requests

type AcceptInvite struct {
	TenantID string `param:"tenant" validate:"required"`
	UserID   string `header:"X-ID" validate:"required"`
}

type AccessPolicyCreate struct {
	Name          string              `json:"name" validate:"required"`
	Subject       AccessPolicySubject `json:"subject" validate:"required"`
	Filter        AccessPolicyFilter  `json:"filter" validate:"required"`
	Logins        []string            `json:"logins" validate:"required,min=1,dive,required"`
	SourceIP      []string            `json:"source_ip" validate:"omitempty,dive,cidr|ip"`
	Action        string              `json:"action" validate:"omitempty,oneof=allow deny"`
	RequireReauth bool                `json:"require_reauth" validate:""`
	ReauthPeriod  *int                `json:"reauth_period" validate:"omitempty,gte=0"`
	TenantID      string              `json:"-"`
}

type AccessPolicyDelete struct {
	AccessPolicyIDParam
	TenantID string `json:"-"`
}

type AccessPolicyFilter struct {
	Hostname string   `json:"hostname,omitempty" validate:"required_without=Tags,excluded_with=Tags,regexp"`
	Tags     []string `json:"tags,omitempty" validate:"required_without=Hostname"`
}

type AccessPolicyGet struct {
	AccessPolicyIDParam
	TenantID string `json:"-"`
}

type AccessPolicyIDParam struct {
	ID string `param:"id" validate:"required"`
}

type AccessPolicyList struct {
	TenantID string `json:"-"`
}

type AccessPolicySubject struct {
	Type  string `json:"type" validate:"required,oneof=user role all-members"`
	Value string `json:"value"`
}

type AccessPolicyUpdate struct {
	AccessPolicyIDParam
	Name          string              `json:"name" validate:"required"`
	Subject       AccessPolicySubject `json:"subject" validate:"required"`
	Filter        AccessPolicyFilter  `json:"filter" validate:"required"`
	Logins        []string            `json:"logins" validate:"required,min=1,dive,required"`
	SourceIP      []string            `json:"source_ip" validate:"omitempty,dive,cidr|ip"`
	Action        string              `json:"action" validate:"omitempty,oneof=allow deny"`
	RequireReauth bool                `json:"require_reauth" validate:""`
	ReauthPeriod  *int                `json:"reauth_period" validate:"omitempty,gte=0"`
	TenantID      string              `json:"-"`
}

type AuthLocalUser struct {
	// Identifier represents an username or email.
	//
	// TODO: change json tag from username to identifier and update the OpenAPI.
	Identifier models.UserAuthIdentifier `json:"username" validate:"required"`
	Password   string                    `json:"password" validate:"required"`
}

type AuthTokenGet struct {
	UserParam
}

type AuthTokenSwap struct {
	TenantParam
}

type CancelMembershipInvitation struct {
	TenantID      string `param:"tenant" validate:"required"`
	UserID        string `header:"X-ID" validate:"required"`
	InvitedUserID string `param:"uid" validate:"required"`
}

type CreateAPIKey struct {
	UserID    string          `header:"X-ID"`
	TenantID  string          `header:"X-Tenant-ID"`
	Role      authorizer.Role `header:"X-Role"`
	Name      string          `json:"name" validate:"required,api-key_name"`
	ExpiresAt int             `json:"expires_at" validate:"required,api-key_expires-at"`
	Key       string          `json:"key" validate:"omitempty,uuid"`
	OptRole   authorizer.Role `json:"role" validate:"omitempty,member_role"`
}

type CreateInstallKey struct {
	UserID   string `header:"X-ID"`
	TenantID string `header:"X-Tenant-ID"`
	Name     string `json:"name" validate:"required,api-key_name"`
	// Mode is the enrollment policy. Omitted defaults to "automatic". Mode-specific fields
	// (WebhookURL/WebhookSecret, AllowedMACs) are validated in the service.
	Mode string `json:"mode" validate:"omitempty,oneof=automatic manual webhook allowlist"`
	// WebhookURL and WebhookSecret configure the webhook mode; AllowedMACs configures the allowlist mode.
	WebhookURL    string   `json:"webhook_url" validate:"omitempty,url"`
	WebhookSecret string   `json:"webhook_secret"`
	AllowedMACs   []string `json:"allowed_macs" validate:"omitempty,dive,required"`
	// WebhookTimeout (seconds, max 15) is the synchronous request timeout; WebhookCallbackTTL (seconds,
	// max 24h) is the deferred-decision token's validity. 0/omitted uses the server default.
	WebhookTimeout     int `json:"webhook_timeout" validate:"omitempty,min=0,max=15"`
	WebhookCallbackTTL int `json:"webhook_callback_ttl" validate:"omitempty,min=0,max=86400"`
	// ExpiresAt is the absolute date the key expires. A null (or omitted) value means the key never
	// expires. When set, it must be in the future.
	ExpiresAt *time.Time `json:"expires_at"`
	// UsageLimit caps how many devices may enroll: 1 is single-use (one-off), a higher value is that
	// many devices, 0 (or omitted) is unlimited. Whether the key is reusable is derived from this.
	UsageLimit int  `json:"usage_limit" validate:"omitempty,min=0"`
	Ephemeral  bool `json:"ephemeral"`
	// EphemeralTimeout is how many minutes an ephemeral device may stay offline before removal
	// (1-10). Only honored when Ephemeral is true; defaults to the maximum when omitted.
	EphemeralTimeout int      `json:"ephemeral_timeout" validate:"omitempty,min=1,max=10"`
	Tags             []string `json:"tags" validate:"omitempty,dive,required"`
}

type CreateTag struct {
	TenantID string `param:"tenant" header:"X-Tenant-ID" validate:"required,uuid"`
	Name     string `json:"name" validate:"required,min=3,max=255,alphanum,ascii,excludes=/@&:"`
}

type CreateUserToken struct {
	UserID   string `param:"id" header:"X-ID" validate:"required"`
	TenantID string `param:"tenant" validate:"omitempty,uuid"`
}

type DeleteAPIKey struct {
	TenantID string `header:"X-Tenant-ID"`
	Name     string `param:"name" validate:"required"`
}

type DeleteTag struct {
	TenantID string `param:"tenant" header:"X-Tenant-ID" validate:"required,uuid"`
	Name     string `param:"name" validate:"required"`
}

type DeviceAuth struct {
	Info       *DeviceInfo     `json:"info" validate:"required"`
	Sessions   []string        `json:"sessions,omitempty"`
	Hostname   string          `json:"hostname,omitempty" validate:"required_without=Identity,omitempty,device_name" hash:"-"`
	Identity   *DeviceIdentity `json:"identity,omitempty" validate:"required_without=Hostname,omitempty"`
	PublicKey  string          `json:"public_key" validate:"required"`
	TenantID   string          `json:"tenant_id" validate:"required"`
	InstallKey string          `json:"install_key,omitempty"`
	RealIP     string          `header:"X-Real-IP"`
	// ForwardedHost/ForwardedProto carry the public base (set by the gateway) so a webhook-mode
	// enrollment can build an absolute callback URL for the integrator.
	ForwardedHost  string `header:"X-Forwarded-Host"`
	ForwardedProto string `header:"X-Forwarded-Proto"`
}

type DeviceCreateTag struct {
	DeviceParam
	TagBody
}

type DeviceDelete struct {
	DeviceParam
}

type DeviceDeleteCustomField struct {
	TenantID string `header:"X-Tenant-ID"`
	DeviceParam
	Key string `param:"key" validate:"required,min=1,max=64"`
}

type DeviceGet struct {
	DeviceParam
}

type DeviceIdentity struct {
	MAC string `json:"mac"`
}

type DeviceInfo struct {
	ID         string `json:"id"`
	PrettyName string `json:"pretty_name"`
	Version    string `json:"version"`
	Arch       string `json:"arch"`
	Platform   string `json:"platform"`
}

type DeviceList struct {
	TenantID     string              `header:"X-Tenant-ID"`
	DeviceStatus models.DeviceStatus `query:"status"` //  TODO: validate
	query.Paginator
	query.Sorter
	query.Filters
}

type DeviceLoginCodeResolve struct {
	Code string `param:"code" validate:"required"`
}

type DeviceLookup struct {
	TenantID string `query:"tenant_id" validate:"required"`
	Name     string `query:"name" validate:"required"`
}

type DeviceOffline struct {
	DeviceParam
}

type DevicePairingAccept struct {
	Code     string `param:"code" validate:"required"`
	TenantID string `json:"tenant_id" validate:"required,uuid"`
}

type DevicePairingCreate struct {
	Info      *DeviceInfo     `json:"info" validate:"required"`
	Hostname  string          `json:"hostname,omitempty" validate:"required_without=Identity,omitempty,device_name" hash:"-"`
	Identity  *DeviceIdentity `json:"identity,omitempty" validate:"required_without=Hostname,omitempty"`
	PublicKey string          `json:"public_key" validate:"required"`
	Code      string          `json:"code,omitempty"`
}

type DevicePairingStatus struct {
	Code string `param:"code" validate:"required"`
}

type DeviceParam struct {
	UID string `param:"uid" validate:"required"`
}

type DeviceRemoveTag struct {
	DeviceParam
	TagBody
}

type DeviceRename struct {
	DeviceParam
	Name string `json:"name" validate:"required"`
}

type DeviceSetCustomField struct {
	TenantID string `header:"X-Tenant-ID"`
	DeviceParam
	Key   string `param:"key" validate:"required,min=1,max=64"`
	Value string `json:"value" validate:"max=256"`
}

type DeviceUpdate struct {
	TenantID string `header:"X-Tenant-ID"`
	UID      string `param:"uid" validate:"required"`
	Name     string `json:"name" validate:"omitempty,device_name"`
}

type DeviceUpdateStatus struct {
	TenantID string `header:"X-Tenant-ID"`
	UID      string `param:"uid" validate:"required"`
	Status   string `param:"status" validate:"required,oneof=accepted pending rejected"`
}

type DeviceUpdateTag struct {
	DeviceParam
	Tags []string `json:"tags" validate:"required,min=0,max=3,unique,dive,min=3,max=255,alphanum,ascii,excludes=/@&:"`
}

type EditSSHAccessMode struct {
	TenantParam
	SSHAccessMode string `json:"ssh_access_mode" validate:"required,oneof=legacy identity"`
}

type EnrollmentCallback struct {
	Token    string `param:"token" validate:"required"`
	Decision string `json:"decision" validate:"required,oneof=accept reject"`
	Reason   string `json:"reason"`
}

type FingerprintParam struct {
	Fingerprint string `param:"fingerprint" validate:"required"`
}

type GenerateInvitationLink struct {
	ForwardedHost  string          `header:"X-Forwarded-Host" validate:"required"`
	ForwardedProto string          `header:"X-Forwarded-Proto"`
	TenantID       string          `param:"tenant" validate:"required,uuid"`
	UserID         string          `header:"X-ID" validate:"required"`
	MemberEmail    string          `json:"email" validate:"required"`
	MemberRole     authorizer.Role `json:"role" validate:"required,member_role"`
}

type GetStats struct {
	TenantID string `header:"X-Tenant-ID"`
}

type GetSystemInfo struct {
	Host string `header:"X-Forwarded-Host"`
	Port int    `header:"X-Forwarded-Port"`
}

type LeaveNamespace struct {
	UserID string `header:"X-ID" validate:"required"`
	// TenantID represents the namespace that the user intends to leave.
	TenantID string `param:"tenant" validate:"required,uuid"`
	// AuthenticatedTenantID represents the namespace to which the user is currently authenticated.
	AuthenticatedTenantID string `header:"X-Tenant-ID" validate:"required"`
}

type ListAPIKey struct {
	TenantID string `header:"X-Tenant-ID"`
	query.Paginator
	query.Sorter
}

type ListInstallKey struct {
	TenantID string `header:"X-Tenant-ID"`
	query.Paginator
	query.Sorter
}

type ListInstallKeyEvents struct {
	TenantID string `header:"X-Tenant-ID"`
	// ID is the install key's digest. History is keyed by digest, not name: names are unique only per
	// namespace and can be reused (the system "legacy" key) or renamed, so a name would be ambiguous.
	ID string `param:"id" validate:"required"`
	query.Paginator
	query.Sorter
}

type ListPublicKeys struct {
	TenantID string `header:"X-Tenant-ID"`
	query.Paginator
	query.Filters
}

type ListSessions struct {
	TenantID string `header:"X-Tenant-ID"`
	query.Paginator
	query.Filters
}

type ListTags struct {
	TenantID string `param:"tenant" header:"X-Tenant-ID" validate:"required,uuid"`
	query.Paginator
	query.Filters
	query.Sorter
}

type MemberList struct {
	TenantID string `param:"tenant" validate:"required,uuid"`
	query.Paginator
}

type MemberParam struct {
	MemberUID string `param:"uid" validate:"required"`
}

type NamespaceAddMember struct {
	ForwardedHost  string          `header:"X-Forwarded-Host" validate:"required"`
	ForwardedProto string          `header:"X-Forwarded-Proto"`
	UserID         string          `header:"X-ID" validate:"required"`
	TenantID       string          `param:"tenant" validate:"required,uuid"`
	MemberEmail    string          `json:"email" validate:"required"`
	MemberRole     authorizer.Role `json:"role" validate:"required,member_role"`
}

type NamespaceCreate struct {
	UserID   string `header:"X-ID" validate:"required"`
	Name     string `json:"name"  validate:"required,hostname_rfc1123,excludes=."`
	TenantID string `json:"tenant" validate:"omitempty,uuid"`
	Type     string `json:"type" validate:"omitempty,lowercase,oneof=personal team"`
}

type NamespaceDelete struct {
	TenantParam
}

type NamespaceEdit struct {
	TenantParam
	Name     string `json:"name" validate:"omitempty,hostname_rfc1123,excludes=."`
	Settings struct {
		SessionRecord          *bool   `json:"session_record" validate:"omitempty"`
		ConnectionAnnouncement *string `json:"connection_announcement" validate:"omitempty,min=0,max=4096"`
	} `json:"settings"`
}

type NamespaceGet struct {
	TenantParam
}

type NamespaceList struct {
	UserID   string `header:"X-ID"`
	TenantID string `header:"X-Tenant-ID"`
	// IsAdmin comes from the authenticated identity; a client-supplied X-Admin is overwritten.
	IsAdmin bool `header:"X-Admin"`
	query.Paginator
	query.Filters
}

type NamespaceMembershipInvitationList struct {
	// ForwardedHost is only used to build the copyable invite_url; it's optional so a missing
	// header degrades to omitting the link rather than failing the whole listing.
	ForwardedHost  string `header:"X-Forwarded-Host"`
	ForwardedProto string `header:"X-Forwarded-Proto"`
	TenantID       string `param:"tenant" validate:"required"`
	UserID         string `header:"X-ID" validate:"required"`
	query.Paginator
	query.Sorter
	query.Filters
}

type NamespaceRemoveMember struct {
	UserID   string `header:"X-ID" validate:"required"`
	TenantID string `param:"tenant" validate:"required,uuid"`
	MemberID string `param:"uid" validate:"required"`
}

type NamespaceUpdateMember struct {
	UserID     string          `header:"X-ID" validate:"required"`
	TenantID   string          `param:"tenant" validate:"required,uuid"`
	MemberID   string          `param:"uid" validate:"required"`
	MemberRole authorizer.Role `json:"role" validate:"omitempty,member_role"`
}

type OptionalTime struct {
	Present bool
	Value   *time.Time
}

type PublicKeyAuth struct {
	Fingerprint string `json:"fingerprint" validate:"required"`
	Data        string `json:"data" validate:"required"`
}

type PublicKeyCreate struct {
	Data        []byte          `json:"data" validate:"required"`
	Filter      PublicKeyFilter `json:"filter" validate:"required"`
	Name        string          `json:"name" validate:"required"`
	Username    string          `json:"username" validate:"required,regexp"`
	TenantID    string          `json:"-"`
	Fingerprint string          `json:"-"`
}

type PublicKeyDelete struct {
	FingerprintParam
}

type PublicKeyFilter struct {
	Hostname string   `json:"hostname,omitempty" validate:"required_without=Tags,excluded_with=Tags,regexp"`
	Tags     []string `json:"tags,omitempty" validate:"required_without=Hostname"`
}

type PublicKeyGet struct {
	FingerprintParam
	TenantParam
}

type PublicKeyTagAdd struct {
	FingerprintParam
	TagParam
}

type PublicKeyTagRemove struct {
	FingerprintParam
	TagParam
}

type PublicKeyTagsUpdate struct {
	FingerprintParam
	Tags []string `json:"tags" validate:"required,min=1,max=3,unique,dive,min=3,max=255,alphanum,ascii,excludes=/@&:"`
}

type PublicKeyUpdate struct {
	FingerprintParam
	// Name is the public key's name.
	Name string `json:"name" validate:"required"`
	// Username is the public key's username.
	Username string `json:"username" validate:"required,regexp"`
	// Filter is the public key's filter.
	Filter PublicKeyFilter `json:"filter" validate:"required"`
}

type PullTag struct {
	TenantID string `param:"tenant" header:"X-Tenant-ID" validate:"required,uuid"`
	Name     string `param:"name" validate:"required,min=3,max=255,alphanum,ascii,excludes=/@&:"`
	// TargetID is the identifier of the target to pull the tag of.
	// For the reason cannot of it can be a list of things (UID for device, ID for firewall, etc...), it
	// cannot be parsed and must be set manually
	TargetID string `validate:"required"`
}

type PushTag struct {
	TenantID string `param:"tenant" header:"X-Tenant-ID" validate:"required,uuid"`
	Name     string `param:"name" validate:"required,min=3,max=255,alphanum,ascii,excludes=/@&:"`
	// TargetID is the identifier of the target to push the tag on.
	// For the reason cannot of it can be a list of things (UID for device, ID for firewall, etc...), it
	// cannot be parsed and must be set manually
	TargetID string `validate:"required"`
}

type RegisterUser struct {
	Name     string `json:"name" validate:"required,name"`
	Username string `json:"username" validate:"required,username"`
	// Email is required for open self-registration, but omitted on the invite flow:
	// there the email is derived from the invitation the Sig resolves to (the invitee
	// can't retarget it), so it's optional when a Sig is present.
	Email          string `json:"email" validate:"required_without=Sig,omitempty,email"`
	Password       string `json:"password" validate:"required,password"`
	EmailMarketing bool   `json:"email_marketing"`

	// Sig is the invitation code from the accept-invite link. When present, it proves
	// the email was already validated (the invitee clicked the link) and identifies the
	// invitation. It's a human-readable pairing code, not a UUID.
	Sig string `json:"sig" validate:"omitempty"`
}

type ResolveDevice struct {
	TenantID string `header:"X-Tenant-ID" validate:"required"`
	UID      string `query:"uid" validate:"omitempty"`
	Hostname string `query:"hostname" validate:"omitempty"`
}

type ResolveInvitation struct {
	Invite string `query:"invite" validate:"required"`
}

type RevealInstallKey struct {
	TenantID string `header:"X-Tenant-ID"`
	Name     string `param:"name" validate:"required"`
}

type RoleBody struct {
	Role string `json:"role" validate:"required,oneof=administrator operator observer"`
}

type SSHApprovalConfirm struct {
	Code string `param:"code" validate:"required"`
	// ExpiresIn is how many days the key being bound should keep working,
	// omitted for a key that never expires. Only meaningful for the identity
	// kind, since a re-auth binds nothing.
	ExpiresIn *int `json:"expires_in" validate:"omitempty,min=1"`
}

type SSHApprovalCreate struct {
	SessionUID string `json:"session_uid" validate:"required"`
	SSHID      string `json:"sshid" validate:"required"`
	TenantID   string `json:"tenant_id" validate:"required,uuid"`
	DeviceUID  string `json:"device_uid" validate:"required"`
	DeviceName string `json:"device_name" validate:""`
	Username   string `json:"username" validate:"required"`
	IPAddress  string `json:"ip_address" validate:"required"`
	// Kind is what confirming will do: bind the key as an identity, or refresh an
	// existing identity's re-auth window.
	Kind        models.SSHApprovalKind `json:"kind" validate:"required,oneof=identity reauth"`
	Fingerprint string                 `json:"fingerprint" validate:"required"`
	Data        []byte                 `json:"data" validate:"required"`
	// ReauthPeriod carries the policy's window so the console can say how long
	// confirming lasts. Only meaningful for the reauth kind.
	ReauthPeriod *int `json:"reauth_period" validate:""`
}

type SSHApprovalGet struct {
	Code string `param:"code" validate:"required"`
}

type SSHApprovalReject struct {
	Code string `param:"code" validate:"required"`
}

type SSHApprovalStatus struct {
	Code string `param:"code" validate:"required"`
	// Wait asks the API to hold the request open until the login is decided
	// instead of answering "pending" right away. The gateway sets it so the
	// person is not left staring at a frozen terminal for a poll interval after
	// they already decided.
	Wait bool `query:"wait" validate:""`
}

type SSHIdentityCreate struct {
	TenantID string `json:"-"`
	UserID   string `json:"-"`
	Name     string `json:"name" validate:""`
	// Data is the OpenSSH public key to enroll.
	Data string `json:"data" validate:"required"`
	// Source says whether this is a key somebody pasted or the web terminal
	// enrolling its own browser-held one, defaulting to the former. The caller
	// asserts it, so it may only ever label the identity — the approval path is
	// not accepted here precisely because that one the server knows for itself.
	Source models.SSHIdentitySource `json:"source" validate:"omitempty,oneof=manual browser"`
	// ExpiresIn is how many days the key should keep working, omitted for a key
	// that never expires. The gateway refuses a login with an expired key.
	ExpiresIn *int `json:"expires_in" validate:"omitempty,min=1"`
}

type SSHIdentityDelete struct {
	SSHIdentityIDParam
	TenantID string `json:"-"`
	UserID   string `json:"-"`
	// Manage reports whether the caller holds the SSHIdentityManage permission,
	// allowing them to revoke another member's identity.
	Manage bool `json:"-"`
}

type SSHIdentityIDParam struct {
	ID string `param:"id" validate:"required"`
}

type SSHIdentityList struct {
	TenantID string `json:"-"`
	UserID   string `json:"-"`
	All      bool   `query:"all"`
}

type SSHIdentityUpdate struct {
	SSHIdentityIDParam
	TenantID string `json:"-"`
	UserID   string `json:"-"`
	Name     string `json:"name" validate:"required"`
}

type ServiceAccountCreate struct {
	TenantID string `json:"-"`
	Name     string `json:"name" validate:"required"`
	// Data is the OpenSSH public key to enroll for the service account.
	Data string `json:"data" validate:"required"`
	// SingleUse burns the key after one established SSH session (Vault-OTP style:
	// consumed per access, not per enrollment).
	SingleUse bool `json:"single_use"`
	// ExpiresIn is the key's TTL in days from creation; nil means it never
	// expires. Service-account only.
	ExpiresIn *int `json:"expires_in" validate:"omitempty,min=1"`
}

type ServiceAccountDelete struct {
	ServiceAccountIDParam
	TenantID string `json:"-"`
}

type ServiceAccountIDParam struct {
	ID string `param:"id" validate:"required"`
}

type ServiceAccountList struct {
	TenantID string `json:"-"`
}

type SessionAuthenticatedSet struct {
	SessionIDParam
	Authenticated bool `json:"authenticated" validate:"required"`
}

type SessionCreate struct {
	UID       string `json:"uid" validate:"required"`
	DeviceUID string `json:"device_uid" validate:"required"`
	Username  string `json:"username" validate:"required"`
	IPAddress string `json:"ip_address" validate:"required"`
	Type      string `json:"type" validate:"required"`
	Term      string `json:"term" validate:""`
	Web       bool   `json:"web" validate:""`
	// UserID is the ShellHub account that authorized the session via browser
	// approval. Empty for password/public-key and web-terminal sessions.
	UserID string `json:"user_id" validate:""`
}

type SessionEditRecordStatus struct {
	TenantParam
	SessionRecord bool `json:"session_record"`
}

type SessionEvent struct {
	Type      string    `json:"type" validate:"required"`
	Timestamp time.Time `json:"timestamp" validate:"required"`
	Data      any       `json:"data" validate:"required"`
	Seat      int       `json:"seat" validate:"min=0"`
}

type SessionFinish struct {
	SessionIDParam
}

type SessionGet struct {
	SessionIDParam
}

type SessionIDParam struct {
	// UID is the session's UID.
	UID string `param:"uid" validate:"required"`
}

type SessionKeepAlive struct {
	SessionIDParam
}

type SessionSeat struct {
	SessionIDParam
	ID int `json:"id"`
}

type SessionUpdate struct {
	SessionIDParam
	Recorded      *bool   `json:"recorded"`
	Authenticated *bool   `json:"authenticated"`
	Type          *string `json:"type"`
}

type Setup struct {
	Email     string `json:"email" validate:"required,email"`
	Name      string `json:"name" validate:"required,name"`
	Username  string `json:"username" validate:"required,username"`
	Password  string `json:"password" validate:"required,password"`
	Namespace string `json:"namespace" validate:"required,hostname_rfc1123,excludes=."`
}

type SystemInstallScript struct {
	Host                string `header:"X-Forwarded-Host"`
	Scheme              string `header:"X-Forwarded-Proto"`
	ForwardedPort       string `header:"X-Forwarded-Port"`
	TenantID            string `query:"tenant_id"`
	KeepAliveInternavel string `query:"keepalive_interval"`
	PreferredHostname   string `query:"preferred_hostname"`
	PreferredIdentity   string `query:"preferred_identity"`
}

type TagBody struct {
	Tag string `json:"tag" validate:"required,min=3,max=255,alphanum,ascii,excludes=/@&:"`
}

type TagDelete struct {
	TagParam
}

type TagParam struct {
	Tag string `param:"tag" validate:"required,min=3,max=255,alphanum,ascii,excludes=/@&:"`
}

type TagRename struct {
	TagParam
	NewTag string `json:"tag" validate:"required,min=3,max=255,alphanum,ascii,excludes=/@&:"`
}

type TenantParam struct {
	Tenant string `param:"tenant" validate:"required,uuid"`
}

type UpdateAPIKey struct {
	UserID   string `header:"X-ID"`
	TenantID string `header:"X-Tenant-ID"`
	// CurrentName is the current stored name. It is different from [UpdateAPIKey.Name], which is used
	// to handle the new target name (optional).
	CurrentName string          `param:"name" validate:"required"`
	Name        string          `json:"name" validate:"omitempty,api-key_name"`
	Role        authorizer.Role `json:"role" validate:"omitempty,member_role"`
}

type UpdateInstallKey struct {
	UserID   string `header:"X-ID"`
	TenantID string `header:"X-Tenant-ID"`
	// CurrentName is the current stored name (path param). It differs from [UpdateInstallKey.Name],
	// which is the optional new target name.
	CurrentName string `param:"name" validate:"required"`
	Name        string `json:"name" validate:"omitempty,api-key_name"`
	// Mode changes the enrollment policy. Nil leaves it unchanged. Mode-specific fields are validated
	// in the service against the resulting key state.
	Mode *string `json:"mode" validate:"omitempty,oneof=automatic manual webhook allowlist"`
	// WebhookURL/WebhookSecret update the webhook config; nil leaves each unchanged. AllowedMACs
	// replaces the allowlist when non-nil.
	WebhookURL    *string  `json:"webhook_url" validate:"omitempty,url"`
	WebhookSecret *string  `json:"webhook_secret"`
	AllowedMACs   []string `json:"allowed_macs" validate:"omitempty,dive,required"`
	// WebhookTimeout/WebhookCallbackTTL update the webhook tuning; nil leaves each unchanged.
	WebhookTimeout     *int `json:"webhook_timeout" validate:"omitempty,min=0,max=15"`
	WebhookCallbackTTL *int `json:"webhook_callback_ttl" validate:"omitempty,min=0,max=86400"`
	// Revoked toggles revocation. Only a false->true transition is honored; un-revoking is rejected.
	Revoked *bool `json:"revoked"`
	// Disabled toggles the reversible pause. Both true and false are honored, so a disabled key can
	// be re-enabled (unlike Revoked).
	Disabled *bool `json:"disabled"`
	// ExpiresAt sets a new absolute expiration date (must be in the future). Omitted leaves the
	// current expiry unchanged; null makes the key never expire (RFC 7396 semantics).
	ExpiresAt OptionalTime `json:"expires_at"`
	// UsageLimit sets a new enrollment cap (0 unlimited, 1 single-use, N devices). Nil leaves it
	// untouched. Reusability is re-derived from it.
	UsageLimit *int     `json:"usage_limit" validate:"omitempty,min=0"`
	Tags       []string `json:"tags" validate:"omitempty,dive,required"`
	// Ephemeral toggles whether devices enrolled with the key are auto-removed after staying offline
	// past the timeout; nil leaves it unchanged. EphemeralTimeout (1-10 minutes) is only honored when
	// Ephemeral is true.
	Ephemeral        *bool `json:"ephemeral"`
	EphemeralTimeout *int  `json:"ephemeral_timeout" validate:"omitempty,min=1,max=10"`
}

type UpdateTag struct {
	TenantID string `param:"tenant" header:"X-Tenant-ID" validate:"required,uuid"`
	Name     string `param:"name" validate:"required"`
	// Similar to [UpdateTag.Name], but is used to update the tag's name instead of retrieve the tag.
	NewName string `json:"name" validate:"omitempty,min=3,max=255,alphanum,ascii,excludes=/@&:"`
}

type UpdateUser struct {
	UserID        string `header:"X-ID" validate:"required"`
	Name          string `json:"name" validate:"omitempty,name"`
	Username      string `json:"username" validate:"omitempty,username"`
	Email         string `json:"email" validate:"omitempty,email"`
	RecoveryEmail string `json:"recovery_email" validate:"omitempty,email"`
	// Password is the new password. If not empty, [UserDataUpdate.CurrentPassword] must be the current user's password.
	Password        string `json:"password" validate:"omitempty,password"`
	CurrentPassword string `json:"current_password"`
}

type UserMembershipInvitationList struct {
	UserID string `header:"X-ID"`
	query.Paginator
	query.Sorter
	query.Filters
}

type UserParam struct {
	ID string `param:"id" validate:"required"`
}

type UserPasswordUpdate struct {
	UserParam
	CurrentPassword string `json:"current_password" validate:"required,min=5,max=32,nefield=NewPassword"`
	NewPassword     string `json:"new_password" validate:"required,password,nefield=CurrentPassword"`
}

type WebReauthVerify struct {
	TenantID string `json:"-"`
	UserID   string `json:"-"`
	Password string `json:"password"`
	Code     string `json:"code"`
	// Fingerprint is the SSH identity being re-authenticated. Its freshness is
	// stamped on that identity's last_reauth_at, and it must belong to the caller.
	Fingerprint string `json:"fingerprint" validate:"required"`
	// ApprovalCode is the login waiting on this step-up. Present when a held login
	// should be released by the same call that proves the factor, so verifying and
	// releasing cannot drift apart. Distinct from Code, which is the TOTP.
	ApprovalCode string `json:"approval_code"`
}