extension

type AppSessionConfigYAML struct {
	Session AppSessionYAML `json:"session" mapstructure:"session" yaml:"session"`
}

type AppSessionYAML struct {
	TokenTTL           time.Duration `json:"token_ttl" mapstructure:"token_ttl" yaml:"token_ttl"`
	RefreshTokenTTL    time.Duration `json:"refresh_token_ttl" mapstructure:"refresh_token_ttl" yaml:"refresh_token_ttl"`
	MaxActiveSessions  *int          `json:"max_active_sessions" mapstructure:"max_active_sessions" yaml:"max_active_sessions"`
	RotateRefreshToken *bool         `json:"rotate_refresh_token" mapstructure:"rotate_refresh_token" yaml:"rotate_refresh_token"`
	BindToIP           *bool         `json:"bind_to_ip" mapstructure:"bind_to_ip" yaml:"bind_to_ip"`
	BindToDevice       *bool         `json:"bind_to_device" mapstructure:"bind_to_device" yaml:"bind_to_device"`
	TokenFormat        string        `json:"token_format" mapstructure:"token_format" yaml:"token_format"`
}

type Argon2Config struct {
	Memory      uint32 `json:"memory" mapstructure:"memory" yaml:"memory"`
	Iterations  uint32 `json:"iterations" mapstructure:"iterations" yaml:"iterations"`
	Parallelism uint8  `json:"parallelism" mapstructure:"parallelism" yaml:"parallelism"`
	SaltLength  uint32 `json:"salt_length" mapstructure:"salt_length" yaml:"salt_length"`
	KeyLength   uint32 `json:"key_length" mapstructure:"key_length" yaml:"key_length"`
}

type BootstrapEnvYAML struct {
	Name      string `json:"name" mapstructure:"name" yaml:"name"`
	Slug      string `json:"slug" mapstructure:"slug" yaml:"slug"`
	Type      string `json:"type" mapstructure:"type" yaml:"type"` // development, staging, production
	IsDefault bool   `json:"is_default" mapstructure:"is_default" yaml:"is_default"`
}

type BootstrapYAMLConfig struct {
	// Enabled controls whether bootstrap runs on start. Default: true when using extension.
	Enabled *bool `json:"enabled" mapstructure:"enabled" yaml:"enabled"`

	// AppName is the platform app display name (default: "Platform").
	AppName string `json:"app_name" mapstructure:"app_name" yaml:"app_name"`

	// AppSlug is the platform app slug (default: "platform").
	AppSlug string `json:"app_slug" mapstructure:"app_slug" yaml:"app_slug"`

	// AppLogo is an optional logo URL for the platform app.
	AppLogo string `json:"app_logo" mapstructure:"app_logo" yaml:"app_logo"`

	// SkipDefaultEnvs disables automatic environment creation.
	SkipDefaultEnvs bool `json:"skip_default_envs" mapstructure:"skip_default_envs" yaml:"skip_default_envs"`

	// SkipDefaultRoles disables automatic role creation.
	SkipDefaultRoles bool `json:"skip_default_roles" mapstructure:"skip_default_roles" yaml:"skip_default_roles"`

	// Environments overrides the default environments to create.
	Environments []BootstrapEnvYAML `json:"environments" mapstructure:"environments" yaml:"environments"`

	// WardenDir, when set, replaces authsome's embedded warden DSL files
	// (bootstrap/warden/embed/) with .warden files loaded from this
	// directory. The directory must contain a `shared/` subtree applied to
	// every app; a `platform/` subtree is consulted only for the platform
	// app and is optional. Use this to ship custom roles + permission
	// catalogs without rebuilding the binary.
	WardenDir string `json:"warden_dir" mapstructure:"warden_dir" yaml:"warden_dir"`

	// InitialOwners is a list of email addresses that should automatically
	// receive the platform-owner role on sign-up, regardless of whether they
	// are the first user. Comparison is case-insensitive.
	InitialOwners []string `json:"initial_owners" mapstructure:"initial_owners" yaml:"initial_owners"`

	// InitialOwnerCount sets how many of the first N users to register are
	// automatically promoted to platform-owner. Defaults to 3. Set to 1 for
	// the original single-owner behaviour; set to 0 to disable.
	InitialOwnerCount int `json:"initial_owner_count" mapstructure:"initial_owner_count" yaml:"initial_owner_count"`
}

type CSRFConfig struct {
	Enabled        *bool    `json:"enabled,omitempty" mapstructure:"enabled" yaml:"enabled,omitempty"`
	AllowedOrigins []string `json:"allowed_origins" mapstructure:"allowed_origins" yaml:"allowed_origins"`
}

type Config struct {
	// DisableRoutes prevents HTTP route registration.
	DisableRoutes bool `json:"disable_routes" mapstructure:"disable_routes" yaml:"disable_routes"`

	// DisableMigrate prevents auto-migration on start.
	DisableMigrate bool `json:"disable_migrate" mapstructure:"disable_migrate" yaml:"disable_migrate"`

	// BasePath is the URL prefix for all auth routes (default: "/authsome").
	BasePath string `json:"base_path" mapstructure:"base_path" yaml:"base_path"`

	// Debug enables verbose logging of all operations.
	Debug bool `json:"debug" mapstructure:"debug" yaml:"debug"`

	// ProtectedResourceMetadataURL is the RFC 9728 metadata URL advertised in
	// the WWW-Authenticate header on 401 responses. Threaded into the engine
	// config in buildEngineConfig the same way BasePath is; extension mode is
	// the only mode that serves the RFC 9728 document (via
	// RootRouteProviders), so this is the field that has to reach the engine
	// for the hint to work end to end.
	ProtectedResourceMetadataURL string `json:"protected_resource_metadata_url" mapstructure:"protected_resource_metadata_url" yaml:"protected_resource_metadata_url"`

	// Session configuration.
	Session SessionConfig `json:"session" mapstructure:"session" yaml:"session"`

	// Password policy configuration.
	Password PasswordConfig `json:"password" mapstructure:"password" yaml:"password"`

	// Rate limiting per endpoint.
	RateLimit RateLimitConfig `json:"rate_limit" mapstructure:"rate_limit" yaml:"rate_limit"`

	// Account lockout after failed attempts.
	Lockout LockoutConfig `json:"lockout" mapstructure:"lockout" yaml:"lockout"`

	// Retention sets how long expired rows are kept before the sweeper
	// removes them. Zero values take the engine defaults.
	Retention RetentionConfig `json:"retention" mapstructure:"retention" yaml:"retention"`

	// Webhooks governs webhook URL checks; see authsome.WebhookConfig.
	Webhooks WebhookConfig `json:"webhooks" mapstructure:"webhooks" yaml:"webhooks"`

	// CSRF governs the cross-site check on cookie sessions; see authsome.CSRFConfig.
	CSRF CSRFConfig `json:"csrf" mapstructure:"csrf" yaml:"csrf"`

	// Mailer configuration for transactional email delivery.
	Mailer MailerConfig `json:"mailer" mapstructure:"mailer" yaml:"mailer"`

	// GroveDatabase is the name of a grove.DB registered in the DI container.
	// When set, the extension resolves this named database and auto-constructs
	// the appropriate store based on the driver type (pg/sqlite/mongo).
	// When empty and WithGroveDatabase was called, the default (unnamed) DB is used.
	GroveDatabase string `json:"grove_database" mapstructure:"grove_database" yaml:"grove_database"`

	// Apps holds per-app session configuration overrides.
	// Keys are app IDs (e.g., "mobile-app", "web-dashboard").
	Apps map[string]AppSessionConfigYAML `json:"apps" mapstructure:"apps" yaml:"apps"`

	// Bootstrap configures automatic platform app setup on first start.
	Bootstrap BootstrapYAMLConfig `json:"bootstrap" mapstructure:"bootstrap" yaml:"bootstrap"`

	// RequireConfig requires config to be present in YAML files.
	// If true and no config is found, Register returns an error.
	RequireConfig bool `json:"-" yaml:"-"`

	// ClientMode delegates all auth operations to a remote authsome server.
	// When true, no local engine is created and no database is required.
	// Token validation uses the /v1/introspect endpoint on the remote server.
	ClientMode bool `json:"client_mode" mapstructure:"client_mode" yaml:"client_mode"`

	// PortalURL is the base URL of the remote authsome server (e.g. "http://portal:7901").
	// Required when ClientMode is true.
	PortalURL string `json:"portal_url" mapstructure:"portal_url" yaml:"portal_url"`

	// ServiceAPIKey authenticates this service with the remote authsome server
	// for service-to-service operations (e.g. org creation during bootstrap).
	ServiceAPIKey string `json:"service_api_key" mapstructure:"service_api_key" yaml:"service_api_key"`

	// ClientAutoRefreshDisabled turns off the client-mode session refresh that
	// ClientAutoRefreshMiddleware performs. Refresh is ON by default, matching
	// the session.auto_refresh_enabled default engine mode resolves from
	// settings — a client-mode service has no settings cascade to read, so the
	// default lives here instead.
	//
	// Turn it off only when something else owns refresh for this service (an
	// edge proxy rotating the cookie, say). With it off and nothing else doing
	// the work, cookie sessions expire at the access token's TTL no matter how
	// active the user is.
	ClientAutoRefreshDisabled bool `json:"client_auto_refresh_disabled" mapstructure:"client_auto_refresh_disabled" yaml:"client_auto_refresh_disabled"`

	// ClientAutoRefreshThreshold is how long before expiry a client-mode
	// session is rotated. Zero means five minutes, matching the
	// session.auto_refresh_threshold_seconds default.
	ClientAutoRefreshThreshold time.Duration `json:"client_auto_refresh_threshold" mapstructure:"client_auto_refresh_threshold" yaml:"client_auto_refresh_threshold"`

	// ServiceAppID is the App ID the service binds to. Stamped as
	// X-App-ID on every authclient request. Required by the API key
	// auth strategy and App-scoped admin endpoints; without it,
	// admin calls with the service API key return 401.
	ServiceAppID string `json:"service_app_id" mapstructure:"service_app_id" yaml:"service_app_id"`

	// Dashboard configures how authsome surfaces inside the Forge
	// dashboard's contract path: branding on the /login page, links to
	// terms/privacy/signup, and the optional required-role gate that
	// keeps the dashboard locked down to specific user populations.
	Dashboard DashboardIntegrationConfig `json:"dashboard" mapstructure:"dashboard" yaml:"dashboard"`
}

type DashboardIntegrationConfig struct {
	// Brand overrides the displayed name on the /login page. Defaults to
	// the platform app's Name when empty.
	Brand string `json:"brand" mapstructure:"brand" yaml:"brand"`

	// BrandLogoURL overrides the logo image URL. Defaults to App.Logo.
	BrandLogoURL string `json:"brand_logo_url" mapstructure:"brand_logo_url" yaml:"brand_logo_url"`

	// SignupURL is the public-facing path the "Don't have an account?
	// Sign up" link points to. Empty hides the line.
	SignupURL string `json:"signup_url" mapstructure:"signup_url" yaml:"signup_url"`

	// SignupLabel overrides the link label.
	SignupLabel string `json:"signup_label" mapstructure:"signup_label" yaml:"signup_label"`

	// TermsURL / PrivacyURL feed the legal footer beneath the form.
	TermsURL   string `json:"terms_url" mapstructure:"terms_url" yaml:"terms_url"`
	PrivacyURL string `json:"privacy_url" mapstructure:"privacy_url" yaml:"privacy_url"`

	// SocialBasePath overrides the URL prefix for OAuth start endpoints.
	// Defaults to "/v1/social" matching the social plugin's default.
	SocialBasePath string `json:"social_base_path" mapstructure:"social_base_path" yaml:"social_base_path"`

	// RequiredRoles, when non-empty, restricts dashboard access to users
	// carrying at least one of the listed roles. Authsome calls
	// dashExt.SetRequiredRoles in RegisterDashboardAuth so the principal
	// endpoint returns 403 PERMISSION_DENIED for anyone without them and
	// the React shell renders an "access denied" panel.
	RequiredRoles []string `json:"required_roles" mapstructure:"required_roles" yaml:"required_roles"`
}

type ExtOption func(*Extension)

type Extension struct {
	*forge.BaseExtension
	// contains filtered or unexported fields
}

type LockoutConfig struct {
	// Enabled turns account lockout on or off. Unset means on: an explicit
	// false is the only way to switch lockout off.
	Enabled *bool `json:"enabled,omitempty" mapstructure:"enabled" yaml:"enabled,omitempty"`

	// MaxAttempts is the number of failed attempts before lockout (default: 5).
	MaxAttempts int `json:"max_attempts" mapstructure:"max_attempts" yaml:"max_attempts"`

	// LockoutDurationSeconds is the lockout duration in seconds (default: 900 = 15 min).
	LockoutDurationSeconds int `json:"lockout_duration_seconds" mapstructure:"lockout_duration_seconds" yaml:"lockout_duration_seconds"`

	// ResetAfterSeconds resets the failure count after this many seconds of no failures (default: 3600 = 1h).
	ResetAfterSeconds int `json:"reset_after_seconds" mapstructure:"reset_after_seconds" yaml:"reset_after_seconds"`
}

type MailerConfig struct {
	// Provider is the email provider ("resend", "smtp", or "noop"). Default: "noop".
	Provider string `json:"provider" mapstructure:"provider" yaml:"provider"`

	// Resend configuration (used when Provider = "resend").
	Resend ResendConfig `json:"resend" mapstructure:"resend" yaml:"resend"`

	// SMTP configuration (used when Provider = "smtp").
	SMTP SMTPConfig `json:"smtp" mapstructure:"smtp" yaml:"smtp"`
}

type PasswordConfig struct {
	// MinLength is the minimum password length (default: 12).
	MinLength int `json:"min_length" mapstructure:"min_length" yaml:"min_length"`

	// RequireUppercase requires at least one uppercase letter.
	RequireUppercase bool `json:"require_uppercase" mapstructure:"require_uppercase" yaml:"require_uppercase"`

	// RequireLowercase requires at least one lowercase letter.
	RequireLowercase bool `json:"require_lowercase" mapstructure:"require_lowercase" yaml:"require_lowercase"`

	// RequireDigit requires at least one digit.
	RequireDigit bool `json:"require_digit" mapstructure:"require_digit" yaml:"require_digit"`

	// RequireSpecial requires at least one special character.
	RequireSpecial bool `json:"require_special" mapstructure:"require_special" yaml:"require_special"`

	// BcryptCost is the bcrypt cost factor (default: 12).
	BcryptCost int `json:"bcrypt_cost" mapstructure:"bcrypt_cost" yaml:"bcrypt_cost"`

	// Algorithm is the password hashing algorithm ("bcrypt" or "argon2id"). Default: "bcrypt".
	Algorithm string `json:"algorithm" mapstructure:"algorithm" yaml:"algorithm"`

	// Argon2 holds parameters for Argon2id hashing.
	Argon2 Argon2Config `json:"argon2" mapstructure:"argon2" yaml:"argon2"`

	// CheckBreached enables HaveIBeenPwned breach checking. Default: false.
	CheckBreached bool `json:"check_breached" mapstructure:"check_breached" yaml:"check_breached"`
}

type RateLimitConfig struct {
	// Enabled turns rate limiting on or off. Unset means on: an explicit
	// false is the only way to switch the limits off.
	Enabled *bool `json:"enabled,omitempty" mapstructure:"enabled" yaml:"enabled,omitempty"`

	// FailOpen lets requests through when the limiter itself fails. Off by
	// default: a limiter outage answers 503.
	FailOpen bool `json:"fail_open" mapstructure:"fail_open" yaml:"fail_open"`

	// ResetPasswordLimit caps reset-password submissions per window (default: 5).
	ResetPasswordLimit int `json:"reset_password_limit" mapstructure:"reset_password_limit" yaml:"reset_password_limit"`

	// ChangePasswordLimit caps change-password submissions per window (default: 5).
	ChangePasswordLimit int `json:"change_password_limit" mapstructure:"change_password_limit" yaml:"change_password_limit"`

	// OAuthTokenLimit caps OAuth2 token, revoke and device requests per window (default: 30).
	OAuthTokenLimit int `json:"oauth_token_limit" mapstructure:"oauth_token_limit" yaml:"oauth_token_limit"`

	// OAuthAuthorizeLimit caps OAuth2 authorize requests per window (default: 30).
	OAuthAuthorizeLimit int `json:"oauth_authorize_limit" mapstructure:"oauth_authorize_limit" yaml:"oauth_authorize_limit"`

	// PasskeyLimit caps passkey ceremonies per window (default: 10).
	PasskeyLimit int `json:"passkey_limit" mapstructure:"passkey_limit" yaml:"passkey_limit"`

	// SSOLimit caps public SSO requests per window (default: 20).
	SSOLimit int `json:"sso_limit" mapstructure:"sso_limit" yaml:"sso_limit"`

	// SCIMLimit caps SCIM requests per window (default: 60).
	SCIMLimit int `json:"scim_limit" mapstructure:"scim_limit" yaml:"scim_limit"`

	// WaitlistJoinLimit caps waitlist joins per window (default: 5).
	WaitlistJoinLimit int `json:"waitlist_join_limit" mapstructure:"waitlist_join_limit" yaml:"waitlist_join_limit"`

	// APIKeyFailureLimit caps failed API-key authentications per address per window (default: 20).
	APIKeyFailureLimit int `json:"api_key_failure_limit" mapstructure:"api_key_failure_limit" yaml:"api_key_failure_limit"`

	// SignInLimit is the max sign-in attempts per window (default: 5).
	SignInLimit int `json:"signin_limit" mapstructure:"signin_limit" yaml:"signin_limit"`

	// SignUpLimit is the max sign-up attempts per window (default: 3).
	SignUpLimit int `json:"signup_limit" mapstructure:"signup_limit" yaml:"signup_limit"`

	// ForgotPasswordLimit is the max forgot-password attempts per window (default: 3).
	ForgotPasswordLimit int `json:"forgot_password_limit" mapstructure:"forgot_password_limit" yaml:"forgot_password_limit"`

	// MFAChallengeLimit is the max MFA challenge attempts per window (default: 5).
	MFAChallengeLimit int `json:"mfa_challenge_limit" mapstructure:"mfa_challenge_limit" yaml:"mfa_challenge_limit"`

	// WindowSeconds is the sliding window duration in seconds (default: 60).
	WindowSeconds int `json:"window_seconds" mapstructure:"window_seconds" yaml:"window_seconds"`
}

type ResendConfig struct {
	APIKey string `json:"api_key" mapstructure:"api_key" yaml:"api_key"`
	From   string `json:"from" mapstructure:"from" yaml:"from"`
}

type RetentionConfig struct {
	SessionsDays             int `json:"sessions_days" mapstructure:"sessions_days" yaml:"sessions_days"`
	VerificationsDays        int `json:"verifications_days" mapstructure:"verifications_days" yaml:"verifications_days"`
	PasswordResetsDays       int `json:"password_resets_days" mapstructure:"password_resets_days" yaml:"password_resets_days"`
	RevokedRefreshTokensDays int `json:"revoked_refresh_tokens_days" mapstructure:"revoked_refresh_tokens_days" yaml:"revoked_refresh_tokens_days"`
	DeviceCodesDays          int `json:"device_codes_days" mapstructure:"device_codes_days" yaml:"device_codes_days"`
	AuthCodesDays            int `json:"auth_codes_days" mapstructure:"auth_codes_days" yaml:"auth_codes_days"`
	BatchSize                int `json:"batch_size" mapstructure:"batch_size" yaml:"batch_size"`
}

type SMTPConfig struct {
	Host     string `json:"host" mapstructure:"host" yaml:"host"`
	Port     string `json:"port" mapstructure:"port" yaml:"port"`
	Username string `json:"username" mapstructure:"username" yaml:"username"`
	Password string `json:"password" mapstructure:"password" yaml:"password"`
	From     string `json:"from" mapstructure:"from" yaml:"from"`
	TLS      bool   `json:"tls" mapstructure:"tls" yaml:"tls"`
}

type SessionConfig struct {
	// TokenTTL is the lifetime of session tokens (default: 1h).
	TokenTTL time.Duration `json:"token_ttl" mapstructure:"token_ttl" yaml:"token_ttl"`

	// RefreshTokenTTL is the lifetime of refresh tokens (default: 30d).
	RefreshTokenTTL time.Duration `json:"refresh_token_ttl" mapstructure:"refresh_token_ttl" yaml:"refresh_token_ttl"`

	// MaxActiveSessions is the maximum number of concurrent sessions per user (0 = unlimited).
	MaxActiveSessions int `json:"max_active_sessions" mapstructure:"max_active_sessions" yaml:"max_active_sessions"`

	// RotateRefreshToken controls whether refresh operations issue a new
	// refresh token (invalidating the old one). Default: true.
	RotateRefreshToken *bool `json:"rotate_refresh_token" mapstructure:"rotate_refresh_token" yaml:"rotate_refresh_token"`

	// CleanupInterval is how often the retention sweeper runs (default: 1h).
	// A negative value disables it.
	CleanupInterval time.Duration `json:"cleanup_interval" mapstructure:"cleanup_interval" yaml:"cleanup_interval"`
}

type WebhookConfig struct {
	AllowInsecureURLs bool          `json:"allow_insecure_urls" mapstructure:"allow_insecure_urls" yaml:"allow_insecure_urls"`
	VerifyTimeout     time.Duration `json:"verify_timeout" mapstructure:"verify_timeout" yaml:"verify_timeout"`
}