auth

type AWSAuthProvider struct {
	// contains filtered or unexported fields
}

type AWSCredentials struct {
	AccessKeyID     string
	SecretAccessKey string
	SessionToken    string
}

type AWSUserCache struct {
	Info        *entities.AWSUserInfo
	Role        string
	Permissions []string
	EnvFile     string
}

type AuthorizationContext struct {
	// User information
	User *entities.User

	// Personal scope permissions
	PersonalScope PersonalScopeAuth

	// Team scope permissions
	TeamScope TeamScopeAuth
}

type GitHubAuthProvider struct {
	// contains filtered or unexported fields
}

type GitHubOAuthProvider struct {
	// contains filtered or unexported fields
}

type GitHubOrganization struct {
	Login string `json:"login"`
	ID    int64  `json:"id"`
}

type GitHubTeamMembership struct {
	Organization string `json:"organization"`
	TeamSlug     string `json:"team_slug"`
	TeamName     string `json:"team_name"`
	Role         string `json:"role"`
}

type GitHubUserInfo struct {
	Login         string                 `json:"login"`
	ID            int64                  `json:"id"`
	Email         string                 `json:"email"`
	Name          string                 `json:"name"`
	Organizations []GitHubOrganization   `json:"organizations"`
	Teams         []GitHubTeamMembership `json:"teams"`
}

type OAuthState struct {
	State       string    `json:"state"`
	RedirectURI string    `json:"redirect_uri"`
	CreatedAt   time.Time `json:"created_at"`
}

type OAuthTokenResponse struct {
	AccessToken string `json:"access_token"`
	TokenType   string `json:"token_type"`
	Scope       string `json:"scope"`
}

type PersonalScopeAuth struct {
	// UserID of the authenticated user
	UserID string

	// CanCreate indicates if the user can create personal-scoped resources
	CanCreate bool

	// CanRead indicates if the user can read their own personal-scoped resources
	CanRead bool

	// CanUpdate indicates if the user can update their own personal-scoped resources
	CanUpdate bool

	// CanDelete indicates if the user can delete their own personal-scoped resources
	CanDelete bool
}

type TeamMappingRepository interface {
	// Get retrieves the team memberships for a given username.
	// Returns the memberships, true if found, and any error.
	Get(ctx context.Context, username string) ([]GitHubTeamMembership, bool, error)

	// Set stores the team memberships for a given username.
	Set(ctx context.Context, username string, teams []GitHubTeamMembership) error
}

type TeamPermissions struct {
	// TeamID in format "org/team-slug"
	TeamID string

	// CanCreate indicates if the user can create resources in this team
	CanCreate bool

	// CanRead indicates if the user can read resources in this team
	CanRead bool

	// CanUpdate indicates if the user can update resources in this team
	CanUpdate bool

	// CanDelete indicates if the user can delete resources in this team
	CanDelete bool
}

type TeamScopeAuth struct {
	// Teams is a list of team IDs the user belongs to (format: "org/team-slug")
	Teams []string

	// TeamPermissions maps team IDs to their permissions
	TeamPermissions map[string]TeamPermissions

	// IsAdmin indicates if the user is an admin (can access all teams)
	IsAdmin bool
}

type UserCache struct {
	User        *GitHubUserInfo
	Role        string
	Permissions []string
	EnvFile     string
}

type UserContext struct {
	UserID      string
	Role        string
	Permissions []string
	APIKey      string
	AuthType    string          // "api_key" or "github_oauth"
	GitHubUser  *GitHubUserInfo // GitHub user info when using GitHub auth
	AccessToken string          // OAuth access token (not serialized)
	EnvFile     string          // Path to team-specific environment file
}