papers

type AccessToken struct {
	Identity    int64     `json:"id"`
	Token       string    `json:"to"`
	Expiration  time.Time `json:"ex"`
	Roles       []string  `json:"ro"`
	Permissions []string  `json:"pe"`
	Chain       string    `json:"ch"`
}

type Config struct {
	Storage struct {
		Users      UserStorage
		Tokens     TokenStorage
		Cookies    CookieStorage
		Session    SessionStorage
		TokenCache TokenCache
	}

	Mailer struct {
		Mailer Mailer
		From   Email
	}

	Routes struct {
		// Path of the confirmation page with a printf style placeholder for the token, e.g. /confirm/%s
		Confirm string
		// Path of the recovery page for the forgot password flow with a printf style placeholder for the token, e.g. /recover/%s
		Recover string
	}

	// Adapter for getting parameters from the current request
	RouteParams RouteParams

	// Complete root level URL of the application, with no trailing slash, e.g. https://example.com
	BaseURL string
	// Name of the application (used when generating TOTP secret)
	ApplicationName string

	// Key to use when storing the logged in User in the request context
	UserContextKey string

	// Require a standard email/password account to be confirmed before being usable
	RequireConfirmation bool
	// Require a username when registering an account
	RequireUsername bool
	// Require usernames to be unique
	UniqueUsernames bool
	// Minimum length of a username
	UsernameMinLength int

	BCryptCost        int
	PasswordMinLength int
	// Require both lower and upper case letters
	PasswordRequireMixedCase bool
	// Require at least one number
	PasswordRequireNumbers bool
	// Require at least one special character
	PasswordRequireSpecials bool
	// Password length that other character requirements are ignored. Intended to allow for passphrases
	PasswordRelaxedLength int

	// Width/height of TOTP setup QR code
	TOTPQRSize int
	// If set, key used to encrypt the TOTP secret before saving it in storage. Must be 16/24/32 bytes for AES-128/AES-192/AES-256 respectively
	TOTPSecretEncryptionKey string

	OAuth2Providers map[string]OAuth2Provider

	// Name of the login token cookie
	LoginCookieName string
	// Name of the access token cookie
	AccessCookieName string
	// Name of the refresh token cookie
	RefreshCookieName string

	// How long until an access token expires
	AccessExpiration time.Duration
	// How long until a refresh token expires
	RefreshExpiration time.Duration
	// How long until a recovery token expires
	RecoveryExpiration time.Duration
	// How long tokens are cached before expiring
	TokenCacheExpiration time.Duration

	// How much leeway is given when checking token expiration
	ExpirationLeeway time.Duration

	// Store all access tokens for extra verification, instead of only storing invalidated access tokens
	StoreAllAccessTokens bool
	// Invalidate and issue a new refresh token each time a refresh token is used
	RotateRefreshTokens bool

	// How long to wait between pruning expired access tokens. 0 to disable
	PruneAccessTokensInterval time.Duration
	// How long to wait between pruning expired refresh tokens. 0 to disable
	PruneRefreshTokensInterval time.Duration

	// How old access tokens must be before they are pruned
	StaleAccessTokensAge time.Duration
	// How old refresh tokens must be before they are pruned
	StaleRefreshTokensAge time.Duration

	// Temporarily lock accounts that have too many failed login attempts
	Locking bool
	// The number of failed login attempts to allow before locking an account
	LockAttempts int
	// How long to wait after a failed login attempt before resetting the number of attempts
	LockWindow time.Duration
	// How long to lock an account after too many failed attempts
	LockDuration time.Duration
}

type ConstError string

type CookieStorage interface {
	Read(name string, r *http.Request, value interface{}) error
	Write(name string, w http.ResponseWriter, maxAge time.Duration, value interface{}) error
	Remove(name string, w http.ResponseWriter)
}

type Email struct {
	Address string
	Name    string
}

type Mailer interface {
	SendMessage(ctx context.Context, p *Papers, msg Message) error
}

type Message struct {
	Type    MessageType
	To      []Email
	Cc      []Email
	Bcc     []Email
	ReplyTo []Email
	Data    map[string]interface{}
}

type MessageType string

type OAuth2Identity interface {
	GetID() string
	GetEmail() string
}

type OAuth2Provider struct {
	Config      oauth2.Config
	GetIdentity func(ctx context.Context, cfg oauth2.Config, token *oauth2.Token) (OAuth2Identity, error)
}

type Papers struct {
	Config Config
	Logger *slog.Logger
	Roles  map[string][]string
}

type RefreshToken struct {
	Identity int64  `json:"id"`
	Token    string `json:"to"`
	Chain    string `json:"ch"`
	Limited  bool   `json:"li"`
}

type RouteParams interface {
	Get(r *http.Request, key string) string
}

type SessionStorage interface {
	Get(r *http.Request, key string) (string, error)
	Set(r *http.Request, key string, value string) error
	MultiSet(r *http.Request, vals map[string]string) error
	Delete(r *http.Request, key string) error
	MultiDelete(r *http.Request, keys []string) error
	Write(r *http.Request, w http.ResponseWriter) error
}

type TTLStorage interface {
	Set(key string, value string, expiration time.Duration)
	Get(key string) (string, bool)
}

type Token interface {
	GetUserID() int64
	GetToken() string
	GetValid() bool
	GetChain() string
	GetCreatedAt() time.Time

	SetUserID(id int64)
	SetToken(token string)
	SetValid(valid bool)
	SetChain(chain string)
	SetCreatedAt(at time.Time)
}

type TokenCache interface {
	IsTokenValid(token, chain string) (bool, bool)
	SetTokenValidity(token string, valid bool)
	SetChainValidity(chain string, valid bool)
}

type TokenStorage interface {
	CreateAccessToken(ctx context.Context, userID int64, token, chain string, valid bool) error
	CreateRefreshToken(ctx context.Context, userID int64, token, chain string, valid bool) error
	GetAccessToken(ctx context.Context, userID int64, token string) (Token, error)
	GetRefreshToken(ctx context.Context, userID int64, token string) (Token, error)
	InvalidateAccessTokens(ctx context.Context, userID int64) error
	InvalidateRefreshToken(ctx context.Context, userID int64, token string) error
	InvalidateRefreshTokens(ctx context.Context, userID int64) error
	InvalidateTokenChain(ctx context.Context, userID int64, chain string) error
	PruneAccessTokens(ctx context.Context, timeToStale time.Duration) error
	PruneRefreshTokens(ctx context.Context, timeToStale time.Duration) error
}

type User interface {
	GetID() int64
	GetEmail() string
	GetUsername() string
	GetPassword() string
	GetConfirmed() bool
	GetConfirmToken() string
	GetRecoveryToken() string
	GetLockedUntil() time.Time
	GetAttempts() int
	GetLastAttempt() time.Time
	GetCreatedAt() time.Time
	GetLastLogin() time.Time
	GetTOTPSecret() string
	GetRoles() []string

	SetID(id int64)
	SetEmail(email string)
	SetUsername(username string)
	SetPassword(password string)
	SetConfirmed(confirmed bool)
	SetConfirmToken(token string)
	SetRecoveryToken(token string)
	SetLockedUntil(until time.Time)
	SetAttempts(attempts int)
	SetLastAttempt(at time.Time)
	SetCreatedAt(at time.Time)
	SetLastLogin(at time.Time)
	SetTOTPSecret(secret string)
	SetRoles(roles []string)
}

type UserStorage interface {
	// Factory method that returns an empty User
	NewUser() User
	// Persists a new user. The storage implementation must call User.SetID with the new ID
	CreateUser(ctx context.Context, user User) error
	UpdateUser(ctx context.Context, user User) error
	CreateOAuth2Identity(ctx context.Context, user User, provider, identity string) error
	RemoveOAuth2Identity(ctx context.Context, user User, provider, identity string) error
	GetUserByID(ctx context.Context, id int64) (User, error)
	GetUserByEmail(ctx context.Context, email string) (User, error)
	GetUserByUsername(ctx context.Context, username string) (User, error)
	GetUserByOAuth2Identity(ctx context.Context, provider, identity string) (User, error)
	GetUserByConfirmationToken(ctx context.Context, token string) (User, error)
	GetUserByRecoveryToken(ctx context.Context, token string) (User, error)
	GetUserRoles(ctx context.Context, user User) ([]string, error)
	GetUserPermissions(ctx context.Context, user User) ([]string, error)
}