dashauth

type AccessLevel int

type AuthChecker interface {
	// CheckAuth inspects the request and returns a UserInfo if authenticated.
	// Returns nil (not an error) when the request is unauthenticated.
	// Returns an error only for infrastructure failures (e.g. token validation
	// service unreachable).
	CheckAuth(ctx context.Context, r *http.Request) (*UserInfo, error)
}

type AuthCheckerFunc func(ctx context.Context, r *http.Request) (*UserInfo, error)

type AuthPageDescriptor struct {
	// Type identifies the kind of auth page (login, logout, register, etc.).
	Type AuthPageType

	// Path is the route path relative to the auth base path (e.g. "/login").
	Path string

	// Title is the page title shown in the browser tab.
	Title string

	// Icon is the optional icon name for the page.
	Icon string
}

type AuthPageProvider interface {
	// AuthPages returns the list of auth pages this provider contributes.
	AuthPages() []AuthPageDescriptor

	// RenderAuthPage renders the templ component for an auth page (GET request).
	// The page type identifies which auth page to render.
	RenderAuthPage(ctx *router.PageContext, pageType AuthPageType) (templ.Component, error)

	// HandleAuthAction handles a form submission for an auth page (POST request).
	// Returns:
	//   - redirectURL: if non-empty, the user should be redirected to this URL
	//   - errComponent: if non-nil, re-render the page with this error content
	//   - err: infrastructure errors
	HandleAuthAction(ctx *router.PageContext, pageType AuthPageType) (redirectURL string, errComponent templ.Component, err error)
}

type AuthPageType string

type ScopeTenantResolver struct{}

type TenantInfo struct {
	// ID is the tenant identifier (AppID or OrgID depending on Type).
	ID string

	// Name is the human-readable display name for this tenant.
	Name string

	// Type indicates whether this is an app-level or org-level tenant.
	Type TenantType

	// AppID is always present — the application identifier.
	AppID string

	// OrgID is present only for org-level tenants.
	OrgID string

	// LogoURL is an optional URL for the tenant's logo/branding.
	LogoURL string

	// Metadata holds additional tenant-specific data.
	Metadata map[string]any
}

type TenantResolver interface {
	ResolveTenant(ctx context.Context, r *http.Request) (*TenantInfo, error)
}

type TenantResolverFunc func(ctx context.Context, r *http.Request) (*TenantInfo, error)

type TenantType string

type UserInfo struct {
	// Subject is the unique user identifier (e.g. user ID, email, or sub claim).
	Subject string

	// DisplayName is the user's display name.
	DisplayName string

	// Email is the user's email address.
	Email string

	// AvatarURL is the URL of the user's avatar image.
	AvatarURL string

	// Roles holds the user's roles (e.g. "admin", "editor").
	Roles []string

	// Scopes holds the user's OAuth2 scopes or permission strings.
	Scopes []string

	// ProviderName identifies which auth provider authenticated this user.
	ProviderName string

	// Claims holds additional authentication claims.
	Claims map[string]any

	// Metadata holds provider-specific metadata.
	Metadata map[string]any
}