service

type ActorContextKey struct{}

type AppleIDTokenClaims struct {
	Issuer         string `json:"iss"`
	Subject        string `json:"sub"`              // User's unique identifier
	Audience       string `json:"aud"`              // Your client_id
	ExpiresAt      int64  `json:"exp"`              // Expiration time
	IssuedAt       int64  `json:"iat"`              // Issued at time
	Email          string `json:"email"`            // User's email (may be private relay)
	EmailVerified  string `json:"email_verified"`   // "true" or "false" as string
	IsPrivateEmail string `json:"is_private_email"` // Whether email is a private relay
	Nonce          string `json:"nonce"`            // Nonce for replay prevention
	AuthTime       int64  `json:"auth_time"`        // Time of authentication
}

type AuditService interface {
	// Log creates a new audit log entry
	Log(ctx context.Context, log *domain.AuditLog) error

	// LogBatch creates multiple audit log entries
	LogBatch(ctx context.Context, logs []*domain.AuditLog) error

	// LogAction is a convenience method to log an action
	LogAction(ctx context.Context, tenantID uuid.UUID, action domain.AuditAction, resourceType domain.AuditResourceType, resourceID string, status domain.AuditStatus, details map[string]interface{}) error

	// LogUserAction logs an action performed by/on a user
	LogUserAction(ctx context.Context, tenantID, userID uuid.UUID, actorID *uuid.UUID, action domain.AuditAction, status domain.AuditStatus, details map[string]interface{}) error

	// LogSessionAction logs a session-related action
	LogSessionAction(ctx context.Context, tenantID, sessionID uuid.UUID, userID uuid.UUID, action domain.AuditAction, status domain.AuditStatus, details map[string]interface{}) error

	// Query retrieves audit logs with filtering
	Query(ctx context.Context, filter repository.AuditLogFilter) ([]domain.AuditLog, int64, error)
}

type AuthService struct {
	authv1.UnimplementedAuthServiceServer
	// contains filtered or unexported fields
}

type CacheService interface {
	Get(key string) (interface{}, bool)
	Set(key string, value interface{})
	SetWithTTL(key string, value interface{}, ttl time.Duration)
	Delete(key string)
	Clear()
	Close() error
}

type Claims struct {
	UserID string            `json:"user_id"`
	Email  string            `json:"email"`
	Type   TokenType         `json:"type"`
	Extra  map[string]string `json:"extra,omitempty"`
	jwt.RegisteredClaims
}

type DefaultLogger struct {
	// contains filtered or unexported fields
}

type EmailService interface {
	SendVerificationEmail(to, token string) error
	SendPasswordResetEmail(to, token string) error
	SendPasswordlessEmail(to, token string) error
	Send2FACode(to, code string) error
	SendWelcomeEmail(to, name string) error
}

type EmailTemplate string

type EmailTemplateData struct {
	AppName         string
	VerificationURL string
	ResetURL        string
	LoginURL        string
	Code            string
	Name            string
}

type IPAddressKey struct{}

type JWTService interface {
	GenerateAccessToken(userID uuid.UUID, email string, extra map[string]string) (string, error)
	GenerateRefreshToken(userID uuid.UUID, email string) (string, error)
	ValidateToken(token string, tokenType TokenType) (*Claims, error)
	ParseToken(token string) (*Claims, error)
}

type LogLevel int

type Logger interface {
	// Error logs an error message with optional context
	Error(msg string, keysAndValues ...interface{})
	// Warn logs a warning message with optional context
	Warn(msg string, keysAndValues ...interface{})
	// Info logs an info message with optional context
	Info(msg string, keysAndValues ...interface{})
	// Debug logs a debug message with optional context
	Debug(msg string, keysAndValues ...interface{})
}

type LoginProtectionConfig struct {
	// Maximum failed login attempts before lockout
	MaxFailedAttempts int
	// Time window to count failed attempts
	FailedAttemptsWindow time.Duration
	// Lockout duration after max failed attempts
	LockoutDuration time.Duration
	// Progressive lockout multiplier for repeat offenders
	LockoutMultiplier float64
	// Maximum lockout duration
	MaxLockoutDuration time.Duration
	// IP-based rate limiting threshold
	IPRateLimitThreshold int
	// IP rate limit window
	IPRateLimitWindow time.Duration
}

type LoginProtectionService interface {
	// CheckLoginAllowed checks if login is allowed for the given email/IP
	CheckLoginAllowed(ctx context.Context, tenantID uuid.UUID, email, ipAddress string) error

	// RecordLoginAttempt records a login attempt (success or failure)
	RecordLoginAttempt(ctx context.Context, tenantID uuid.UUID, email, ipAddress string, userID *uuid.UUID, success bool, failureReason string) error

	// GetActiveLockout gets the active lockout for a user if any
	GetActiveLockout(ctx context.Context, tenantID, userID uuid.UUID) (*domain.AccountLockout, error)

	// UnlockAccount manually unlocks an account (admin action)
	UnlockAccount(ctx context.Context, tenantID, userID uuid.UUID, unlockedBy *uuid.UUID) error

	// CleanupExpired removes expired records
	CleanupExpired(ctx context.Context) error
}

type NopLogger struct{}

type OAuthProvider string

type OAuthService interface {
	GetAuthURL(provider OAuthProvider, state string) (string, error)
	ExchangeCode(provider OAuthProvider, code string) (*oauth2.Token, error)
	GetUserInfo(provider OAuthProvider, token *oauth2.Token) (*OAuthUserInfo, error)
	GenerateState() (string, error)
}

type OAuthUserInfo struct {
	ProviderUserID string
	Email          string
	FirstName      string
	LastName       string
	Picture        string
}

type PasswordHistoryConfig struct {
	// Number of previous passwords to check against
	HistoryCount int
	// Minimum days before password can be reused (0 = never)
	MinPasswordAgeDays int
}

type PasswordHistoryService interface {
	// CheckPasswordReuse checks if the password was used recently
	CheckPasswordReuse(ctx context.Context, tenantID, userID uuid.UUID, newPassword string) error

	// RecordPassword records a password in history
	RecordPassword(ctx context.Context, tenantID, userID uuid.UUID, passwordHash string) error

	// CleanupOldHistory removes old password history entries
	CleanupOldHistory(ctx context.Context, tenantID, userID uuid.UUID) error
}

type PasswordService interface {
	HashPassword(password string) (string, error)
	VerifyPassword(hashedPassword, password string) error
	ValidatePasswordStrength(password string) error
}

type PasswordlessService interface {
	GenerateToken(tenantID uuid.UUID, email string) (*domain.OTP, error)
	VerifyToken(tenantID uuid.UUID, token string) (*domain.OTP, error)
}

type SessionConfig struct {
	// Session expiry duration
	SessionExpiry time.Duration
	// Idle timeout duration (HIPAA compliance)
	IdleTimeout time.Duration
	// Maximum concurrent sessions per user (0 = unlimited)
	MaxConcurrentSessions int
}

type TOTPService interface {
	GenerateSecret(email string) (secret string, qrCodeURL string, err error)
	ValidateCode(secret, code string) bool
	GenerateBackupCodes(count int) ([]string, error)
}

type TenantContextKey struct{}

type TokenType string

type UserAgentKey struct{}