auth

type APIKeyValidator struct {
	// contains filtered or unexported fields
}

type Claims struct {
	UserID string `json:"uid"`
	jwt.RegisteredClaims
}

type Config struct {
	JWTSecret          string
	JWTExpiry          time.Duration
	RefreshTokenExpiry time.Duration
}

type EmailSender interface {
	SendPasswordReset(ctx context.Context, to, name, resetToken string) error
	SendWelcome(ctx context.Context, to, name string) error
}

type LockoutConfig struct {
	// MaxAttempts is the maximum failed attempts before lockout.
	MaxAttempts int
	// LockoutDuration is how long the account is locked after MaxAttempts.
	LockoutDuration time.Duration
	// AttemptWindow is the window during which failed attempts are counted.
	AttemptWindow time.Duration
}

type LoginAttemptTracker interface {
	// RecordFailedAttempt records a failed login attempt for an email.
	// Returns the number of failed attempts and whether the account is locked.
	RecordFailedAttempt(ctx context.Context, email string) (attempts int, locked bool, err error)
	// ClearAttempts clears all failed attempts for an email (call on successful login).
	ClearAttempts(ctx context.Context, email string) error
	// IsLocked checks if an account is currently locked.
	IsLocked(ctx context.Context, email string) (bool, time.Duration, error)
}

type MFAConfig struct {
	Issuer         string // Application name shown in authenticator apps
	BackupCodeLen  int    // Length of each backup code
	BackupCodeNum  int    // Number of backup codes to generate
	ValidationSkew uint   // Allow codes this many periods before/after current
}

type MFAService struct {
	// contains filtered or unexported fields
}

type MFASetupResponse struct {
	Secret      string   `json:"secret"`      // Base32 encoded secret for manual entry
	QRCodeURL   string   `json:"qrCodeUrl"`   // otpauth:// URL for QR code generation
	BackupCodes []string `json:"backupCodes"` // One-time backup codes
}

type MemoryLoginAttemptTracker struct {
	// contains filtered or unexported fields
}

type OAuthManager struct {
	// contains filtered or unexported fields
}

type OAuthProvider struct {
	// contains filtered or unexported fields
}

type OAuthResult struct {
	User       *User
	IsNewUser  bool
	LinkedNew  bool
	ProviderID string
}

type OAuthToken struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token"`
	IDToken      string `json:"id_token"`
}

type OAuthUserInfo struct {
	Sub           string `json:"sub"`
	Email         string `json:"email"`
	EmailVerified bool   `json:"email_verified"`
	Name          string `json:"name"`
	Picture       string `json:"picture"`
}

type OIDCDiscovery struct {
	Issuer                string `json:"issuer"`
	AuthorizationEndpoint string `json:"authorization_endpoint"`
	TokenEndpoint         string `json:"token_endpoint"`
	UserInfoEndpoint      string `json:"userinfo_endpoint"`
	JwksURI               string `json:"jwks_uri"`
}

type ProviderInfo struct {
	Name        string `json:"name"`
	DisplayName string `json:"displayName"`
	IconURL     string `json:"iconUrl,omitempty"`
}

type RedisLoginAttemptTracker struct {
	// contains filtered or unexported fields
}

type RegisterInput struct {
	Email    string
	Password string
	Name     string
}

type Service struct {
	// contains filtered or unexported fields
}

type TokenPair struct {
	AccessToken  string    `json:"accessToken"`
	RefreshToken string    `json:"refreshToken"`
	ExpiresAt    time.Time `json:"expiresAt"`
}

type User struct {
	ID            string
	Email         string
	Name          string
	Avatar        string // Storage ID for user's avatar
	EmailVerified bool
	MFAEnabled    bool
	HasPassword   bool
	CreatedAt     time.Time
}