account

type Argon2Params struct {
	Memory      uint32 // Memory in KiB (default: 64*1024 = 64 MiB)
	Iterations  uint32 // Time cost (default: 3)
	Parallelism uint8  // Parallelism factor (default: 2)
	SaltLength  uint32 // Salt length in bytes (default: 16)
	KeyLength   uint32 // Derived key length in bytes (default: 32)
}

type BreachChecker struct {
	// contains filtered or unexported fields
}

type LockedError struct {
	Until time.Time
}

type MemoryPasswordHistoryStore struct {
	// contains filtered or unexported fields
}

type PasswordHistoryEntry struct {
	ID        string    `json:"id"`
	UserID    id.UserID `json:"user_id"`
	Hash      string    `json:"-"`
	CreatedAt time.Time `json:"created_at"`
}

type PasswordHistoryStore interface {
	// SavePasswordHash records a new password hash for the user.
	SavePasswordHash(ctx context.Context, userID id.UserID, hash string) error

	// GetPasswordHistory returns the most recent N password hashes.
	GetPasswordHistory(ctx context.Context, userID id.UserID, limit int) ([]PasswordHistoryEntry, error)
}

type PasswordPolicy struct {
	MinLength        int
	RequireUppercase bool
	RequireLowercase bool
	RequireDigit     bool
	RequireSpecial   bool
	BcryptCost       int
	Algorithm        string       // "bcrypt" (default) or "argon2id"
	Argon2Params     Argon2Params // Used when Algorithm = "argon2id"
	CheckBreached    bool         // Enable HIBP breach checking
}

type PasswordReset struct {
	ID        id.PasswordResetID `json:"id"`
	AppID     id.AppID           `json:"app_id"`
	EnvID     id.EnvironmentID   `json:"env_id"`
	UserID    id.UserID          `json:"user_id"`
	Token     string             `json:"-"`
	TokenHash string             `json:"-"`
	ExpiresAt time.Time          `json:"expires_at"`
	Consumed  bool               `json:"consumed"`
	CreatedAt time.Time          `json:"created_at"`
}

type SessionConfig struct {
	TokenTTL           time.Duration
	RefreshTokenTTL    time.Duration
	MaxActiveSessions  int
	RotateRefreshToken bool

	// TokenExchangeTTL caps tokens minted by the RFC 8693 token exchange
	// grant. Short by design: an exchanged token is meant to be re-minted,
	// not held. Zero means the caller's own default applies.
	TokenExchangeTTL time.Duration
}

type SignInRequest struct {
	AppID     id.AppID         `json:"app_id"`
	EnvID     id.EnvironmentID `json:"env_id"`
	Email     string           `json:"email,omitempty"`
	Username  string           `json:"username,omitempty"`
	Password  string           `json:"password"`
	IPAddress string           `json:"ip_address,omitempty"`
	UserAgent string           `json:"user_agent,omitempty"`

	// DPoPJKT binds the issued session to a client-held key (RFC 9449).
	// Empty issues an ordinary unbound session.
	DPoPJKT string `json:"-"`
}

type SignUpRequest struct {
	AppID     id.AppID          `json:"app_id"`
	EnvID     id.EnvironmentID  `json:"env_id"`
	Email     string            `json:"email"`
	Password  string            `json:"password"`
	FirstName string            `json:"first_name,omitempty"`
	LastName  string            `json:"last_name,omitempty"`
	Username  string            `json:"username,omitempty"`
	Metadata  map[string]string `json:"metadata,omitempty"` // custom form fields
	IPAddress string            `json:"ip_address,omitempty"`
	UserAgent string            `json:"user_agent,omitempty"`

	// DPoPJKT binds the newly created session to a client-held key
	// (RFC 9449). Empty issues an ordinary unbound session.
	DPoPJKT string `json:"-"`
}

type Store interface {
	CreateVerification(ctx context.Context, v *Verification) error
	GetVerification(ctx context.Context, token string) (*Verification, error)
	ConsumeVerification(ctx context.Context, token string) error

	// GetActiveEmailVerification returns the most recent unconsumed, unexpired
	// email verification for the user, or ErrNotFound. The OTP flow looks up by
	// user (codes are short and not globally unique) rather than by token.
	GetActiveEmailVerification(ctx context.Context, userID id.UserID) (*Verification, error)

	// UpdateVerification persists mutable fields of an existing verification
	// (Attempts, Consumed).
	UpdateVerification(ctx context.Context, v *Verification) error

	CreatePasswordReset(ctx context.Context, pr *PasswordReset) error
	GetPasswordReset(ctx context.Context, token string) (*PasswordReset, error)
	ConsumePasswordReset(ctx context.Context, token string) error
}

type Verification struct {
	ID     id.VerificationID `json:"id"`
	AppID  id.AppID          `json:"app_id"`
	EnvID  id.EnvironmentID  `json:"env_id"`
	UserID id.UserID         `json:"user_id"`
	// Token is the plaintext, present on the way into the store and on a
	// verification looked up by that plaintext. TokenHash is what the store
	// keeps; a verification read back by user carries only the hash.
	Token     string           `json:"-"`
	TokenHash string           `json:"-"`
	Type      VerificationType `json:"type"`
	Attempts  int              `json:"attempts"`
	ExpiresAt time.Time        `json:"expires_at"`
	Consumed  bool             `json:"consumed"`
	CreatedAt time.Time        `json:"created_at"`
}

type VerificationType string