store

type AuditLogEntry struct {
	ID        int64
	TableName string
	Operation string // INSERT, UPDATE, DELETE
	OldData   []byte // raw JSONB; nil for INSERT
	NewData   []byte // raw JSONB; nil for DELETE
	ChangedAt time.Time
}

type AuditLogFilter struct {
	TableName string    // optional
	Operation string    // optional: INSERT, UPDATE, DELETE
	Since     time.Time // optional: only entries after this time
	Limit     int       // 0 → default 100; capped at 500
}

type AuthCode struct {
	Sub                string // internal user UUID (JWT sub)
	GitHubID           int64  // GitHub numeric ID (for logging)
	Email              string
	Scope              string
	CodeChallenge      string
	RedirectURI        string
	ClientID           string
	AccessToken        string
	RefreshToken       string
	AccessTokenExpiry  time.Time
	RefreshTokenExpiry time.Time
}

type Encryptor struct {
	// contains filtered or unexported fields
}

type Grant struct {
	JTI                string
	UserID             uuid.UUID
	OurRefreshToken    string
	ClientID           string
	Scope              string
	AccessToken        string
	RefreshToken       string
	AccessTokenExpiry  time.Time
	RefreshTokenExpiry time.Time
	JWTExpiry          time.Time
	UpdatedAt          time.Time
}

type Insight struct {
	ID        uuid.UUID
	ProjectID uuid.UUID
	Key       string // empty string when no key
	Content   string
	Tags      []string
	Category  string
	Source    string
	CreatedBy uuid.UUID
	CreatedAt time.Time
	UpdatedAt time.Time
}

type OAuthClient struct {
	ClientID                string
	ClientName              string
	RedirectURIs            []string
	GrantTypes              []string
	ResponseTypes           []string
	TokenEndpointAuthMethod string
	Scope                   string
	IssuedAt                time.Time
	ExpiresAt               time.Time
}

type Org struct {
	ID        uuid.UUID
	Slug      string
	Name      string
	Kind      string // "personal" or "shared"
	CreatedAt time.Time
}

type PendingAuth struct {
	ClientID      string
	RedirectURI   string
	Scope         string
	CodeChallenge string
	ClientState   string
}

type Project struct {
	ID        uuid.UUID
	OrgID     uuid.UUID
	CreatedBy uuid.UUID
	Slug      string
	Name      string
	CreatedAt time.Time
}

type RetiredRefreshToken struct {
	TokenHash      []byte
	Reason         string
	UserID         uuid.UUID
	ClientID       string
	OldJTI         string
	ReplacementJTI string
	GraceExpiresAt time.Time
	RetainedUntil  time.Time
	CreatedAt      time.Time
}

type Store interface {
	Ping(ctx context.Context) error
	Migrate(ctx context.Context, logger *slog.Logger) error
	Close()

	UpsertUser(ctx context.Context, githubID int64, email, login string) (*User, error)
	GetUserByGitHubID(ctx context.Context, githubID int64) (*User, error)
	GetUserByID(ctx context.Context, id uuid.UUID) (*User, error)

	GetPersonalOrgByUserID(ctx context.Context, userID uuid.UUID) (*Org, error)

	EnsureProject(ctx context.Context, orgID, createdBy uuid.UUID, slug, name string) (*Project, error)
	ListProjects(ctx context.Context, orgID uuid.UUID) ([]*Project, error)
	GetProjectBySlug(ctx context.Context, orgID uuid.UUID, slug string) (*Project, error)

	UpsertGrant(ctx context.Context, g Grant) error
	GetGrant(ctx context.Context, jti string) (*Grant, error)
	GetGrantByRefreshToken(ctx context.Context, token string) (*Grant, error)
	GetRetiredRefreshToken(ctx context.Context, tokenHash []byte) (*RetiredRefreshToken, error)
	RotateGrant(ctx context.Context, oldToken, oldJTI string, oldJWTExpiry time.Time, g Grant, retired *RetiredRefreshToken) (*Grant, error)
	DeleteGrant(ctx context.Context, jti string, retired *RetiredRefreshToken) error

	StorePendingAuth(ctx context.Context, state string, p PendingAuth) error
	ConsumePendingAuth(ctx context.Context, state string) (*PendingAuth, error)
	StoreAuthCode(ctx context.Context, code string, c AuthCode) error
	ConsumeAuthCode(ctx context.Context, code string) (*AuthCode, error)

	RevokeToken(ctx context.Context, jti string, expiresAt time.Time) error
	IsTokenRevoked(ctx context.Context, jti string) (bool, error)

	WriteInsight(ctx context.Context, p WriteInsightParams) (*Insight, error)
	UpdateInsight(ctx context.Context, p UpdateInsightParams) (*Insight, error)
	DeleteInsight(ctx context.Context, orgID, insightID uuid.UUID) error
	SearchInsights(ctx context.Context, projectID uuid.UUID, query string, tags []string, limit int) ([]*Insight, error)
	ListInsights(ctx context.Context, projectID uuid.UUID, tag string, limit int) ([]*Insight, error)
	ListTags(ctx context.Context, projectID uuid.UUID, limit int) ([]TagCount, error)

	SaveClient(ctx context.Context, c OAuthClient) error
	GetClient(ctx context.Context, clientID string) (*OAuthClient, error)

	ListAuditLog(ctx context.Context, filter AuditLogFilter) ([]*AuditLogEntry, error)
}

type TagCount struct {
	Name  string
	Count int
}

type UpdateInsightParams struct {
	OrgID     uuid.UUID
	InsightID uuid.UUID
	Content   string
	Tags      []string
}

type User struct {
	ID        uuid.UUID
	GitHubID  int64
	Email     string
	Login     string
	CreatedAt time.Time
	UpdatedAt time.Time
}

type WriteInsightParams struct {
	ProjectID uuid.UUID
	Key       string // empty = no stable key
	Content   string
	Tags      []string
	Category  string
	Source    string
	CreatedBy uuid.UUID
}