auth

type Config struct {
	PathPrefix string
	Secret     string
	Issuer     string
	MaxTTL     time.Duration
}

type LegacyPasswordConfig struct {
	AcceptUntil time.Time
}

type LegacyPasswordVerifier interface {
	VerifyPassword(password, encodedHash string) (bool, error)
}

type LegacyTokenConfig struct {
	SigningKey    []byte
	AcceptUntil   time.Time
	MaxTTL        time.Duration
	MaxTokenBytes int
}

type LoginRequest struct {
	Email    string `json:"email" validate:"required,email"`
	Password string `json:"password" validate:"required"`
}

type PasswordCompatibility struct {
	Verifier    LegacyPasswordVerifier
	AcceptUntil time.Time
}

type PasswordConfig struct {
	Memory      uint32
	Iterations  uint32
	Parallelism uint8
	SaltLength  uint32
	KeyLength   uint32
}

type PasswordPolicy struct {
	// contains filtered or unexported fields
}

type PasswordPolicyConfig struct {
	Pepper        []byte
	Argon2id      PasswordConfig
	LegacyV1      *LegacyPasswordConfig
	Compatibility []PasswordCompatibility
	Now           func() time.Time
}

type PasswordVerification uint8

type RedisSessionManager struct {
	// contains filtered or unexported fields
}

type RegisterRequest struct {
	Email    string `json:"email" validate:"required,email"`
	Password string `json:"password" validate:"required,min=6"`
	Name     string `json:"name"`
}

type Response struct {
	Token string `json:"token"`
	User  *User  `json:"user"`
}

type SessionConfig struct {
	TTL        time.Duration
	CookieName string
	// AllowInsecureHTTP disables Secure cookies for explicit local-development use only.
	AllowInsecureHTTP bool
	SameSite          http.SameSite
	Now               func() time.Time
	MaxSessions       int
}

type TokenClaims struct {
	Subject      string            `json:"sub"`
	UserID       int64             `json:"-"`
	UserIDString string            `json:"-"`
	Email        string            `json:"email,omitempty"`
	Roles        []string          `json:"roles,omitempty"`
	Attributes   map[string]string `json:"attributes,omitempty"`
	TenantID     string            `json:"tenant_id,omitempty"`
	Issuer       string            `json:"iss"`
	Audience     string            `json:"aud"`
	ExpiresAt    int64             `json:"exp"`
	NotBefore    int64             `json:"nbf"`
	IssuedAt     int64             `json:"iat"`
	JWTID        string            `json:"jti"`
}

type TokenCompatibility struct {
	Verifier      TokenVerifier
	AcceptUntil   time.Time
	MaxTokenBytes int
}

type TokenConfig struct {
	Issuer        string
	Audience      string
	ActiveKeyID   string
	Keys          map[string][]byte
	MaxTTL        time.Duration
	ClockSkew     time.Duration
	Now           func() time.Time
	LegacyV1      *LegacyTokenConfig
	Compatibility []TokenCompatibility
}

type TokenManager struct {
	// contains filtered or unexported fields
}

type TokenVerifier interface {
	VerifyToken(context.Context, string) (UserClaims, error)
}

type User struct {
	ID           int64     `json:"id" db:"id,pk,auto_id"`
	Email        string    `json:"email" db:"email,unique" validate:"required,email"`
	PasswordHash string    `json:"-" db:"password_hash"`
	Name         string    `json:"name" db:"name"`
	Role         string    `json:"role" db:"role"`
	CreatedAt    time.Time `json:"created_at" db:"created_at"`
	UpdatedAt    time.Time `json:"updated_at" db:"updated_at"`
}

type UserClaims struct {
	ID         string            `json:"id"`
	Subject    string            `json:"sub,omitempty"`
	Email      string            `json:"email"`
	Roles      []string          `json:"roles"`
	Attributes map[string]string `json:"attributes"`
	TenantID   string            `json:"tenant_id"`
}