postgres

type APIKeyModel struct {
	grove.BaseModel `grove:"table:authsome_api_keys,alias:ak"`

	ID               string         `grove:"id,pk"`
	AppID            string         `grove:"app_id,notnull"`
	EnvID            string         `grove:"env_id,notnull"`
	UserID           sql.NullString `grove:"user_id"`
	ServiceAccountID sql.NullString `grove:"service_account_id"`
	Name             string         `grove:"name,notnull"`
	KeyHash          string         `grove:"key_hash,notnull"`
	KeyPrefix        string         `grove:"key_prefix,notnull"`
	PublicKey        string         `grove:"public_key,notnull"`
	PublicKeyPrefix  string         `grove:"public_key_prefix,notnull"`
	Scopes           string         `grove:"scopes"` // comma-separated
	ExpiresAt        sql.NullTime   `grove:"expires_at"`
	LastUsedAt       sql.NullTime   `grove:"last_used_at"`
	Revoked          bool           `grove:"revoked"`
	CreatedAt        time.Time      `grove:"created_at,notnull,default:now()"`
	UpdatedAt        time.Time      `grove:"updated_at,notnull,default:now()"`
}

type AppClientConfigModel struct {
	grove.BaseModel `grove:"table:authsome_app_client_configs,alias:acc"`

	ID                       string          `grove:"id,pk"`
	AppID                    string          `grove:"app_id,notnull"`
	SignupEnabled            *bool           `grove:"signup_enabled"`
	PasswordEnabled          *bool           `grove:"password_enabled"`
	PasskeyEnabled           *bool           `grove:"passkey_enabled"`
	MagicLinkEnabled         *bool           `grove:"magic_link_enabled"`
	MFAEnabled               *bool           `grove:"mfa_enabled"`
	MFARequired              *bool           `grove:"mfa_required"`
	SSOEnabled               *bool           `grove:"sso_enabled"`
	SocialEnabled            *bool           `grove:"social_enabled"`
	WaitlistEnabled          *bool           `grove:"waitlist_enabled"`
	RequireEmailVerification *bool           `grove:"require_email_verification"`
	SocialProviders          json.RawMessage `grove:"social_providers,type:jsonb"`
	MFAMethods               json.RawMessage `grove:"mfa_methods,type:jsonb"`
	AppName                  *string         `grove:"app_name"`
	LogoURL                  *string         `grove:"logo_url"`
	CreatedAt                time.Time       `grove:"created_at,notnull,default:now()"`
	UpdatedAt                time.Time       `grove:"updated_at,notnull,default:now()"`
}

type AppModel struct {
	grove.BaseModel `grove:"table:authsome_apps,alias:a"`

	ID             string          `grove:"id,pk"`
	Name           string          `grove:"name,notnull"`
	Slug           string          `grove:"slug,notnull"`
	Logo           string          `grove:"logo"`
	PublishableKey string          `grove:"publishable_key"`
	IsPlatform     bool            `grove:"is_platform"`
	Metadata       json.RawMessage `grove:"metadata,type:jsonb"`
	CreatedAt      time.Time       `grove:"created_at,notnull,default:now()"`
	UpdatedAt      time.Time       `grove:"updated_at,notnull,default:now()"`
}

type AppSessionConfigModel struct {
	grove.BaseModel `grove:"table:authsome_app_session_configs,alias:asc"`

	ID                     string        `grove:"id,pk"`
	AppID                  string        `grove:"app_id,notnull"`
	TokenTTLSeconds        sql.NullInt64 `grove:"token_ttl_seconds"`
	RefreshTokenTTLSeconds sql.NullInt64 `grove:"refresh_token_ttl_seconds"`
	MaxActiveSessions      sql.NullInt64 `grove:"max_active_sessions"`
	RotateRefreshToken     sql.NullBool  `grove:"rotate_refresh_token"`
	BindToIP               sql.NullBool  `grove:"bind_to_ip"`
	BindToDevice           sql.NullBool  `grove:"bind_to_device"`
	TokenFormat            string        `grove:"token_format"`
	CreatedAt              time.Time     `grove:"created_at,notnull,default:now()"`
	UpdatedAt              time.Time     `grove:"updated_at,notnull,default:now()"`
}

type BrandingConfigModel struct {
	grove.BaseModel `grove:"table:authsome_branding_configs,alias:bc"`

	ID              string    `grove:"id,pk"`
	OrgID           string    `grove:"org_id,notnull"`
	AppID           string    `grove:"app_id,notnull"`
	LogoURL         string    `grove:"logo_url"`
	PrimaryColor    string    `grove:"primary_color"`
	BackgroundColor string    `grove:"background_color"`
	AccentColor     string    `grove:"accent_color"`
	FontFamily      string    `grove:"font_family"`
	CustomCSS       string    `grove:"custom_css"`
	CompanyName     string    `grove:"company_name"`
	Tagline         string    `grove:"tagline"`
	CreatedAt       time.Time `grove:"created_at,notnull,default:now()"`
	UpdatedAt       time.Time `grove:"updated_at,notnull,default:now()"`
}

type DelegationModel struct {
	grove.BaseModel `grove:"table:authsome_delegations,alias:dl"`

	ID            string          `grove:"id,pk"`
	AppID         string          `grove:"app_id,notnull"`
	OrgID         string          `grove:"org_id"`
	ActorKind     string          `grove:"actor_kind,notnull"`
	ActorID       string          `grove:"actor_id,notnull"`
	SubjectKind   string          `grove:"subject_kind,notnull"`
	SubjectID     string          `grove:"subject_id,notnull"`
	GrantKind     string          `grove:"grant_kind,notnull"`
	Scopes        json.RawMessage `grove:"scopes,type:jsonb"`
	GrantedByKind string          `grove:"granted_by_kind"`
	GrantedByID   string          `grove:"granted_by_id"`
	ExpiresAt     *time.Time      `grove:"expires_at"`
	RevokedAt     *time.Time      `grove:"revoked_at"`
	CreatedAt     time.Time       `grove:"created_at,notnull,default:now()"`
	UpdatedAt     time.Time       `grove:"updated_at,notnull,default:now()"`
}

type DeviceModel struct {
	grove.BaseModel `grove:"table:authsome_devices,alias:d"`

	ID          string    `grove:"id,pk"`
	UserID      string    `grove:"user_id,notnull"`
	AppID       string    `grove:"app_id,notnull"`
	EnvID       string    `grove:"env_id,notnull"`
	Name        string    `grove:"name"`
	Type        string    `grove:"type"`
	Browser     string    `grove:"browser"`
	OS          string    `grove:"os"`
	IPAddress   string    `grove:"ip_address"`
	Fingerprint string    `grove:"fingerprint"`
	Trusted     bool      `grove:"trusted"`
	LastSeenAt  time.Time `grove:"last_seen_at,notnull,default:now()"`
	CreatedAt   time.Time `grove:"created_at,notnull,default:now()"`
	UpdatedAt   time.Time `grove:"updated_at,notnull,default:now()"`
}

type EnvironmentModel struct {
	grove.BaseModel `grove:"table:authsome_environments,alias:env"`

	ID          string          `grove:"id,pk"`
	AppID       string          `grove:"app_id,notnull"`
	Name        string          `grove:"name,notnull"`
	Slug        string          `grove:"slug,notnull"`
	Type        string          `grove:"type,notnull"`
	IsDefault   bool            `grove:"is_default"`
	Color       string          `grove:"color"`
	Description string          `grove:"description"`
	Settings    json.RawMessage `grove:"settings,type:jsonb"`
	ClonedFrom  string          `grove:"cloned_from"`
	Metadata    json.RawMessage `grove:"metadata,type:jsonb"`
	CreatedAt   time.Time       `grove:"created_at,notnull,default:now()"`
	UpdatedAt   time.Time       `grove:"updated_at,notnull,default:now()"`
}

type FormConfigModel struct {
	grove.BaseModel `grove:"table:authsome_form_configs,alias:fc"`

	ID        string          `grove:"id,pk"`
	AppID     string          `grove:"app_id,notnull"`
	FormType  string          `grove:"form_type,notnull"`
	Fields    json.RawMessage `grove:"fields,type:jsonb"`
	Active    bool            `grove:"active"`
	Version   int             `grove:"version,notnull"`
	CreatedAt time.Time       `grove:"created_at,notnull,default:now()"`
	UpdatedAt time.Time       `grove:"updated_at,notnull,default:now()"`
}

type InvitationModel struct {
	grove.BaseModel `grove:"table:authsome_invitations,alias:inv"`

	ID        string         `grove:"id,pk"`
	OrgID     string         `grove:"org_id,notnull"`
	Email     string         `grove:"email,notnull"`
	Role      string         `grove:"role,notnull"`
	InviterID string         `grove:"inviter_id,notnull"`
	Status    string         `grove:"status,notnull"`
	Token     string         `grove:"token,notnull"`
	TokenHash sql.NullString `grove:"token_hash"`
	ExpiresAt time.Time      `grove:"expires_at,notnull"`
	CreatedAt time.Time      `grove:"created_at,notnull,default:now()"`
}

type KVModel struct {
	grove.BaseModel `grove:"table:authsome_kv,alias:kv"`

	Key       string `grove:"key,pk"`
	Value     []byte `grove:"value"`
	Counter   int64  `grove:"counter,notnull"`
	ExpiresAt int64  `grove:"expires_at,notnull"`
}

type MemberModel struct {
	grove.BaseModel `grove:"table:authsome_members,alias:m"`

	ID        string    `grove:"id,pk"`
	OrgID     string    `grove:"org_id,notnull"`
	UserID    string    `grove:"user_id,notnull"`
	Role      string    `grove:"role,notnull"`
	CreatedAt time.Time `grove:"created_at,notnull,default:now()"`
	UpdatedAt time.Time `grove:"updated_at,notnull,default:now()"`
}

type NotificationModel struct {
	grove.BaseModel `grove:"table:authsome_notifications,alias:n"`

	ID        string       `grove:"id,pk"`
	AppID     string       `grove:"app_id,notnull"`
	EnvID     string       `grove:"env_id,notnull"`
	UserID    string       `grove:"user_id,notnull"`
	Type      string       `grove:"type,notnull"`
	Channel   string       `grove:"channel,notnull"`
	Subject   string       `grove:"subject"`
	Body      string       `grove:"body"`
	Sent      bool         `grove:"sent"`
	SentAt    sql.NullTime `grove:"sent_at"`
	CreatedAt time.Time    `grove:"created_at,notnull,default:now()"`
}

type OrganizationModel struct {
	grove.BaseModel `grove:"table:authsome_organizations,alias:o"`

	ID        string          `grove:"id,pk"`
	AppID     string          `grove:"app_id,notnull"`
	EnvID     string          `grove:"env_id,notnull"`
	Name      string          `grove:"name,notnull"`
	Slug      string          `grove:"slug,notnull"`
	Logo      string          `grove:"logo"`
	Metadata  json.RawMessage `grove:"metadata,type:jsonb"`
	CreatedBy string          `grove:"created_by,notnull"`
	CreatedAt time.Time       `grove:"created_at,notnull,default:now()"`
	UpdatedAt time.Time       `grove:"updated_at,notnull,default:now()"`
}

type PasswordResetModel struct {
	grove.BaseModel `grove:"table:authsome_password_resets,alias:pr"`

	ID        string         `grove:"id,pk"`
	AppID     string         `grove:"app_id,notnull"`
	EnvID     string         `grove:"env_id,notnull"`
	UserID    string         `grove:"user_id,notnull"`
	Token     string         `grove:"token,notnull"`
	TokenHash sql.NullString `grove:"token_hash"`
	ExpiresAt time.Time      `grove:"expires_at,notnull"`
	Consumed  bool           `grove:"consumed"`
	CreatedAt time.Time      `grove:"created_at,notnull,default:now()"`
}

type RevokedRefreshTokenModel struct {
	grove.BaseModel `grove:"table:authsome_revoked_refresh_tokens,alias:rrt"`

	TokenHash string    `grove:"token_hash,pk"`
	FamilyID  string    `grove:"family_id,notnull"`
	RevokedAt time.Time `grove:"revoked_at,notnull"`
	Reason    string    `grove:"reason"`
}

type ServiceAccountModel struct {
	grove.BaseModel `grove:"table:authsome_service_accounts,alias:sa"`

	ID    string `grove:"id,pk"`
	AppID string `grove:"app_id,notnull"`
	EnvID string `grove:"env_id"`
	OrgID string `grove:"org_id"`
	// Kind is empty on no row postgres writes, but stays nullable-tolerant so
	// a row inserted by hand without it still reads as a service account.
	Kind        string          `grove:"kind"`
	Name        string          `grove:"name,notnull"`
	Description string          `grove:"description"`
	Scopes      json.RawMessage `grove:"scopes,type:jsonb"`
	OwnerUserID string          `grove:"owner_user_id"`
	ParentID    string          `grove:"parent_id"`
	ExpiresAt   *time.Time      `grove:"expires_at"`
	Active      bool            `grove:"active,notnull"`
	CreatedAt   time.Time       `grove:"created_at,notnull,default:now()"`
	UpdatedAt   time.Time       `grove:"updated_at,notnull,default:now()"`
}

type SessionModel struct {
	grove.BaseModel `grove:"table:authsome_sessions,alias:s"`

	ID    string `grove:"id,pk"`
	AppID string `grove:"app_id,notnull"`
	EnvID string `grove:"env_id,notnull"`
	// UserID is empty for a service-account session, which has no user behind
	// it. That is the same sentinel-empty convention every other optional id
	// column here uses (org_id, device_id, family_id, impersonated_by).
	UserID string `grove:"user_id,notnull"`
	// PrincipalKind and ServiceAccountID carry which kind of principal owns the
	// session. Empty PrincipalKind means "user" for rows written before these
	// columns existed, so neither direction normalizes it — inventing "user" on
	// read would make a legacy row indistinguishable from one deliberately
	// stamped, and this value is branched on to make authorization decisions.
	PrincipalKind    string `grove:"principal_kind"`
	ServiceAccountID string `grove:"service_account_id"`
	// AgentID and GrantID carry the agent principal and the grant that
	// authorized it, mapped the same way as ServiceAccountID above.
	AgentID  string `grove:"agent_id"`
	GrantID  string `grove:"grant_id"`
	OrgID    string `grove:"org_id"`
	FamilyID string `grove:"family_id"`
	// Token and RefreshToken are empty on every row written since
	// hash_session_tokens; they hold plaintext only on rows older than that
	// migration, which the first lookup rewrites. TokenHash and
	// RefreshTokenHash are NULL on those legacy rows so the unique index
	// skips them.
	Token            string         `grove:"token,notnull"`
	RefreshToken     string         `grove:"refresh_token,notnull"`
	TokenHash        sql.NullString `grove:"token_hash"`
	RefreshTokenHash sql.NullString `grove:"refresh_token_hash"`
	IPAddress        string         `grove:"ip_address"`
	UserAgent        string         `grove:"user_agent"`
	DeviceID         string         `grove:"device_id"`
	ImpersonatedBy   string         `grove:"impersonated_by"`
	// Roles is JSON rather than a comma-separated list. A slug containing a
	// comma would split into two role names nobody was ever granted, and
	// these strings are read back as an authorization decision, so the
	// encoding must not be able to invent a member.
	Roles json.RawMessage `grove:"roles,type:jsonb"`
	// Audience is JSON for the same reason Roles is. A resource identifier is
	// a URI and may contain a comma, and these strings are compared to decide
	// whether a token is allowed to authenticate at all.
	Audience json.RawMessage `grove:"audience,type:jsonb"`
	// Scopes is JSON for the same reason Roles is: these strings are read back
	// as an authorization decision, so the encoding must not be able to invent
	// or merge a member.
	Scopes json.RawMessage `grove:"scopes,type:jsonb"`
	// Actors is JSON for the same reason Roles is: a chain element carries a
	// kind and an id, and both are compared to make authorization decisions,
	// so the encoding must not be able to invent or merge a member.
	Actors                json.RawMessage `grove:"actors,type:jsonb"`
	ActorGrant            string          `grove:"actor_grant"`
	DelegationID          string          `grove:"delegation_id"`
	LastActivityAt        time.Time       `grove:"last_activity_at"`
	ExpiresAt             time.Time       `grove:"expires_at,notnull"`
	RefreshTokenExpiresAt time.Time       `grove:"refresh_token_expires_at,notnull"`
	CreatedAt             time.Time       `grove:"created_at,notnull,default:now()"`
	UpdatedAt             time.Time       `grove:"updated_at,notnull,default:now()"`
	DPoPJKT               string          `grove:"dpop_jkt"`
	ClientID              string          `grove:"client_id"`
}

type SettingModel struct {
	grove.BaseModel `grove:"table:authsome_settings,alias:st"`

	ID        string          `grove:"id,pk"`
	Key       string          `grove:"key,notnull"`
	Value     json.RawMessage `grove:"value,type:jsonb"`
	Scope     string          `grove:"scope,notnull"`
	ScopeID   string          `grove:"scope_id,notnull"`
	AppID     string          `grove:"app_id"`
	OrgID     string          `grove:"org_id"`
	Enforced  bool            `grove:"enforced"`
	Namespace string          `grove:"namespace"`
	Version   int64           `grove:"version"`
	UpdatedBy string          `grove:"updated_by"`
	CreatedAt time.Time       `grove:"created_at,notnull,default:now()"`
	UpdatedAt time.Time       `grove:"updated_at,notnull,default:now()"`
}

type Store struct {
	// contains filtered or unexported fields
}

type TeamModel struct {
	grove.BaseModel `grove:"table:authsome_teams,alias:t"`

	ID        string    `grove:"id,pk"`
	OrgID     string    `grove:"org_id,notnull"`
	Name      string    `grove:"name,notnull"`
	Slug      string    `grove:"slug,notnull"`
	CreatedAt time.Time `grove:"created_at,notnull,default:now()"`
	UpdatedAt time.Time `grove:"updated_at,notnull,default:now()"`
}

type UserEmailModel struct {
	grove.BaseModel `grove:"table:authsome_user_emails,alias:ue"`

	ID        string       `grove:"id,pk"`
	UserID    string       `grove:"user_id,notnull"`
	AppID     string       `grove:"app_id,notnull"`
	EnvID     string       `grove:"env_id,notnull"`
	Email     string       `grove:"email,notnull"`
	Verified  bool         `grove:"verified"`
	IsPrimary bool         `grove:"is_primary"`
	Source    string       `grove:"source"`
	CreatedAt time.Time    `grove:"created_at,notnull,default:now()"`
	UpdatedAt time.Time    `grove:"updated_at,notnull,default:now()"`
	DeletedAt sql.NullTime `grove:"deleted_at"`
}

type UserModel struct {
	grove.BaseModel `grove:"table:authsome_users,alias:u"`

	ID              string          `grove:"id,pk"`
	AppID           string          `grove:"app_id,notnull"`
	EnvID           string          `grove:"env_id,notnull"`
	Email           string          `grove:"email,notnull"`
	EmailVerified   bool            `grove:"email_verified"`
	FirstName       string          `grove:"first_name"`
	LastName        string          `grove:"last_name"`
	Image           string          `grove:"image"`
	Username        string          `grove:"username"`
	DisplayUsername string          `grove:"display_username"`
	Phone           string          `grove:"phone"`
	PhoneVerified   bool            `grove:"phone_verified"`
	PasswordHash    string          `grove:"password_hash"`
	Banned          bool            `grove:"banned"`
	BanReason       string          `grove:"ban_reason"`
	BanExpires      sql.NullTime    `grove:"ban_expires"`
	Metadata        json.RawMessage `grove:"metadata,type:jsonb"`
	CreatedAt       time.Time       `grove:"created_at,notnull,default:now()"`
	UpdatedAt       time.Time       `grove:"updated_at,notnull,default:now()"`
	DeletedAt       sql.NullTime    `grove:"deleted_at"`
}

type VerificationModel struct {
	grove.BaseModel `grove:"table:authsome_verifications,alias:v"`

	ID     string `grove:"id,pk"`
	AppID  string `grove:"app_id,notnull"`
	EnvID  string `grove:"env_id,notnull"`
	UserID string `grove:"user_id,notnull"`
	Token  string `grove:"token,notnull"`
	// TokenHash is store.HashToken of the code; Token is empty on rows
	// written since hash_credential_tokens and NULL here marks a legacy row.
	TokenHash sql.NullString `grove:"token_hash"`
	Type      string         `grove:"type,notnull"`
	Attempts  int            `grove:"attempts,notnull,default:0"`
	ExpiresAt time.Time      `grove:"expires_at,notnull"`
	Consumed  bool           `grove:"consumed"`
	CreatedAt time.Time      `grove:"created_at,notnull,default:now()"`
}

type WebhookModel struct {
	grove.BaseModel `grove:"table:authsome_webhooks,alias:wh"`

	ID     string          `grove:"id,pk"`
	AppID  string          `grove:"app_id,notnull"`
	EnvID  string          `grove:"env_id,notnull"`
	URL    string          `grove:"url,notnull"`
	Events json.RawMessage `grove:"events,type:jsonb"`
	// Secret is empty once the row has a relay endpoint; see webhook.Webhook.
	Secret          string    `grove:"secret"`
	SecretHash      string    `grove:"secret_hash"`
	RelayEndpointID string    `grove:"relay_endpoint_id"`
	Active          bool      `grove:"active"`
	CreatedAt       time.Time `grove:"created_at,notnull,default:now()"`
	UpdatedAt       time.Time `grove:"updated_at,notnull,default:now()"`
}