credential

type CreateAPIKeyInput struct {
	PrincipalID uuid.UUID
	Name        string
	Scopes      []string
	ExpiresAt   *time.Time
	Metadata    map[string]any
}

type CreateClientSecretInput struct {
	PrincipalID uuid.UUID
	Name        string
	ExpiresAt   *time.Time
	Metadata    map[string]any
}

type CreateKeypairInput struct {
	PrincipalID  uuid.UUID
	Name         string
	KeyAlgorithm string // RS256, ES256, EdDSA
	PublicKeyPEM string
	Scopes       []string
	ExpiresAt    *time.Time
	Metadata     map[string]any
}

type CreatePasswordInput struct {
	PrincipalID uuid.UUID
	Password    string `json:"-"` //nolint:gosec // G117: field holds user-provided value, not a hardcoded secret
}

type Credential struct {
	ID            uuid.UUID      `json:"id"`
	PrincipalID   uuid.UUID      `json:"principal_id"`
	Type          Type           `json:"type"`
	Identifier    string         `json:"identifier,omitempty"` // e.g., key prefix for API keys
	Name          string         `json:"name,omitempty"`
	Scopes        []string       `json:"scopes,omitempty"`
	Active        bool           `json:"active"`
	ExpiresAt     *time.Time     `json:"expires_at,omitempty"`
	Revoked       bool           `json:"revoked"`
	RevokedAt     *time.Time     `json:"revoked_at,omitempty"`
	RevokedReason string         `json:"revoked_reason,omitempty"`
	LastUsedAt    *time.Time     `json:"last_used_at,omitempty"`
	LastUsedIP    string         `json:"last_used_ip,omitempty"`
	Metadata      map[string]any `json:"metadata,omitempty"`
	CreatedAt     time.Time      `json:"created_at"`
	UpdatedAt     time.Time      `json:"updated_at"`
}

type DefaultService struct {
	// contains filtered or unexported fields
}

type GeneratedAPIKey struct {
	Credential *Credential `json:"credential"`
	PlainKey   string      `json:"plain_key"` // Only available at creation time
	Prefix     string      `json:"prefix"`    // First 8 chars for identification
}

type GeneratedClientSecret struct {
	Credential  *Credential `json:"credential"`
	PlainSecret string      `json:"plain_secret"` // Only available at creation time
	Prefix      string      `json:"prefix"`       // First 8 chars for identification
}

type GeneratedLoginToken struct {
	Credential *Credential `json:"credential"`
	PlainToken string      `json:"plain_token"`
	Prefix     string      `json:"prefix"`
}

type IssueLoginTokenInput struct {
	// PrincipalID is the managed principal the token signs in.
	PrincipalID uuid.UUID
	// IssuedBy is the manager issuing the token.
	IssuedBy uuid.UUID
	// ExpiresAt is required; resolve it with LoginTokenPolicy.ExpiresAt.
	ExpiresAt time.Time
	// SingleUse revokes the token on its first successful use.
	SingleUse bool
	// Name is an optional label, such as the device or card it is for.
	Name string
}

type KeypairCredential struct {
	Credential   *Credential `json:"credential"`
	KeyID        string      `json:"key_id"`        // Used in JWT kid header
	KeyAlgorithm string      `json:"key_algorithm"` // RS256, ES256, etc.
	PublicKeyPEM string      `json:"public_key_pem"`
}

type LoginTokenPolicy struct {
	// DefaultTTL applies to reusable tokens issued without an explicit
	// expiry. A client may set its own, for example a school year.
	DefaultTTL time.Duration
	// MaxTTL caps every token's lifetime.
	MaxTTL time.Duration
	// SingleUseTTL applies to single-use tokens issued without an
	// explicit expiry.
	SingleUseTTL time.Duration
}

type Service interface {
	// Password operations
	CreatePassword(ctx context.Context, input CreatePasswordInput) error
	VerifyPassword(ctx context.Context, principalID uuid.UUID, password string) (bool, error)
	UpdatePassword(ctx context.Context, principalID uuid.UUID, newPassword string) error

	// API key operations
	CreateAPIKey(ctx context.Context, input CreateAPIKeyInput) (*GeneratedAPIKey, error)
	ValidateAPIKey(ctx context.Context, plainKey string) (*Credential, error)
	ListAPIKeys(ctx context.Context, principalID uuid.UUID) ([]*Credential, error)

	// Client secret operations
	CreateClientSecret(ctx context.Context, input CreateClientSecretInput) (*GeneratedClientSecret, error)
	ValidateClientSecret(ctx context.Context, clientID, plainSecret string) (*Credential, error)

	// Keypair operations
	CreateKeypair(ctx context.Context, input CreateKeypairInput) (*KeypairCredential, error)
	GetKeypairByKeyID(ctx context.Context, keyID string) (*KeypairCredential, error)
	ListKeypairs(ctx context.Context, principalID uuid.UUID) ([]*KeypairCredential, error)

	// Login token operations
	IssueLoginToken(ctx context.Context, input IssueLoginTokenInput) (*GeneratedLoginToken, error)
	VerifyLoginToken(ctx context.Context, plainToken, ip string) (*Credential, error)

	// Common operations
	GetByID(ctx context.Context, id uuid.UUID) (*Credential, error)
	Revoke(ctx context.Context, id uuid.UUID, reason string) error
	UpdateLastUsed(ctx context.Context, id uuid.UUID, ip string) error
}

type Type string