auth

type APIKey struct {
	ID, Name, Prefix, UserID                    string
	Kind                                        string // KeyKindAPI or KeyKindAgent
	Scopes                                      []string
	RatePerMin                                  int
	ExpiresAt, LastUsedAt, CreatedAt, RevokedAt string
	UseCount                                    int64  // approximate: flushed at most once a minute
	RotatedFrom                                 string // id of the key this one replaced
}

type KeyService interface {
	// Create creates an API key of kind KeyKindAPI.
	Create(ctx context.Context, name, userID string, scopes []string, rate int, expires string) (plaintext string, k *APIKey, err error)
	// CreateKind is Create with an explicit kind (KeyKindAPI or KeyKindAgent).
	CreateKind(ctx context.Context, kind, name, userID string, scopes []string, rate int, expires string) (plaintext string, k *APIKey, err error)
	List(ctx context.Context) ([]APIKey, error)
	Get(ctx context.Context, id string) (*APIKey, error)
	Revoke(ctx context.Context, id string) error
	// Rotate issues a new key with the same name, kind, owner, scopes, rate
	// and expiry, and retires the old one: revoked now when grace is 0,
	// otherwise expiring after grace (so clients can switch without downtime).
	Rotate(ctx context.Context, id string, grace time.Duration) (plaintext string, k *APIKey, err error)
}

type ListQuery struct {
	Search        string
	Page, PerPage int
	Sort, Order   string
}

type Module struct{}

type Role struct {
	Slug        string
	Name        map[string]string // locale → label (en required)
	System      bool
	Permissions []string
	UserCount   int
}

type RolePatch struct {
	Name        map[string]string
	Permissions *[]string
}

type RoleService interface {
	List(ctx context.Context) ([]Role, error)
	Get(ctx context.Context, slug string) (*Role, error)
	Create(ctx context.Context, slug string, name map[string]string, permissions []string) (*Role, error)
	Update(ctx context.Context, slug string, patch RolePatch) (*Role, error)
	Delete(ctx context.Context, slug string) error
}

type Service interface {
	Create(ctx context.Context, email, name, password, role string) (*User, error)
	GetByEmail(ctx context.Context, email string) (*User, error)
	Get(ctx context.Context, id string) (*User, error)
	List(ctx context.Context, q ListQuery) ([]User, int, error)
	Update(ctx context.Context, id string, patch UserPatch) (*User, error)
	Delete(ctx context.Context, id string) error
	CheckPassword(ctx context.Context, email, password string) (*User, error) // rate-limited per IP (audit.IPFromContext) + email
	Count(ctx context.Context) (int, error)
}

type User struct {
	ID, Email, Name, Role, Locale, Status string
	LastLoginAt, CreatedAt, UpdatedAt     string
}

type UserPatch struct {
	Name, Email, Role, Locale, Status, Password *string
}

type ValidationError struct{ Fields map[string]string }