auth

type AccountLockout struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID         uuid.UUID  `json:"user_id" gorm:"type:uuid;not null;index"`
	IPAddress      string     `json:"ip_address" gorm:"size:45;index"`
	Reason         string     `json:"reason" gorm:"size:255"`
	FailedAttempts int        `json:"failed_attempts" gorm:"default:0"`
	LockedUntil    *time.Time `json:"locked_until"`
	IsActive       bool       `json:"is_active" gorm:"default:true"`
}

type AuditEvent string

type AuditLog struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID     *uuid.UUID `json:"user_id" gorm:"type:uuid;index"`
	Event      string     `json:"event" gorm:"not null;size:50;index"`
	IPAddress  string     `json:"ip_address" gorm:"size:45;index"`
	UserAgent  string     `json:"user_agent" gorm:"size:255"`
	Details    string     `json:"details" gorm:"type:text"`
	Success    bool       `json:"success" gorm:"index"`
	RiskLevel  string     `json:"risk_level" gorm:"size:20;index"`
	SessionID  *uuid.UUID `json:"session_id" gorm:"type:uuid;index"`
	Location   string     `json:"location" gorm:"size:255"`
	DeviceInfo string     `json:"device_info" gorm:"size:255"`
}

type AuditService struct {
	// contains filtered or unexported fields
}

type AuthResponse struct {
	User         *models.User `json:"user"`
	AccessToken  string       `json:"access_token"`
	RefreshToken string       `json:"refresh_token"`
	ExpiresIn    int64        `json:"expires_in"`
}

type AuthService interface {
	Login(ctx context.Context, req LoginRequest) (*AuthResponse, error)
	Register(ctx context.Context, req RegisterRequest) (*models.User, error)
	RefreshToken(ctx context.Context, refreshToken string) (*AuthResponse, error)
	Logout(ctx context.Context, userID uuid.UUID) error
	VerifyToken(ctx context.Context, token string) (*models.User, error)
	RequestPasswordReset(ctx context.Context, req PasswordResetRequest) error
	ResetPassword(ctx context.Context, req PasswordResetConfirmRequest) error
	VerifyEmail(ctx context.Context, token string) error
	ResendVerificationEmail(ctx context.Context, userID uuid.UUID) error
	// Legacy methods for backward compatibility
	GetUserByID(userID uuid.UUID) (*models.User, error)
	GetUserByEmail(email string) (*models.User, error)
	GetUserByUsername(username string) (*models.User, error)
	UpdateUser(user *models.User) error
	ValidateToken(tokenString string) (*models.User, error)
}

type BackupCode struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID uuid.UUID  `json:"user_id" gorm:"type:uuid;not null;index"`
	Code   string     `json:"code" gorm:"not null;size:255"`
	Used   bool       `json:"used" gorm:"default:false"`
	UsedAt *time.Time `json:"used_at"`

	// Relationships
	User models.User `json:"user,omitempty" gorm:"foreignKey:UserID"`
}

type Claims struct {
	UserID   uuid.UUID `json:"user_id"`
	Username string    `json:"username"`
	Email    string    `json:"email"`
	// Roles granted to the user from external identity or group mapping
	Roles   []string `json:"roles,omitempty"`
	IsAdmin bool     `json:"is_admin"`
	jwt.RegisteredClaims
}

type DatabaseStats struct {
	TotalUsers           int64 `json:"total_users"`
	ActiveUsers          int64 `json:"active_users"`
	VerifiedUsers        int64 `json:"verified_users"`
	MFAEnabledUsers      int64 `json:"mfa_enabled_users"`
	ActiveSessions       int64 `json:"active_sessions"`
	TotalSessions        int64 `json:"total_sessions"`
	OAuthAccounts        int64 `json:"oauth_accounts"`
	RecentLogins24h      int64 `json:"recent_logins_24h"`
	FailedLogins24h      int64 `json:"failed_logins_24h"`
	SecurityEvents24h    int64 `json:"security_events_24h"`
	PendingVerifications int64 `json:"pending_verifications"`
}

type EmailService interface {
	SendPasswordResetEmail(to, token string) error
	SendEmailVerification(to, token string) error
	SendMFASetupEmail(to string, backupCodes []string) error
}

type EmailTemplate struct {
	Subject  string
	HTMLBody string
	TextBody string
}

type EmailVerificationService struct {
	// contains filtered or unexported fields
}

type EmailVerificationToken struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID    uuid.UUID  `json:"user_id" gorm:"type:uuid;not null;index"`
	Token     string     `json:"-" gorm:"not null;uniqueIndex;size:255"`
	ExpiresAt time.Time  `json:"expires_at" gorm:"not null"`
	Used      bool       `json:"used" gorm:"default:false"`
	UsedAt    *time.Time `json:"used_at"`

	// Relationships
	User models.User `json:"user,omitempty" gorm:"foreignKey:UserID"`
}

type GitHubProvider struct {
	ClientID     string
	ClientSecret string
}

type GitLabProvider struct {
	ClientID     string
	ClientSecret string
	BaseURL      string // For self-hosted GitLab instances
}

type GoogleProvider struct {
	ClientID     string
	ClientSecret string
}

type JITProvisioningConfig struct {
	Enabled             bool              `json:"enabled" mapstructure:"enabled"`
	DefaultRole         string            `json:"default_role" mapstructure:"default_role"`
	AttributeMapping    map[string]string `json:"attribute_mapping" mapstructure:"attribute_mapping"`
	GroupMapping        map[string]string `json:"group_mapping" mapstructure:"group_mapping"`
	CreateOrganizations bool              `json:"create_organizations" mapstructure:"create_organizations"`
}

type JWTManager struct {
	// contains filtered or unexported fields
}

type LDAPConnection interface {
	Bind(username, password string) error
	Search(baseDN, filter string, attributes []string) ([]LDAPSearchResult, error)
	Close() error
}

type LDAPSearchResult struct {
	DN         string
	Attributes map[string][]string
}

type LDAPService struct {
	// contains filtered or unexported fields
}

type LDAPUserInfo struct {
	DN          string
	Username    string
	Email       string
	FirstName   string
	LastName    string
	DisplayName string
	Groups      []string
	Attributes  map[string][]string
}

type LoggingSMSProvider struct{}

type LoginAttempt struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID     *uuid.UUID `json:"user_id,omitempty" gorm:"type:uuid;index"`
	Email      string     `json:"email" gorm:"not null;size:255;index"`
	IPAddress  string     `json:"ip_address" gorm:"not null;size:45;index"`
	Success    bool       `json:"success" gorm:"not null;index"`
	UserAgent  string     `json:"user_agent" gorm:"size:255"`
	FailReason string     `json:"fail_reason" gorm:"size:255"`
}

type LoginRequest struct {
	Email    string `json:"email" binding:"required,email"`
	Password string `json:"password" binding:"required,min=6"`
	MFACode  string `json:"mfa_code,omitempty"`
}

type MFAService struct {
	// contains filtered or unexported fields
}

type MFASetupRequest struct {
	UserID uuid.UUID `json:"user_id"`
}

type MFASetupResponse struct {
	Secret      string   `json:"secret"`
	QRCodeURL   string   `json:"qr_code_url"`
	BackupCodes []string `json:"backup_codes"`
}

type MFAVerifyRequest struct {
	UserID uuid.UUID `json:"user_id"`
	Code   string    `json:"code"`
}

type MicrosoftProvider struct {
	ClientID     string
	ClientSecret string
	TenantID     string
}

type MockEmailService struct{}

type MockLDAPConnection struct {
	// contains filtered or unexported fields
}

type MockLDAPUser struct {
	DN          string
	Password    string
	Email       string
	FirstName   string
	LastName    string
	DisplayName string
	Groups      []string
}

type OAuthAccount struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID       uuid.UUID  `json:"user_id" gorm:"type:uuid;not null;index"`
	Provider     string     `json:"provider" gorm:"not null;size:50"`
	ProviderID   string     `json:"provider_id" gorm:"not null;size:255"`
	Email        string     `json:"email" gorm:"size:255"`
	Username     string     `json:"username" gorm:"size:255"`
	AccessToken  string     `json:"-" gorm:"type:text"`
	RefreshToken string     `json:"-" gorm:"type:text"`
	ExpiresAt    *time.Time `json:"expires_at"`

	// Relationships
	User models.User `json:"user,omitempty" gorm:"foreignKey:UserID"`
}

type OAuthProvider interface {
	GetAuthURL(state string, redirectURI string) string
	ExchangeCode(code, redirectURI string) (*OAuthToken, error)
	GetUserInfo(token *OAuthToken) (*OAuthUserInfo, error)
	GetProviderName() string
}

type OAuthService struct {
	// contains filtered or unexported fields
}

type OAuthState struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	State     string    `json:"state" gorm:"not null;uniqueIndex;size:255"`
	Provider  string    `json:"provider" gorm:"not null;size:50"`
	ExpiresAt time.Time `json:"expires_at" gorm:"not null"`
	Used      bool      `json:"used" gorm:"default:false"`
}

type OAuthToken struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	RefreshToken string `json:"refresh_token,omitempty"`
	ExpiresIn    int    `json:"expires_in,omitempty"`
	Scope        string `json:"scope,omitempty"`
}

type OAuthUserInfo struct {
	ID       string `json:"id"`
	Username string `json:"username"`
	Email    string `json:"email"`
	Name     string `json:"name"`
	Avatar   string `json:"avatar"`
}

type OIDCClaims struct {
	Sub               string   `json:"sub"`
	Name              string   `json:"name"`
	GivenName         string   `json:"given_name"`
	FamilyName        string   `json:"family_name"`
	PreferredUsername string   `json:"preferred_username"`
	Email             string   `json:"email"`
	EmailVerified     bool     `json:"email_verified"`
	Picture           string   `json:"picture"`
	Groups            []string `json:"groups"`
	Roles             []string `json:"roles"`
}

type OIDCDiscoveryDocument struct {
	Issuer                 string   `json:"issuer"`
	AuthorizationEndpoint  string   `json:"authorization_endpoint"`
	TokenEndpoint          string   `json:"token_endpoint"`
	UserinfoEndpoint       string   `json:"userinfo_endpoint"`
	JwksURI                string   `json:"jwks_uri"`
	ScopesSupported        []string `json:"scopes_supported"`
	ResponseTypesSupported []string `json:"response_types_supported"`
}

type OIDCProvider struct {
	Name         string
	ClientID     string
	ClientSecret string
	IssuerURL    string
	RedirectURI  string
	Scopes       []string
	// contains filtered or unexported fields
}

type OIDCService struct {
	// contains filtered or unexported fields
}

type OIDCTokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	RefreshToken string `json:"refresh_token"`
	ExpiresIn    int    `json:"expires_in"`
	IDToken      string `json:"id_token"`
	Scope        string `json:"scope"`
}

type PasswordResetConfirmRequest struct {
	Token    string `json:"token" binding:"required"`
	Password string `json:"password" binding:"required,min=12"`
}

type PasswordResetRequest struct {
	Email string `json:"email" binding:"required,email"`
}

type PasswordResetService struct {
	// contains filtered or unexported fields
}

type PasswordResetToken struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID    uuid.UUID  `json:"user_id" gorm:"type:uuid;not null;index"`
	Token     string     `json:"-" gorm:"not null;uniqueIndex;size:255"`
	ExpiresAt time.Time  `json:"expires_at" gorm:"not null"`
	Used      bool       `json:"used" gorm:"default:false"`
	UsedAt    *time.Time `json:"used_at"`

	// Relationships
	User models.User `json:"user,omitempty" gorm:"foreignKey:UserID"`
}

type RateLimitConfig struct {
	MaxAttempts     int           // Maximum failed attempts
	WindowDuration  time.Duration // Time window for rate limiting
	LockoutDuration time.Duration // How long to lock account
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type RegisterRequest struct {
	Username string `json:"username" binding:"required,min=3,max=50"`
	Email    string `json:"email" binding:"required,email"`
	Password string `json:"password" binding:"required,min=12"`
	FullName string `json:"full_name" binding:"required,min=1,max=255"`
}

type SAMLRequest struct {
	XMLName      xml.Name `xml:"urn:oasis:names:tc:SAML:2.0:protocol AuthnRequest"`
	ID           string   `xml:"ID,attr"`
	Version      string   `xml:"Version,attr"`
	IssueInstant string   `xml:"IssueInstant,attr"`
	Issuer       struct {
		Value string `xml:",chardata"`
	} `xml:"urn:oasis:names:tc:SAML:2.0:assertion Issuer"`
}

type SAMLResponse struct {
	XMLName xml.Name `xml:"urn:oasis:names:tc:SAML:2.0:protocol Response"`
	ID      string   `xml:"ID,attr"`
	Status  struct {
		StatusCode struct {
			Value string `xml:"Value,attr"`
		} `xml:"urn:oasis:names:tc:SAML:2.0:protocol StatusCode"`
	} `xml:"urn:oasis:names:tc:SAML:2.0:protocol Status"`
	Assertion struct {
		Subject struct {
			NameID struct {
				Value string `xml:",chardata"`
			} `xml:"urn:oasis:names:tc:SAML:2.0:assertion NameID"`
		} `xml:"urn:oasis:names:tc:SAML:2.0:assertion Subject"`
		AttributeStatement struct {
			Attributes []struct {
				Name   string `xml:"Name,attr"`
				Values []struct {
					Value string `xml:",chardata"`
				} `xml:"urn:oasis:names:tc:SAML:2.0:assertion AttributeValue"`
			} `xml:"urn:oasis:names:tc:SAML:2.0:assertion Attribute"`
		} `xml:"urn:oasis:names:tc:SAML:2.0:assertion AttributeStatement"`
	} `xml:"urn:oasis:names:tc:SAML:2.0:assertion Assertion"`
}

type SAMLService struct {
	// contains filtered or unexported fields
}

type SAMLUserInfo struct {
	ID       string
	Email    string
	Username string
	Name     string
	Groups   []string
}

type SMSProvider interface {
	SendSMS(phoneNumber, message string) error
}

type SMSService struct {
	// contains filtered or unexported fields
}

type SMSVerificationCode struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID    uuid.UUID  `json:"user_id" gorm:"type:uuid;not null;index"`
	Code      string     `json:"code" gorm:"not null;size:10"`
	ExpiresAt time.Time  `json:"expires_at" gorm:"not null"`
	Used      bool       `json:"used" gorm:"default:false"`
	UsedAt    *time.Time `json:"used_at"`

	// Relationships
	User models.User `json:"user,omitempty" gorm:"foreignKey:UserID"`
}

type SMTPEmailService struct {
	// contains filtered or unexported fields
}

type SecurityEvent struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID    *uuid.UUID `json:"user_id,omitempty" gorm:"type:uuid;index"`
	EventType string     `json:"event_type" gorm:"not null;size:50;index"`
	IPAddress string     `json:"ip_address" gorm:"size:45;index"`
	UserAgent string     `json:"user_agent" gorm:"size:255"`
	Details   string     `json:"details" gorm:"type:text"`
	Severity  string     `json:"severity" gorm:"size:20;default:'info'"` // info, warning, critical
}

type SecurityMetrics struct {
	FailedLogins24h       int64 `json:"failed_logins_24h"`
	SuspiciousActivity24h int64 `json:"suspicious_activity_24h"`
	AccountLockouts24h    int64 `json:"account_lockouts_24h"`
	ActiveSessions        int64 `json:"active_sessions"`
	UnusualLocations24h   int64 `json:"unusual_locations_24h"`
}

type SecurityService struct {
	// contains filtered or unexported fields
}

type Session struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID        uuid.UUID `json:"user_id" gorm:"type:uuid;not null;index"`
	RefreshToken  string    `json:"-" gorm:"not null;uniqueIndex;size:255"`
	ExpiresAt     time.Time `json:"expires_at" gorm:"not null"`
	IPAddress     string    `json:"ip_address" gorm:"size:45"`
	UserAgent     string    `json:"user_agent" gorm:"size:255"`
	IsActive      bool      `json:"is_active" gorm:"default:true"`
	LastUsedAt    time.Time `json:"last_used_at"`
	DeviceName    string    `json:"device_name" gorm:"size:255"`
	LocationInfo  string    `json:"location_info" gorm:"size:255"`
	IsRemembered  bool      `json:"is_remembered" gorm:"default:false"`
	SecurityFlags int       `json:"security_flags" gorm:"default:0"`
}

type SessionConfig struct {
	MaxSessions          int           `json:"max_sessions"`
	DefaultExpiration    time.Duration `json:"default_expiration"`
	RememberMeExpiration time.Duration `json:"remember_me_expiration"`
	IdleTimeout          time.Duration `json:"idle_timeout"`
	RequireSecureHeaders bool          `json:"require_secure_headers"`
	EnableGeoTracking    bool          `json:"enable_geo_tracking"`
	EnableDeviceTracking bool          `json:"enable_device_tracking"`
	AutoCleanupInterval  time.Duration `json:"auto_cleanup_interval"`
}

type SessionService struct {
	// contains filtered or unexported fields
}

type SessionStats struct {
	TotalSessions  int64     `json:"total_sessions"`
	ActiveSessions int64     `json:"active_sessions"`
	LastCleanup    time.Time `json:"last_cleanup"`
}

type TemplatedEmailService struct {
	// contains filtered or unexported fields
}

type TokenBlacklist struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	TokenHash     string    `json:"-" gorm:"uniqueIndex;not null;size:64"`
	UserID        uuid.UUID `json:"user_id" gorm:"type:uuid;index"`
	ExpiresAt     time.Time `json:"expires_at" gorm:"not null"`
	Reason        string    `json:"reason" gorm:"size:255"`
	BlacklistedBy uuid.UUID `json:"blacklisted_by" gorm:"type:uuid"`
}

type TokenBlacklistService struct {
	// contains filtered or unexported fields
}

type WebAuthnCredential struct {
	ID        uuid.UUID      `json:"id" gorm:"type:uuid;primaryKey;default:(gen_random_uuid())"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
	DeletedAt gorm.DeletedAt `json:"-" gorm:"index"`

	UserID       uuid.UUID  `json:"user_id" gorm:"type:uuid;not null;index"`
	CredentialID string     `json:"credential_id" gorm:"not null;uniqueIndex;size:255"`
	PublicKey    []byte     `json:"public_key" gorm:"not null"`
	Name         string     `json:"name" gorm:"not null;size:255"`
	SignCount    uint32     `json:"sign_count" gorm:"default:0"`
	LastUsedAt   *time.Time `json:"last_used_at"`

	// Relationships
	User models.User `json:"user,omitempty" gorm:"foreignKey:UserID"`
}

type WebAuthnLoginRequest struct {
	UserID uuid.UUID `json:"user_id"`
}

type WebAuthnLoginResponse struct {
	Options string `json:"options"` // JSON string of WebAuthn assertion options
}

type WebAuthnRegistrationRequest struct {
	UserID uuid.UUID `json:"user_id"`
	Name   string    `json:"name"`
}

type WebAuthnRegistrationResponse struct {
	Options string `json:"options"` // JSON string of WebAuthn creation options
}