics(ctx context.Context, date time.Time) ([]user.UserStatisticsWithDate, error)

	// FindAuthMethodByIdentifier resolves the binding of authType whose
	// identifier is identifier, such as a Telegram chat id or an email
	// address.
	FindAuthMethodByIdentifier(ctx context.Context, authType, identifier string) (*user.AuthMethods, error)
	// FindEmailAlias returns an email binding of a live account that reaches
	// the same mailbox as email under another spelling (Gmail dots, "+tag"
	// subaddresses), the check registration runs; a guest purchase must
	// not create a second account for that mailbox.
	FindEmailAlias(ctx context.Context, email string) (*user.AuthMethods, error)
	// FindUserAuthMethod returns the account's binding of authType.
	FindUserAuthMethod(ctx context.Context, userID int64, authType string) (*user.AuthMethods, error)
	// ListUserAuthMethods returns every binding of the account.
	ListUserAuthMethods(ctx context.Context, userID int64) ([]*user.AuthMethods, error)
	// FindAuthMethodsByUserIDs returns the authType bindings of the accounts,
	// for contacting them in bulk; soft-deleted accounts resolve to none.
	FindAuthMethodsByUserIDs(ctx context.Context, authType string, userIDs []int64) ([]*user.AuthMethods, error)
	// ListUserDevices pages the account's devices, optionally only those of
	// one subscription.
	ListUserDevices(ctx context.Context, userID, subscribeID int64, page, size int) ([]*user.Device, int64, error)
	// ListLoginMethods returns the configured authentication methods;
	// FindLoginMethod returns the stored configuration of one, such as
	// "email" or "telegram".
	ListLoginMethods(ctx context.Context) ([]*auth.Auth, error)
	FindLoginMethod(ctx context.Context, method string) (*auth.Auth, error)
	// CountAffiliates counts the accounts the account referred;
	// ListAffiliates pages them.
	CountAffiliates(ctx context.Context, refererID int64) (int64, error)
	ListAffiliates(ctx context.Context, refererID int64, page, size int) ([]*user.User, int64, error)
	// QueryEmailRecipients returns the email addresses of the accounts a
	// marketing filter selects; CountEmailRecipients counts them.
	QueryEmailRecipients(ctx context.Context, filter *user.EmailRecipientFilter) ([]string, error)
	CountEmailRecipients(ctx context.Context, filter *user.EmailRecipientFilter) (int64, error)

	// ClearUserCache drops the id-keyed cached projections of the accounts,
	// after another module changed data they show.
	ClearUserCache(ctx context.Context, userIDs ...int64) error
	// ClearUserCacheOf drops every cached projection the loaded accounts
	// derive, their email-keyed entry included.
	ClearUserCacheOf(ctx context.Context, users ...*user.User) error

	// BindTelegramChat records chatID as the account's verified Telegram
	// binding, once the bot redeemed the account's bind token.
	BindTelegramChat(ctx context.Context, userID int64, chatID string) error
	// SetUserEnabled enables or disables the account like the admin edit
	// does: only the flag, then the subscription-token caches and node user
	// lists its access reaches are invalidated, so a ban applies at once.
	SetUserEnabled(ctx context.Context, userID int64, enabled bool) error
}

type AppleLoginRedirect = oauth.AppleLoginRedirect

type AuthSnapshot = authn.Snapshot

type Deps struct {
	Users     repository.UserRepo
	UserAuths repository.UserAuthRepo
	Devices   repository.UserDeviceRepo
	Cache     repository.UserCacheRepo
	Logs      repository.LogRepo
	Store     Store
	// KickDevice force-disconnects a bound device.
	KickDevice func(userID int64, identifier string)
	// SubscriptionCaches and ServerCaches drop the subscription tokens and
	// node user lists that keep serving an account after its deletion or
	// disabling (the subscription and network facades).
	SubscriptionCaches adminuser.SubscriptionCaches
	ServerCaches       adminuser.ServerCaches

	// Wallet is the port onto the billing module's wallets: the admin and
	// self-service account views read them, and the admin's money edits run
	// in billing's own transaction after the identity one.
	Wallet Wallets

	// Profile-specific dependencies.
	Auths repository.AuthRepo
	Redis *redis.Client
	// EmailDomains snapshots the runtime-mutable email domain-suffix policy.
	EmailDomains func() (domainList string, restrict bool)
	// TelegramBotName snapshots the runtime-mutable Telegram bot name.
	TelegramBotName func() string
	// NotifyTelegramUnbind sends the best-effort unbind notice.
	NotifyTelegramUnbind func(ctx context.Context, userID, chatID int64) error
	// NotifyPasswordChanged tells the account, best effort, that its
	// password was changed or reset and which third-party sign-in methods
	// (by type) are still bound to it; optional.
	NotifyPasswordChanged func(ctx context.Context, userID int64, bindings []string) error
	// AuthConfig snapshots the runtime-mutable settings consumed by the
	// authentication flows per request.
	AuthConfig func() AuthSnapshot
	// VerifyQueue publishes verification-code delivery tasks; the asynq
	// client satisfies it structurally.
	VerifyQueue VerificationTaskQueue
	// VerifyCodeConfig snapshots the runtime-mutable settings consumed by
	// the verification-code flows per request.
	VerifyCodeConfig func() VerifyCodeSnapshot
	// SenderConfig snapshots the runtime-mutable sender platform settings
	// per request, and Reinitialize re-runs a sender subsystem's
	// initialization after its configuration changed.
	SenderConfig func() SenderSnapshot
	Reinitialize func(subsystem string) error
}

type GuestAccountCommand = guestaccount.Command

type GuestAccounts interface {
	FindGuestAccount(context.Context, string) (int64, bool, error)
	EnsureGuestAccount(context.Context, GuestAccountCommand) (int64, error)
}

type SenderSnapshot = authmethodadmin.Snapshot

type Service interface {
	// Accounts serves the other modules' account reads and writes.
	Accounts

	CreateUser(ctx context.Context, req *dto.CreateUserRequest) error
	DeleteUser(ctx context.Context, req *dto.GetDetailRequest) error
	BatchDeleteUser(ctx context.Context, req *dto.BatchDeleteUserRequest) error
	GetUserDetail(ctx context.Context, req *dto.GetDetailRequest) (*dto.User, error)
	GetUserList(ctx context.Context, req *dto.GetUserListRequest) (*dto.GetUserListResponse, error)
	CurrentUser(ctx context.Context) (*dto.User, error)
	CreateUserAuthMethod(ctx context.Context, req *dto.CreateUserAuthMethodRequest) error
	DeleteUserAuthMethod(ctx context.Context, req *dto.DeleteUserAuthMethodRequest) error
	GetUserAuthMethod(ctx context.Context, req *dto.GetUserAuthMethodRequest) (*dto.GetUserAuthMethodResponse, error)
	UpdateUserAuthMethod(ctx context.Context, req *dto.UpdateUserAuthMethodRequest) error
	DeleteUserDevice(ctx context.Context, req *dto.DeleteUserDeviceRequest) error
	UpdateUserDevice(ctx context.Context, req *dto.UserDevice) error
	KickOfflineByUserDevice(ctx context.Context, req *dto.KickOfflineRequest) error
	GetUserLoginLogs(ctx context.Context, req *dto.GetUserLoginLogsRequest) (*dto.GetUserLoginLogsResponse, error)
	UpdateUserBasicInfo(ctx context.Context, req *dto.UpdateUserBasicInfoRequest) error
	UpdateUserNotifySetting(ctx context.Context, req *dto.UpdateUserNotifySettingRequest) error

	// The profile flows resolve the current user from the request context:
	// account info, credentials, third-party bindings, devices and
	// notification preferences.
	QueryUserInfo(ctx context.Context) (*dto.User, error)
	// UpdateUserPassword changes the password and reports the third-party
	// sign-in methods still bound to the account.
	UpdateUserPassword(ctx context.Context, req *dto.UpdateUserPasswordRequest) (*dto.UpdateUserPasswordResponse, error)
	// Logout ends the calling session.
	Logout(ctx context.Context) error
	UpdateUserNotify(ctx context.Context, req *dto.UpdateUserNotifyRequest) error
	UpdateUserRules(ctx context.Context, req *dto.UpdateUserRulesRequest) error
	GetLoginLog(ctx context.Context, req *dto.GetLoginLogRequest) (*dto.GetLoginLogResponse, error)
	GetDeviceList(ctx context.Context) (*dto.GetDeviceListResponse, error)
	UnbindDevice(ctx context.Context, req *dto.UnbindDeviceRequest) error
	GetOAuthMethods(ctx context.Context) (*dto.GetOAuthMethodsResponse, error)
	BindOAuth(ctx context.Context, req *dto.BindOAuthRequest) (*dto.BindOAuthResponse, error)
	BindOAuthCallback(ctx context.Context, req *dto.BindOAuthCallbackRequest) error
	UnbindOAuth(ctx context.Context, req *dto.UnbindOAuthRequest) error
	BindTelegram(ctx context.Context) (*dto.BindTelegramResponse, error)
	UnbindTelegram(ctx context.Context) error
	UpdateBindEmail(ctx context.Context, req *dto.UpdateBindEmailRequest) error
	VerifyEmail(ctx context.Context, req *dto.VerifyEmailRequest) error
	UpdateBindMobile(ctx context.Context, req *dto.UpdateBindMobileRequest) error

	// The authentication flows: existence checks, credential/telephone/device
	// login and registration, password resets and the OAuth handshakes. They
	// read the client address and user agent from the request metadata and
	// apply the configured Turnstile checks themselves.
	CheckUser(ctx context.Context, req *dto.CheckUserRequest) (*dto.CheckUserResponse, error)
	CheckUserTelephone(ctx context.Context, req *dto.TelephoneCheckUserRequest) (*dto.TelephoneCheckUserResponse, error)
	UserLogin(ctx context.Context, req *dto.UserLoginRequest) (*dto.LoginResponse, error)
	UserRegister(ctx context.Context, req *dto.UserRegisterRequest) (*dto.LoginResponse, error)
	TelephoneLogin(ctx context.Context, req *dto.TelephoneLoginRequest) (*dto.LoginResponse, error)
	TelephoneUserRegister(ctx context.Context, req *dto.TelephoneRegisterRequest) (*dto.LoginResponse, error)
	ResetPassword(ctx context.Context, req *dto.ResetPasswordRequest) (*dto.LoginResponse, error)
	TelephoneResetPassword(ctx context.Context, req *dto.TelephoneResetPasswordRequest) (*dto.LoginResponse, error)
	DeviceLogin(ctx context.Context, req *dto.DeviceLoginRequest) (*dto.LoginResponse, error)
	OAuthLogin(ctx context.Context, req *dto.OAuthLoginRequest) (*dto.OAuthLoginResponse, error)
	OAuthLoginGetToken(ctx context.Context, req *dto.OAuthLoginGetTokenRequest) (*dto.LoginResponse, error)
	AppleLoginCallback(ctx context.Context, req *dto.AppleLoginCallbackRequest) (*AppleLoginRedirect, error)

	// The admin-side authentication-method management: configuration,
	// sender platforms and test sends.
	GetAuthMethodList(ctx context.Context) (*dto.GetAuthMethodListResponse, error)
	GetAuthMethodConfig(ctx context.Context, req *dto.GetAuthMethodConfigRequest) (*dto.AuthMethodConfig, error)
	UpdateAuthMethodConfig(ctx context.Context, req *dto.UpdateAuthMethodConfigRequest) (*dto.AuthMethodConfig, error)
	GetEmailPlatform(ctx context.Context) (*dto.AuthPlatformResponse, error)
	GetSmsPlatform(ctx context.Context) (*dto.AuthPlatformResponse, error)
	TestEmailSend(ctx context.Context, req *dto.TestEmailSendRequest) error
	TestSmsSend(ctx context.Context, req *dto.TestSmsSendRequest) error

	// The verification-code flows issue and pre-check the email/SMS codes
	// gating registration and account mutations.
	SendEmailCode(ctx context.Context, req *dto.SendCodeRequest) (*dto.SendCodeResponse, error)
	SendSmsCode(ctx context.Context, req *dto.SendSmsCodeRequest) (*dto.SendCodeResponse, error)
	CheckVerificationCode(ctx context.Context, req *dto.CheckVerificationCodeRequest) (*dto.CheckVerificationCodeResponse, error)

	// The presence the device WebSocket reports, which the composition
	// root's socket callbacks record. Both skip a device that no longer
	// exists.
	//
	// MarkDeviceOnline shows the connected device identifier online; a
	// disabled device stays offline.
	MarkDeviceOnline(ctx context.Context, identifier string) error
	// MarkDeviceOffline shows the device offline again and records, for the
	// account userID, the online time of its connection opened at
	// connectedAt; the time is recorded even when the flag cannot be cleared.
	MarkDeviceOffline(ctx context.Context, userID int64, identifier string, connectedAt time.Time) error

	// The startup work of the runtime bootstrap and the server start.
	//
	// CreateInitialAdministrator creates the first administrator, signing in
	// with the verified email address and password, when the database holds
	// no account yet, and reports whether it created one.
	CreateInitialAdministrator(ctx context.Context, email, password string) (bool, error)
	// FindAdministratorsWithPassword returns the administrators, with their
	// auth methods, who sign in with password.
	FindAdministratorsWithPassword(ctx context.Context, password string) ([]*user.User, error)
	// ValidateEmailIdentities fails with EmailIdentityAmbiguous when email
	// sign-in cannot tell two email bindings apart.
	ValidateEmailIdentities(ctx context.Context) error
	// NormalizePhoneNumbers rewrites the phone numbers stored in a legacy
	// form to E.164 and logs what it changed; it is idempotent.
	NormalizePhoneNumbers(ctx context.Context) error
	// WarnUnpinnedOAuthRedirects logs an error when Apple or Telegram
	// sign-in is enabled while no site host pins their redirects.
	WarnUnpinnedOAuthRedirects(ctx context.Context) error
	// ReportLegacyAdministratorPasswords logs an error naming the ids of
	// the administrators whose password hash is still a legacy format.
	ReportLegacyAdministratorPasswords(ctx context.Context) error
}

type Store interface {
	adminuser.Store
	authn.Store
	profile.Store
	startup.Store
}

type VerificationTaskQueue = verifycode.VerificationTaskQueue

type VerifyCodeSnapshot = verifycode.Snapshot

type Wallets = adminuser.Wallets