goauth

type APIKey struct {
	ID        string
	UserID    string
	Name      string
	KeyPrefix string // First 8 chars for identification
	KeyHash   []byte // SHA-256 hash of full key
	Scopes    []string
	ExpiresAt *time.Time
	LastUsed  time.Time
	CreatedAt time.Time
	RateLimit int // Requests per minute, 0 = default
}

type APIKeyStore interface {
	CreateAPIKey(ctx context.Context, key APIKey) error
	GetAPIKeyByHash(ctx context.Context, keyHash []byte) (*APIKey, error)
	GetUserAPIKeys(ctx context.Context, userID string) ([]APIKey, error)
	UpdateAPIKeyLastUsed(ctx context.Context, keyID string) error
	RevokeAPIKey(ctx context.Context, keyID string) error
}

type AWSSSMConfig struct {
	JWTParameter        string
	EncryptionParameter string
	PepperParameter     string
	Region              string
}

type AWSSecretsConfig struct {
	// SecretName is the name of the secret in AWS
	SecretName string
	// Region is the AWS region
	Region string
	// Keys maps secret keys (optional)
	Keys map[string]string
}

type AuditExporter interface {
	ExportUserAuditLogs(ctx context.Context, userID string, format string) ([]byte, error)
	ExportTenantAuditLogs(ctx context.Context, tenantID string, from, to time.Time, format string) ([]byte, error)
}

type AuditLog struct {
	ID            string
	UserID        string
	TenantID      string
	EventType     string
	IPEncrypted   []byte
	IPNonce       []byte
	UserAgentHash []byte
	Metadata      map[string]any
	MetadataEnc   []byte
	MetadataNonce []byte
	ExpiresAt     time.Time
	CreatedAt     time.Time
}

type AuditStore interface {
	InsertAuditLog(ctx context.Context, log AuditLog) error
	GetUserAuditLogs(ctx context.Context, userID string, limit int) ([]AuditLog, error)
}

type AuthError struct {
	// Code is a machine-readable error code
	Code string `json:"code"`
	// Message is a human-readable error message safe for users
	Message string `json:"message"`
	// Internal is the underlying error (not included in JSON)
	Internal error `json:"-"`
}

type AuthService struct {
	// contains filtered or unexported fields
}

type BackgroundJobs struct {
	// contains filtered or unexported fields
}

type BaseOAuthProvider struct {
	// contains filtered or unexported fields
}

type BiometricChallenge struct {
	Challenge string    `json:"challenge"`
	ExpiresAt time.Time `json:"expires_at"`
}

type BreachNotification struct {
	BreachName  string
	BreachDate  time.Time
	DataTypes   []string // "password", "email", "address", etc.
	Description string
	SourceURL   string
}

type CaptchaPolicy struct {
	Required        bool
	OnRegister      bool
	OnLogin         bool
	OnPasswordReset bool
	OnMagicLink     bool
}

type CaptchaProvider interface {
	// Name returns the provider name
	Name() string
	// Verify checks if the CAPTCHA token is valid
	Verify(ctx context.Context, token, ip string) (bool, error)
}

type CircuitBreaker struct {
	// contains filtered or unexported fields
}

type CircuitState int

type ClientConfig struct {
	AccessTokenTTL  time.Duration
	RefreshTokenTTL time.Duration
	AllowRememberMe bool
	MaxDevices      int
}

type ClientType string

type ComponentHealth struct {
	Status  string `json:"status"`
	Latency string `json:"latency,omitempty"`
	Error   string `json:"error,omitempty"`
}

type Config struct {
	// ==================== APP INFO ====================
	AppName      string
	AppBaseURL   string
	CallbackPath string

	// ==================== FEATURE TOGGLES ====================
	EmailPasswordEnabled      bool
	EmailVerificationRequired bool
	TOTPEnabled               bool
	PasswordResetEnabled      bool
	MagicLinksEnabled         bool
	APIKeysEnabled            bool
	DeviceManagementEnabled   bool

	// ==================== USERNAME ====================
	UsernameEnabled          bool
	UsernameRequired         bool
	MinUsernameLength        int
	MaxUsernameLength        int
	UsernamePattern          string
	UsernameReserved         []string
	UsernameAllowNumericOnly bool

	// ==================== TOKEN SETTINGS ====================
	AccessTokenTTL      time.Duration
	RefreshTokenTTL     time.Duration
	VerificationCodeTTL time.Duration
	PasswordResetTTL    time.Duration
	MagicLinkTTL        time.Duration
	EmailChangeTTL      time.Duration

	// ==================== 2FA/TOTP ====================
	TOTPDigits           int
	TOTPAccountName      string
	TOTPUseUsername      bool
	TOTPQRCodeEnabled    bool
	TOTPQRCodeSize       int
	BackupCodeLength     int
	BackupCodeDigitsOnly bool
	BackupCodeCount      int

	// ==================== SECURITY ====================
	MaxLoginAttempts          int
	LockoutDuration           time.Duration
	MaxVerificationAttempts   int
	PasswordHistorySize       int
	MinPasswordLength         int
	RequirePasswordComplexity bool
	RotateRefreshTokens       bool
	BlockDisposableEmails     bool
	DisposableEmailDomains    []string

	RequireVerifiedEmailForAuth bool
	Require2FAForAuth           bool
	Require2FAForOAuth          bool
	Require2FAForMagicLink      bool
	Require2FAForSDK            bool
	Require2FAForEmailChange    bool

	AllowOAuthEmailLinking           bool
	AllowUnverifiedOAuthEmailLinking bool

	TrustProxyHeaders bool
	TrustedProxies    []string

	RateLimits RateLimitConfig
	IPBlock    IPBlockConfig

	// ==================== PRIVACY ====================
	IPPrivacy              IPPrivacyConfig
	AuditLogRetention      time.Duration
	UnverifiedAccountTTL   time.Duration
	StoreUserAgentHash     bool
	NotifyOnPasswordChange bool
	NotifyOnEmailChange    bool

	// ==================== EXTERNAL SERVICES ====================
	TurnstileEnabled       bool
	TurnstileSecret        string
	TurnstileVerifyURL     string
	HIBPEnabled            bool
	HIBPAPIURL             string
	EmailDomainCheck       bool
	CaptchaFailOpen        bool
	CaptchaRequired        bool
	CaptchaOnRegister      bool
	CaptchaOnLogin         bool
	CaptchaOnPasswordReset bool
	CaptchaOnMagicLink     bool

	// ==================== WEBAUTHN ====================
	WebAuthn        WebAuthnConfig
	WebAuthnEnabled bool
	AllowRememberMe bool
	MaxDevices      int // 0 = unlimited

	// ==================== DEBUG / HOOKS ====================
	OAuthSuccessHandler func(w http.ResponseWriter, r *http.Request, provider string, user *OAuthUser, tokens *OAuthTokens) bool

	// ==================== CLIENT CONFIGS ====================
	WebClientConfig    ClientConfig
	MobileClientConfig ClientConfig
	APIClientConfig    ClientConfig
}

type CustomOAuthProvider struct {
	BaseOAuthProvider
}

type DataExporter interface {
	ExportUserData(ctx context.Context, userID string) ([]byte, error)
}

type Device struct {
	ID           string
	UserID       string
	Name         string // "Chrome on Windows", "iPhone 15"
	DeviceType   string // "browser", "mobile", "desktop", "api"
	LastIP       string // Last seen IP (encrypted or hashed based on config)
	LastIPNonce  []byte
	LastActive   time.Time
	CreatedAt    time.Time
	RefreshToken string // JTI of the associated refresh token
	TrustLevel   string // "untrusted", "trusted", "remembered"
	Fingerprint  string // Device fingerprint hash
}

type DeviceStore interface {
	// CreateDevice creates a new device entry.
	CreateDevice(ctx context.Context, device Device) error
	// GetUserDevices returns all devices for a user.
	GetUserDevices(ctx context.Context, userID string) ([]Device, error)
	// GetDevice returns a specific device.
	GetDevice(ctx context.Context, deviceID string) (*Device, error)
	// UpdateDeviceActivity updates last active time and IP.
	UpdateDeviceActivity(ctx context.Context, deviceID string, ip []byte, ipNonce []byte) error
	// RevokeDevice removes a device and its associated tokens.
	RevokeDevice(ctx context.Context, deviceID string) error
	// RevokeAllDevices removes all devices for a user except current.
	RevokeAllDevices(ctx context.Context, userID, exceptDeviceID string) error
	// TrustDevice marks a device as trusted (skip 2FA).
	TrustDevice(ctx context.Context, deviceID string, trustLevel string) error
}

type DiscordOption func(*DiscordProvider)

type DiscordProvider struct {
	BaseOAuthProvider
}

type EmailChangeMailer interface {
	SendEmailChange(ctx context.Context, to, link string) error
}

type EmailChangeToken struct {
	ID                string
	UserID            string
	TokenHash         []byte
	NewEmailHash      []byte
	NewEmailEncrypted []byte
	NewEmailNonce     []byte
	ExpiresAt         time.Time
	Used              bool
}

type EmailChangedMailer interface {
	SendEmailChanged(ctx context.Context, to, newEmail string) error
}

type GitHubOption func(*GitHubProvider)

type GitHubProvider struct {
	BaseOAuthProvider
}

type GoogleOption func(*GoogleProvider)

type GoogleProvider struct {
	BaseOAuthProvider
}

type GracefulShutdown struct {
	// contains filtered or unexported fields
}

type HCaptchaProvider struct {
	// contains filtered or unexported fields
}

type HTTPClientPool struct {
	// contains filtered or unexported fields
}

type HealthChecker interface {
	Ping(ctx context.Context) error
}

type HealthStatus struct {
	Status    string                     `json:"status"`
	Version   string                     `json:"version"`
	Uptime    string                     `json:"uptime"`
	Checks    map[string]ComponentHealth `json:"checks,omitempty"`
	Timestamp time.Time                  `json:"timestamp"`
}

type IPBlockConfig struct {
	Enabled          bool
	FailureThreshold int
	FailureWindow    time.Duration
	BlockDuration    time.Duration
}

type IPBlocker interface {
	IsBlocked(ctx context.Context, ip string) (bool, time.Time, error)
	Block(ctx context.Context, ip string, duration time.Duration, reason string) error
	Unblock(ctx context.Context, ip string) error
}

type IPIntelligence interface {
	// Check returns reputation info for an IP.
	Check(ctx context.Context, ip string) (*IPReputation, error)
}

type IPPrivacyConfig struct {
	StoreIP         bool
	EncryptIP       bool
	HashIPInLogs    bool
	IPRetentionDays int
}

type IPReputation struct {
	IP           string
	IsProxy      bool
	IsVPN        bool
	IsTor        bool
	IsDatacenter bool
	IsBotnet     bool
	ThreatScore  float64 // 0-1, higher = more risky
	Country      string
	City         string
	ISP          string
}

type JobOption func(*jobConfig)

type MagicLinkMailer interface {
	SendMagicLink(ctx context.Context, to, link string) error
}

type MagicLinkStore interface {
	CreateMagicLinkToken(ctx context.Context, token MagicLinkToken) error
	GetMagicLinkToken(ctx context.Context, tokenHash []byte) (*MagicLinkToken, error)
	MarkMagicLinkUsed(ctx context.Context, tokenID string, ipUsed, ipNonce []byte) error
}

type MagicLinkToken struct {
	ID        string
	UserID    string
	TokenHash []byte
	ExpiresAt time.Time
	Used      bool
	IPCreated []byte
	IPNonce   []byte
}

type Mailer interface {
	SendVerification(ctx context.Context, to, code, link string) error
	SendPasswordReset(ctx context.Context, to, link string) error
}

type MemoryBlacklist struct {
	// contains filtered or unexported fields
}

type Metrics struct {
	// contains filtered or unexported fields
}

type MicrosoftProvider struct {
	BaseOAuthProvider
}

type OAuthConnection struct {
	ID           string
	UserID       string
	Provider     string
	ProviderID   string
	AccessToken  []byte // Encrypted
	RefreshToken []byte // Encrypted
	ExpiresAt    *time.Time
	CreatedAt    time.Time
}

type OAuthConnectionStore interface {
	GetUserByOAuthProvider(ctx context.Context, provider, providerUserID string) (*User, error)
	LinkOAuthConnection(ctx context.Context, userID, provider, providerUserID string) error
	UnlinkOAuthConnection(ctx context.Context, userID, provider string) error
	GetUserOAuthConnections(ctx context.Context, userID string) ([]OAuthConnection, error)
}

type OAuthProvider interface {
	Name() string
	AuthURL(state, redirectURL string) string
	ExchangeCode(ctx context.Context, code, redirectURL string) (*OAuthTokens, error)
	GetUser(ctx context.Context, accessToken string) (*OAuthUser, error)
}

type OAuthRefresher interface {
	RefreshToken(ctx context.Context, refreshToken string) (*OAuthTokens, error)
}

type OAuthRevoker interface {
	RevokeToken(ctx context.Context, accessToken string) error
}

type OAuthTokenManager struct {
	// contains filtered or unexported fields
}

type OAuthTokenStore interface {
	StoreOAuthTokens(ctx context.Context, userID, provider string, accessEnc, accessNonce, refreshEnc, refreshNonce []byte, expiresAt time.Time) error
	GetOAuthTokens(ctx context.Context, userID, provider string) (accessEnc, accessNonce, refreshEnc, refreshNonce []byte, expiresAt time.Time, err error)
	DeleteOAuthTokens(ctx context.Context, userID, provider string) error
}

type OAuthTokens struct {
	AccessToken  string
	RefreshToken string
	ExpiresIn    int
	TokenType    string
}

type OAuthUser struct {
	ID            string
	Email         string
	EmailVerified bool
	Name          string
	Avatar        string
	Raw           map[string]any
}

type Option func(*AuthService) error

type PasswordChangeMailer interface {
	SendPasswordChanged(ctx context.Context, to string) error
}

type PasswordHistory struct {
	Hash []byte
	Salt []byte
}

type PasswordResetToken struct {
	ID        string
	UserID    string
	TokenHash []byte
	ExpiresAt time.Time
	Used      bool
}

type Permission string

type Profile struct {
	UserID          string
	DisplayName     string
	DisplayPhotoURL string
	Bio             string
	Locale          string
	Timezone        string
	Metadata        map[string]any
	CreatedAt       time.Time
	UpdatedAt       time.Time
}

type ProfileProvider interface {
	Profiles() ProfileStore
}

type ProfileStore interface {
	GetProfile(ctx context.Context, userID string) (*Profile, error)
	UpsertProfile(ctx context.Context, profile Profile) error
	DeleteProfile(ctx context.Context, userID string) error
}

type RateLimitConfig struct {
	LoginLimit          int
	LoginWindow         time.Duration
	TwoFALimit          int
	TwoFAWindow         time.Duration
	RegisterLimit       int
	RegisterWindow      time.Duration
	PasswordResetLimit  int
	PasswordResetWindow time.Duration
	MagicLinkLimit      int
	MagicLinkWindow     time.Duration
}

type RateLimiter interface {
	Allow(ctx context.Context, key string, limit int, window time.Duration) (allowed bool, remaining int, err error)
}

type ReCaptchaConfig struct {
	// Secret is your reCAPTCHA secret key
	Secret string
	// MinScore is the minimum score for v3 (0.0 to 1.0, default 0.5)
	MinScore float64
	// IsV3 indicates whether this is reCAPTCHA v3 (score-based)
	IsV3 bool
}

type ReCaptchaProvider struct {
	// contains filtered or unexported fields
}

type RedisBlacklist struct {
	// contains filtered or unexported fields
}

type RequestDeduplicator struct {
	// contains filtered or unexported fields
}

type RequestTracker struct {
	// contains filtered or unexported fields
}

type ResourceChecker func(ctx context.Context, user *User, resourceID string) bool

type Role string

type SDKToken struct {
	UserID    string
	DeviceID  string
	Scopes    []string
	ExpiresAt time.Time
}

type Scope string

type Secrets struct {
	JWTSecret     []byte
	EncryptionKey []byte
	Pepper        []byte
}

type SecurityAlert struct {
	Type      string
	UserID    string
	IP        string
	Details   map[string]any
	Severity  string // "low", "medium", "high", "critical"
	Timestamp time.Time
}

type SecurityAlertMailer interface {
	SendSecurityAlert(ctx context.Context, to, event, details string) error
}

type SecurityMode string

type SecurityMonitor interface {
	OnAlert(ctx context.Context, alert SecurityAlert)
}

type Session struct {
	ID         string
	UserID     string
	TenantID   string // For multi-tenant
	DeviceID   string
	ExpiresAt  time.Time
	CreatedAt  time.Time
	LastActive time.Time
	IPAddress  []byte // Encrypted
	IPNonce    []byte
	UserAgent  string
	Data       map[string]any // Custom session data
}

type SessionStore interface {
	CreateSession(ctx context.Context, session Session) error
	GetSession(ctx context.Context, sessionID string) (*Session, error)
	UpdateSession(ctx context.Context, sessionID string, data map[string]any) error
	ExtendSession(ctx context.Context, sessionID string, expiresAt time.Time) error
	DeleteSession(ctx context.Context, sessionID string) error
	DeleteUserSessions(ctx context.Context, userID string) error
}

type SlidingWindowRateLimiter struct {
	// contains filtered or unexported fields
}

type Store interface {
	Users() UserStore
	Tokens() TokenStore
	Audit() AuditStore
}

type StoreCleaner interface {
	// CleanupExpiredTokens removes all expired tokens.
	CleanupExpiredTokens(ctx context.Context) (int64, error)
	// CleanupOldAuditLogs removes audit logs older than retention period.
	CleanupOldAuditLogs(ctx context.Context, retention time.Duration) (int64, error)
	// CleanupUnverifiedAccounts removes unverified accounts past deadline.
	CleanupUnverifiedAccounts(ctx context.Context) (int64, error)
}

type Tenant struct {
	ID          string
	Name        string
	Slug        string // URL-friendly identifier
	Plan        string // "free", "pro", "enterprise"
	Settings    TenantSettings
	CreatedAt   time.Time
	SuspendedAt *time.Time
}

type TenantSettings struct {
	MaxUsers              int
	AllowedDomains        []string // Email domains allowed to register
	EnforceMFA            bool     // Require 2FA for all users
	SessionTimeout        time.Duration
	AllowedOAuthProviders []string
	CustomBranding        map[string]string // logo_url, primary_color, etc.
}

type TenantStore interface {
	GetTenant(ctx context.Context, tenantID string) (*Tenant, error)
	GetTenantBySlug(ctx context.Context, slug string) (*Tenant, error)
	CreateTenant(ctx context.Context, tenant Tenant) (string, error)
	UpdateTenantSettings(ctx context.Context, tenantID string, settings TenantSettings) error
	GetUserTenants(ctx context.Context, userID string) ([]Tenant, error)
}

type TokenBlacklist interface {
	// Add adds a token to the blacklist until its expiry.
	Add(ctx context.Context, jti string, expiresAt time.Time) error
	// IsBlacklisted checks if a token is blacklisted.
	IsBlacklisted(ctx context.Context, jti string) (bool, error)
	// Cleanup removes expired entries (for in-memory implementation).
	Cleanup()
}

type TokenStore interface {
	CreateVerificationToken(ctx context.Context, token VerificationToken, ipEnc, ipNonce []byte) (string, error)
	GetActiveVerificationToken(ctx context.Context, userID string) (*VerificationToken, error)
	GetVerificationTokenByLinkHash(ctx context.Context, linkHash []byte) (*VerificationToken, error)
	IncrementVerificationAttempts(ctx context.Context, tokenID string) (int, error)
	MarkVerificationTokenUsed(ctx context.Context, tokenID string, ipEnc, ipNonce []byte) error
	CreatePasswordResetToken(ctx context.Context, token PasswordResetToken, ipEnc, ipNonce []byte) (string, error)
	GetPasswordResetTokenByHash(ctx context.Context, tokenHash []byte) (*PasswordResetToken, error)
	MarkPasswordResetUsed(ctx context.Context, tokenID string, ipEnc, ipNonce []byte) error
	CreateEmailChangeToken(ctx context.Context, token EmailChangeToken, ipEnc, ipNonce []byte) (string, error)
	GetEmailChangeTokenByHash(ctx context.Context, tokenHash []byte) (*EmailChangeToken, error)
	MarkEmailChangeUsed(ctx context.Context, tokenID string, ipEnc, ipNonce []byte) error
	StoreRefreshToken(ctx context.Context, userID, jti string, expiresAt time.Time, ipEnc, ipNonce []byte) error
	RefreshTokenValid(ctx context.Context, jti string) (bool, error)
	RevokeRefreshToken(ctx context.Context, jti string) error
	RevokeAllRefreshTokens(ctx context.Context, userID string) error
}

type TurnstileProvider struct {
	// contains filtered or unexported fields
}

type TwitchProvider struct {
	BaseOAuthProvider
}

type User struct {
	ID                   string
	EmailHash            []byte
	EmailEncrypted       []byte
	EmailNonce           []byte
	Username             string
	UsernameNormalized   string
	PasswordHash         []byte
	PasswordSalt         []byte
	TOTPSecretEncrypted  []byte
	TOTPNonce            []byte
	TOTPEnabled          bool
	EmailVerified        bool
	AccountStatus        string
	Role                 string
	FailedLoginAttempts  int
	LockedAt             *time.Time
	LastLoginAt          *time.Time
	LastLoginIPEncrypted []byte
	LastLoginIPNonce     []byte
	CreatedAt            time.Time
	UpdatedAt            time.Time
	Metadata             map[string]any
}

type UserDeleter interface {
	DeleteUser(ctx context.Context, userID string) error
}

type UserStore interface {
	EmailExists(ctx context.Context, emailHash []byte) (bool, error)
	UsernameExists(ctx context.Context, usernameNormalized string) (bool, error)
	CreateUser(ctx context.Context, user User, verificationDeadline time.Time) (string, error)
	GetUserByEmailHash(ctx context.Context, emailHash []byte) (*User, error)
	GetUserByUsername(ctx context.Context, usernameNormalized string) (*User, error)
	GetUserByID(ctx context.Context, userID string) (*User, error)
	SetUserVerified(ctx context.Context, userID string) error
	IncrementLoginFailures(ctx context.Context, userID string) (int, error)
	LockUser(ctx context.Context, userID string) error
	UnlockUser(ctx context.Context, userID string) error
	ResetLoginFailures(ctx context.Context, userID string) error
	UpdateLastLogin(ctx context.Context, userID string, ipEnc, ipNonce []byte) error
	UpdateUsername(ctx context.Context, userID, username, usernameNormalized string) error
	UpdatePassword(ctx context.Context, userID string, hash, salt []byte) error
	UpdateEmail(ctx context.Context, userID string, emailHash, emailEnc, emailNonce []byte, verified bool) error
	RecentPasswordHistory(ctx context.Context, userID string, limit int) ([]PasswordHistory, error)
	UpdateTOTPSecret(ctx context.Context, userID string, secretEnc, secretNonce []byte) error
	EnableTOTP(ctx context.Context, userID string) error
	DisableTOTP(ctx context.Context, userID string) error
	ReplaceBackupCodes(ctx context.Context, userID string, hashes [][]byte) error
	UseBackupCode(ctx context.Context, userID string, codeHash []byte) (bool, error)
	UpdateUserRole(ctx context.Context, userID string, role string) error
}

type VaultConfig struct {
	// Address is the Vault server address (e.g., https://vault.example.com)
	Address string
	// Token is the Vault authentication token
	Token string
	// Path is the secret path (e.g., secret/data/myapp)
	Path string
	// Keys maps secret keys to our expected keys (optional)
	// Default: jwt_secret, encryption_key, pepper
	Keys map[string]string
}

type VerificationToken struct {
	ID           string
	UserID       string
	CodeHash     []byte
	LinkHash     []byte
	EmailHash    []byte
	ExpiresAt    time.Time
	CodeAttempts int
	MaxAttempts  int
	Used         bool
}

type WebAuthnChallenge struct {
	Challenge   []byte
	UserID      string
	SessionData []byte
	ExpiresAt   time.Time
	Type        string // "registration" or "authentication"
}

type WebAuthnConfig struct {
	// RPDisplayName is the display name of your application
	RPDisplayName string
	// RPID is the relying party ID (usually your domain without protocol)
	RPID string
	// RPOrigins are the allowed origins for WebAuthn requests
	RPOrigins []string
	// Timeout for challenges in milliseconds
	Timeout int
	// AttestationPreference: "none", "indirect", or "direct"
	AttestationPreference string
	// UserVerification: "required", "preferred", or "discouraged"
	UserVerification string
	// ResidentKeyRequirement: "required", "preferred", or "discouraged"
	ResidentKeyRequirement string
	// AllowCredentials enables discoverable credentials (passkeys)
	AllowCredentials bool
	// MaxPasskeysPerUser limits how many passkeys a user can register (0 = unlimited)
	MaxPasskeysPerUser int
	// AllowPasskeysForRoles limits passkey registration to specific roles (empty = allow all)
	AllowPasskeysForRoles []Role
}

type WebAuthnCredential struct {
	ID              string     `json:"id"`
	UserID          string     `json:"user_id"`
	CredentialID    []byte     `json:"credential_id"`
	PublicKey       []byte     `json:"public_key"`
	AttestationType string     `json:"attestation_type"`
	AAGUID          []byte     `json:"aaguid"`
	SignCount       uint32     `json:"sign_count"`
	CloneWarning    bool       `json:"clone_warning"`
	Transports      []string   `json:"transports,omitempty"`
	CreatedAt       time.Time  `json:"created_at"`
	LastUsedAt      *time.Time `json:"last_used_at,omitempty"`
	Name            string     `json:"name"`
}

type WebAuthnNameStore interface {
	UpdateCredentialName(ctx context.Context, userID string, credentialID []byte, name string) error
}

type WebAuthnStore interface {
	// Credentials
	CreateCredential(ctx context.Context, cred WebAuthnCredential) error
	GetCredentialByID(ctx context.Context, credentialID []byte) (*WebAuthnCredential, error)
	GetUserCredentials(ctx context.Context, userID string) ([]WebAuthnCredential, error)
	UpdateCredentialSignCount(ctx context.Context, credentialID []byte, signCount uint32) error
	DeleteCredential(ctx context.Context, userID string, credentialID []byte) error

	// Challenges
	StoreChallenge(ctx context.Context, challenge WebAuthnChallenge) error
	GetChallenge(ctx context.Context, challenge []byte) (*WebAuthnChallenge, error)
	DeleteChallenge(ctx context.Context, challenge []byte) error
}

type WebAuthnUsageStore interface {
	UpdateCredentialUsage(ctx context.Context, credentialID []byte, signCount uint32, lastUsedAt time.Time) error
}

type Webhook struct {
	ID        string
	URL       string
	Secret    string // For signature verification
	Events    []WebhookEvent
	TenantID  string // Optional, for multi-tenant
	Active    bool
	CreatedAt time.Time
}

type WebhookEvent string

type WebhookPayload struct {
	Event     WebhookEvent   `json:"event"`
	Timestamp time.Time      `json:"timestamp"`
	Data      map[string]any `json:"data"`
}

type WebhookStore interface {
	GetActiveWebhooks(ctx context.Context, event WebhookEvent, tenantID string) ([]Webhook, error)
	CreateWebhook(ctx context.Context, webhook Webhook) (string, error)
	DeleteWebhook(ctx context.Context, webhookID string) error
}

type WelcomeMailer interface {
	SendWelcome(ctx context.Context, to, name string) error
}