sdk

type APIError struct {
	StatusCode int
	Message    string
}

type BackupCodesResponse struct {
	BackupCodes []string `json:"backup_codes"`
}

type CreateOIDCProviderRequest struct {
	ProviderName             string   `json:"provider_name"`
	IssuerURL                string   `json:"issuer_url"`
	ClientID                 string   `json:"client_id,omitempty"`     // Optional: for manual registration
	ClientSecret             string   `json:"client_secret,omitempty"` // Optional: for manual registration
	AccessToken              string   `json:"access_token,omitempty"`  // Optional: for authenticated dynamic registration
	Scopes                   []string `json:"scopes,omitempty"`
	Enabled                  bool     `json:"enabled"`
	AllowedDomains           []string `json:"allowed_domains"`
	AutoCreateUsers          bool     `json:"auto_create_users"`
	RequireEmailVerification bool     `json:"require_email_verification"`
}

type CreateRoleRequest struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	MFARequired bool   `json:"mfa_required"`
}

type CreateUserRequest struct {
	Email   string      `json:"email"`
	RoleIDs []uuid.UUID `json:"role_ids,omitempty"` // Optional list of role IDs to assign
}

type CreateUserResponse struct {
	UserID            uuid.UUID `json:"user_id"`
	Email             string    `json:"email"`
	TenantID          uuid.UUID `json:"tenant_id"`
	VerificationToken string    `json:"verification_token"` // Empty for SSO users, set for non-SSO users
}

type DeleteOIDCProviderRequest struct {
	ProviderID uuid.UUID `json:"-"` // From URL parameter
}

type DeleteRoleRequest struct {
	RoleID uuid.UUID `json:"-"`
}

type DirectPermission struct {
	PermissionID uuid.UUID        `json:"permission_id"`
	Effect       PermissionEffect `json:"effect"`
}

type DirectPermissionsResponse struct {
	Permissions []EffectivePermission `json:"permissions"`
}

type DisableMFARequest struct {
	Password string `json:"password"`
	Code     string `json:"code"` // TOTP code or backup code
}

type EffectivePermission struct {
	Permission Permission       `json:"permission"`
	Effect     PermissionEffect `json:"effect"`
}

type EnableMFARequest struct {
	Code string `json:"code"`
}

type ErrorResponse struct {
	Error string `json:"error"`
}

type ForgotPasswordRequest struct {
	Email string `json:"email"`
}

type ForgotPasswordResponse struct {
	Message string `json:"message"`
}

type GRPCClient struct {
	// contains filtered or unexported fields
}

type GRPCClientOption func(*grpcClientConfig)

type GetDirectPermissionsRequest struct {
	UserID uuid.UUID `json:"-"`
}

type GetOIDCProviderRequest struct {
	ProviderID uuid.UUID `json:"-"` // From URL parameter
}

type GetRolePermissionsRequest struct {
	RoleID uuid.UUID `json:"-"`
}

type GetRoleRequest struct {
	RoleID uuid.UUID `json:"-"`
}

type GetUserRolesRequest struct {
	UserID uuid.UUID `json:"-"`
}

type HTTPClient struct {
	*http.Client // Embedded for direct access to http.Client methods
	// contains filtered or unexported fields
}

type HealthResponse struct {
	Status string `json:"status"`
}

type LoginRequest struct {
	Email    string `json:"email"`
	Password string `json:"password"`
}

type LoginResponse struct {
	AccessToken       string `json:"access_token,omitempty"`        // Set when login is complete
	MFAChallengeToken string `json:"mfa_challenge_token,omitempty"` // Set when MFA verification is required
	MFASetupToken     string `json:"mfa_setup_token,omitempty"`     // Set when role requires MFA but user hasn't set it up
	TokenType         string `json:"token_type,omitempty"`          // "Bearer" for access tokens, omitted for challenge/setup tokens
	ExpiresIn         int    `json:"expires_in"`                    // Seconds until access token expires (OAuth 2.0 standard)
	RefreshExpiresIn  int    `json:"refresh_expires_in,omitempty"`  // Seconds until refresh token expires (extension to standard)
}

type LogoutResponse struct {
	Message string `json:"message"`
}

type MFASetupResponse struct {
	Secret      string   `json:"secret"`
	QRCode      string   `json:"qr_code"`
	BackupCodes []string `json:"backup_codes"`
}

type MFAStatus struct {
	VerifiedAt           *time.Time `json:"verified_at,omitempty"`
	BackupCodesRemaining int        `json:"backup_codes_remaining"`
}

type OIDCAuthResponse struct {
	AuthorizationURL string `json:"authorization_url"`
}

type OIDCLoginRequest struct {
	ProviderType OIDCProviderType `json:"provider_type"`
}

type OIDCProvider struct {
	ID                       uuid.UUID              `json:"id"`
	ProviderName             string                 `json:"provider_name"`
	IssuerURL                string                 `json:"issuer_url"`
	ClientID                 string                 `json:"client_id"`
	Scopes                   []string               `json:"scopes"`
	Enabled                  bool                   `json:"enabled"`
	AllowedDomains           []string               `json:"allowed_domains"`
	AutoCreateUsers          bool                   `json:"auto_create_users"`
	RequireEmailVerification bool                   `json:"require_email_verification"`
	RegistrationMethod       OIDCRegistrationMethod `json:"registration_method"`
	ClientIDIssuedAt         *time.Time             `json:"client_id_issued_at,omitempty"`
	ClientSecretExpiresAt    *time.Time             `json:"client_secret_expires_at,omitempty"`
}

type OIDCProviderType string

type OIDCProviderTypeInfo struct {
	Type        OIDCProviderType `json:"type"`
	DisplayName string           `json:"display_name"`
}

type OIDCProviderTypesResponse struct {
	Providers []OIDCProviderTypeInfo `json:"providers"`
}

type OIDCProvidersResponse struct {
	Providers []OIDCProvider `json:"providers"`
}

type OIDCRegistrationMethod string

type Option func(*HTTPClient)

type Permission struct {
	ID          uuid.UUID `json:"id"`
	Name        string    `json:"name"`
	Description string    `json:"description"`
}

type PermissionEffect string

type PermissionsResponse struct {
	Permissions []Permission `json:"permissions"`
}

type RegenerateBackupCodesRequest struct {
	Password string `json:"password"`
}

type RegisterRequest struct {
	Email     string `json:"email"`
	FirstName string `json:"first_name"`
	LastName  string `json:"last_name"`
}

type RegisterResponse struct {
	UserID  uuid.UUID `json:"user_id"`
	Email   string    `json:"email"`
	Message string    `json:"message"`
}

type RequiredMFAEnableRequest struct {
	SetupToken string `json:"setup_token"` // Setup token from login response
	Code       string `json:"code"`        // TOTP code to verify setup
}

type RequiredMFASetupRequest struct {
	SetupToken string `json:"setup_token"` // Setup token from login response
}

type ResetPasswordRequest struct {
	Token       string `json:"token"`
	NewPassword string `json:"new_password"`
}

type ResetPasswordResponse struct {
	Message string `json:"message"`
}

type RevokeSessionRequest struct {
	SessionID uuid.UUID `json:"-"` // From URL parameter
}

type Role struct {
	ID          uuid.UUID `json:"id"`
	Name        string    `json:"name"`
	Description string    `json:"description"`
	MFARequired bool      `json:"mfa_required"`
}

type RolesResponse struct {
	Roles []Role `json:"roles"`
}

type SSOLoginRequest struct {
	Email string `json:"email"`
}

type Session struct {
	ID         uuid.UUID `json:"id"`
	UserAgent  string    `json:"user_agent"`
	IPAddress  string    `json:"ip_address"`
	CreatedAt  time.Time `json:"created_at"`
	LastUsedAt time.Time `json:"last_used_at"`
}

type SessionsResponse struct {
	Sessions []Session `json:"sessions"`
}

type SetDirectPermissionsRequest struct {
	UserID      uuid.UUID          `json:"-"`
	Permissions []DirectPermission `json:"permissions"`
}

type SetRolePermissionsRequest struct {
	RoleID        uuid.UUID   `json:"-"`
	PermissionIDs []uuid.UUID `json:"permission_ids"`
}

type SetUserRolesRequest struct {
	UserID  uuid.UUID   `json:"-"`
	RoleIDs []uuid.UUID `json:"role_ids"`
}

type UpdateOIDCProviderRequest struct {
	ProviderID               uuid.UUID `json:"-"`                                    // From URL parameter, not JSON body
	ProviderName             *string   `json:"provider_name,omitempty"`              // Optional: update display name
	ClientSecret             *string   `json:"client_secret,omitempty"`              // Optional: rotate secret
	Scopes                   []string  `json:"scopes,omitempty"`                     // Optional: nil = keep, [] = clear, non-empty = update
	Enabled                  *bool     `json:"enabled,omitempty"`                    // Optional: update enabled status
	AllowedDomains           []string  `json:"allowed_domains,omitempty"`            // Optional: nil = keep, non-nil = update
	AutoCreateUsers          *bool     `json:"auto_create_users,omitempty"`          // Optional: update auto-create users flag
	RequireEmailVerification *bool     `json:"require_email_verification,omitempty"` // Optional: update email verification requirement
}

type UpdateRoleRequest struct {
	RoleID      uuid.UUID `json:"-"`
	Name        *string   `json:"name,omitempty"`
	Description *string   `json:"description,omitempty"`
	MFARequired *bool     `json:"mfa_required,omitempty"`
}

type User struct {
	ID        uuid.UUID `json:"id"`
	TenantID  uuid.UUID `json:"tenant_id"`
	Email     string    `json:"email"`
	FirstName string    `json:"first_name"`
	LastName  string    `json:"last_name"`
	Status    string    `json:"status"`
}

type VerifyEmailRequest struct {
	Token    string `json:"token"`
	Password string `json:"password"`
}

type VerifyMFACodeRequest struct {
	ChallengeToken string `json:"challenge_token"` // Challenge token from initial login
	Code           string `json:"code"`            // TOTP code (6 digits) or backup code (8 digits)
	TrustDevice    bool   `json:"trust_device"`    // Optional: trust this device for 30 days (skip MFA on next login)
}