auth

type APIKey struct {
	ID        string     `json:"id"`
	UserID    string     `json:"user_id"`
	Name      string     `json:"name"`
	Role      string     `json:"role"`
	KeyPrefix string     `json:"key_prefix"` // first 8 chars for display
	CreatedAt time.Time  `json:"created_at"`
	LastUsed  *time.Time `json:"last_used,omitempty"`
}

type Claims struct {
	Sub       string `json:"sub"`                  // Subject (username or user ID)
	Role      string `json:"role"`                 // RBAC role: admin, operator, analyst, viewer
	TenantID  string `json:"tenant_id,omitempty"`  // Multi-tenant isolation
	TokenType string `json:"token_type,omitempty"` // "access" or "refresh"
	Exp       int64  `json:"exp"`                  // Expiration (Unix timestamp)
	Iat       int64  `json:"iat"`                  // Issued at
	Iss       string `json:"iss,omitempty"`        // Issuer
}

type EmailSendFunc func(toEmail, userName, code string) error

type JWTMiddleware struct {

	// PublicPaths are exempt from auth (e.g., /health, /api/auth/login).
	PublicPaths map[string]bool
	// contains filtered or unexported fields
}

type LoginRequest struct {
	Email    string `json:"email"`
	Password string `json:"password"`
}

type Plan struct {
	ID                string `json:"id"`
	Name              string `json:"name"`
	Description       string `json:"description,omitempty"`
	MaxUsers          int    `json:"max_users"`
	MaxEventsMonth    int    `json:"max_events_month"` // SOC event ingestion quota (-1=unlimited)
	MaxIncidents      int    `json:"max_incidents"`
	MaxSensors        int    `json:"max_sensors"`
	MaxScansMonth     int    `json:"max_scans_month"` // /api/v1/scan quota (-1=unlimited, 0=none)
	RetentionDays     int    `json:"retention_days"`
	SOCEnabled        bool   `json:"soc_enabled"` // SOC Dashboard access
	SLAEnabled        bool   `json:"sla_enabled"`
	SOAREnabled       bool   `json:"soar_enabled"`
	ComplianceEnabled bool   `json:"compliance_enabled"`
	OnPremise         bool   `json:"on_premise"`        // Enterprise: on-premise deployment
	PriceMonthCents   int    `json:"price_month_cents"` // 0 = free, -1 = custom pricing
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type Tenant struct {
	ID                string    `json:"id"`
	Name              string    `json:"name"`
	Slug              string    `json:"slug"`
	PlanID            string    `json:"plan_id"`
	PaymentCustomerID string    `json:"payment_customer_id,omitempty"`
	PaymentSubID      string    `json:"payment_sub_id,omitempty"`
	OwnerUserID       string    `json:"owner_user_id"`
	Active            bool      `json:"active"`
	CreatedAt         time.Time `json:"created_at"`
	EventsThisMonth   int       `json:"events_this_month"`
	MonthResetAt      time.Time `json:"month_reset_at"`
}

type TenantStore struct {
	// contains filtered or unexported fields
}

type TokenResponse struct {
	CSRFToken string `json:"csrf_token"`
	User      *User  `json:"user"`
}

type UsageInfo struct {
	Plan        string    `json:"plan"`
	ScansUsed   int       `json:"scans_used"`
	ScansLimit  int       `json:"scans_limit"`
	Remaining   int       `json:"remaining"`
	PeriodStart time.Time `json:"period_start"`
	PeriodEnd   time.Time `json:"period_end"`
	Unlimited   bool      `json:"unlimited"`
}

type UsageTracker struct {
	// contains filtered or unexported fields
}

type User struct {
	ID            string     `json:"id"`
	Email         string     `json:"email"`
	DisplayName   string     `json:"display_name"`
	Role          string     `json:"role"` // admin, analyst, viewer
	TenantID      string     `json:"tenant_id,omitempty"`
	Active        bool       `json:"active"`
	EmailVerified bool       `json:"email_verified"`
	PasswordHash  string     `json:"-"` // never serialized
	VerifyToken   string     `json:"-"` // never serialized
	VerifyExpiry  *time.Time `json:"-"` // never serialized
	CreatedAt     time.Time  `json:"created_at"`
	LastLoginAt   *time.Time `json:"last_login_at,omitempty"`
}

type UserStore struct {
	// contains filtered or unexported fields
}