auth

type AttemptCounter struct {
	UserID      string    `json:"user_id"`
	Attempts    int       `json:"attempts"`
	LastAttempt time.Time `json:"last_attempt"`
	LockedUntil time.Time `json:"locked_until"`
}

type AuthCache struct {
	// contains filtered or unexported fields
}

type AuthConfig struct {
	HashMethod       string      `json:"hash_method"`       // "argon2" or "pbkdf2"
	Argon2Memory     uint32      `json:"argon2_memory"`     // Memory for Argon2 (KB)
	Argon2Time       uint32      `json:"argon2_time"`       // Time for Argon2 (iterations)
	Argon2Threads    uint8       `json:"argon2_threads"`    // Threads for Argon2
	Argon2KeyLength  uint32      `json:"argon2_key_length"` // Key length for Argon2
	PBKDF2Iterations int         `json:"pbkdf2_iterations"` // Iterations for PBKDF2
	PBKDF2KeyLength  int         `json:"pbkdf2_key_length"` // Key length for PBKDF2
	SaltLength       int         `json:"salt_length"`       // Salt length
	SessionTimeout   int         `json:"session_timeout"`   // Session timeout in seconds
	EnableMFA        bool        `json:"enable_mfa"`        // Enable MFA
	EnableOIDC       bool        `json:"enable_oidc"`       // Enable OIDC
	EnableLDAP       bool        `json:"enable_ldap"`       // Enable LDAP
	MFA              *MFAConfig  `json:"mfa,omitempty"`
	OIDC             *OIDCConfig `json:"oidc,omitempty"`
	LDAP             *LDAPConfig `json:"ldap,omitempty"`

	// OIDC fallback settings
	OIDCPrimary           bool     `json:"oidc_primary"`            // OIDC is primary auth method
	AllowPasswordFallback bool     `json:"allow_password_fallback"` // Allow password fallback for admin users
	AdminUsernames        []string `json:"admin_usernames"`         // List of admin usernames allowed password fallback
	RequireAdminMFA       bool     `json:"require_admin_mfa"`       // Require MFA for admin users
}

type AuthDigest string

type AuthManager struct {
	// contains filtered or unexported fields
}

type AuthResult struct {
	Success     bool      `json:"success"`
	User        *LDAPUser `json:"user,omitempty"`
	Error       string    `json:"error,omitempty"`
	Groups      []string  `json:"groups,omitempty"`
	IsAdmin     bool      `json:"is_admin"`
	Permissions []string  `json:"permissions,omitempty"`
}

type AuthState struct {
	State           string    `json:"state"`
	CodeVerifier    string    `json:"code_verifier"`
	CodeChallenge   string    `json:"code_challenge"`
	RedirectURI     string    `json:"redirect_uri"`
	Scopes          []string  `json:"scopes"`
	CreatedAt       time.Time `json:"created_at"`
	ExpiresAt       time.Time `json:"expires_at"`
	UserID          string    `json:"user_id,omitempty"`
	DeviceCode      string    `json:"device_code,omitempty"`
	UserCode        string    `json:"user_code,omitempty"`
	VerificationURI string    `json:"verification_uri,omitempty"`
}

type AuthenticateResult struct {
	User         *User                  `json:"user"`
	RequiresMFA  bool                   `json:"requires_mfa"`
	MFAChallenge *TOTPData              `json:"mfa_challenge,omitempty"`
	Source       string                 `json:"source"`
	Metadata     map[string]interface{} `json:"metadata,omitempty"`
	SessionID    string                 `json:"session_id,omitempty"`
}

type CacheConfig struct {
	PasswordCacheTTL time.Duration
	SessionCacheTTL  time.Duration
	MFACacheTTL      time.Duration
	MaxEntries       int
	CleanupInterval  time.Duration
}

type CacheStats struct {
	PasswordCacheSize int
	SessionCacheSize  int
	MFACacheSize      int
	PasswordCacheHits int64
}

type CachedGroup struct {
	Group     *LDAPGroup `json:"group"`
	CachedAt  time.Time  `json:"cached_at"`
	ExpiresAt time.Time  `json:"expires_at"`
}

type CachedUser struct {
	User      *LDAPUser `json:"user"`
	CachedAt  time.Time `json:"cached_at"`
	ExpiresAt time.Time `json:"expires_at"`
}

type CertificateManager struct {
	CAPath      string // Path to CA certificate
	CertPath    string // Path to server certificate
	KeyPath     string // Path to server key
	CRLPath     string // Path to Certificate Revocation List
	DhPath      string // Path to Diffie-Hellman parameters
	TLSAuthPath string // Path to TLS auth key
	// contains filtered or unexported fields
}

type CertificateOption func(*CertificateManager)

type CipherContext struct {
	CipherMode  CipherMode
	AuthDigest  AuthDigest
	Key         []byte
	IV          []byte
	HMAC        hash.Hash
	BlockCipher cipher.Block
	GCM         cipher.AEAD
	IsGCM       bool
}

type CipherMode string

type ClaimMappings struct {
	Username    string `json:"username"`     // Claim for username
	Email       string `json:"email"`        // Claim for email
	FirstName   string `json:"first_name"`   // Claim for first name
	LastName    string `json:"last_name"`    // Claim for last name
	Groups      string `json:"groups"`       // Claim for groups
	Roles       string `json:"roles"`        // Claim for roles
	DisplayName string `json:"display_name"` // Claim for display name
}

type DeviceAuthResponse struct {
	DeviceCode              string `json:"device_code"`
	UserCode                string `json:"user_code"`
	VerificationURI         string `json:"verification_uri"`
	VerificationURIComplete string `json:"verification_uri_complete,omitempty"`
	ExpiresIn               int    `json:"expires_in"`
	Interval                int    `json:"interval"`
}

type GroupAttributes struct {
	Name        string `json:"name"`        // cn
	Description string `json:"description"` // description
	Members     string `json:"members"`     // member
	DN          string `json:"dn"`          // distinguishedName
}

type HOTPSettings struct {
	Digits    otp.Digits    `json:"digits"`    // Number of digits in code (using standard library type)
	Algorithm otp.Algorithm `json:"algorithm"` // SHA1, SHA256, SHA512 (using standard library type)
	Lookahead int           `json:"lookahead"` // Number of attempts ahead
}

type LDAPConfig struct {
	Enabled            bool            `json:"enabled"`
	Server             string          `json:"server"`
	Port               int             `json:"port"`
	UseSSL             bool            `json:"use_ssl"`
	UseTLS             bool            `json:"use_tls"`
	SkipVerify         bool            `json:"skip_verify"`
	Timeout            time.Duration   `json:"timeout"`
	BindDN             string          `json:"bind_dn"`
	BindPassword       string          `json:"bind_password"`
	BaseDN             string          `json:"base_dn"`
	UserFilter         string          `json:"user_filter"`
	GroupFilter        string          `json:"group_filter"`
	UserSearchBase     string          `json:"user_search_base"`
	GroupSearchBase    string          `json:"group_search_base"`
	UserAttributes     UserAttributes  `json:"user_attributes"`
	GroupAttributes    GroupAttributes `json:"group_attributes"`
	RequiredGroups     []string        `json:"required_groups"`
	AdminGroups        []string        `json:"admin_groups"`
	ConnectionPoolSize int             `json:"connection_pool_size"`
	MaxRetries         int             `json:"max_retries"`
	RetryDelay         time.Duration   `json:"retry_delay"`
	CacheTimeout       time.Duration   `json:"cache_timeout"`
	CacheEnabled       bool            `json:"cache_enabled"`
}

type LDAPGroup struct {
	DN          string   `json:"dn"`
	Name        string   `json:"name"`
	Description string   `json:"description"`
	Members     []string `json:"members"`
}

type LDAPProvider struct {
	// contains filtered or unexported fields
}

type LDAPUser struct {
	DN          string            `json:"dn"`
	Username    string            `json:"username"`
	Email       string            `json:"email"`
	FirstName   string            `json:"first_name"`
	LastName    string            `json:"last_name"`
	DisplayName string            `json:"display_name"`
	Groups      []string          `json:"groups"`
	IsAdmin     bool              `json:"is_admin"`
	Attributes  map[string]string `json:"attributes"`
}

type Logger interface {
	Printf(format string, v ...interface{})
	Errorf(format string, v ...interface{})
	Infof(format string, v ...interface{})
	Debugf(format string, v ...interface{})
}

type MFACacheEntry struct {
	Username  string
	TokenHash string // Hash of used tokens to prevent replay
	CreatedAt time.Time
	ExpiresAt time.Time
}

type MFAConfig struct {
	Enabled          bool          `json:"enabled"`
	RequiredForAll   bool          `json:"required_for_all"`
	TOTPEnabled      bool          `json:"totp_enabled"`
	HOTPEnabled      bool          `json:"hotp_enabled"`
	BackupCodesCount int           `json:"backup_codes_count"`
	TOTPSettings     TOTPSettings  `json:"totp_settings"`
	HOTPSettings     HOTPSettings  `json:"hotp_settings"`
	Issuer           string        `json:"issuer"`
	AccountName      string        `json:"account_name"`
	GracePeriod      time.Duration `json:"grace_period"`
	MaxAttempts      int           `json:"max_attempts"`
	LockoutDuration  time.Duration `json:"lockout_duration"`
}

type MFAProvider struct {
	// contains filtered or unexported fields
}

type MFAValidationResult struct {
	Valid          bool   `json:"valid"`
	Method         string `json:"method"` // totp, hotp, backup
	RemainingCodes int    `json:"remaining_codes,omitempty"`
	Error          string `json:"error,omitempty"`
}

type OIDCConfig struct {
	Enabled               bool              `json:"enabled"`
	ProviderURL           string            `json:"provider_url"`
	ClientID              string            `json:"client_id"`
	ClientSecret          string            `json:"client_secret"`
	RedirectURL           string            `json:"redirect_url"`
	Scopes                []string          `json:"scopes"`
	UserInfoEndpoint      string            `json:"user_info_endpoint"`
	TokenEndpoint         string            `json:"token_endpoint"`
	AuthorizationEndpoint string            `json:"authorization_endpoint"`
	JWKSEndpoint          string            `json:"jwks_endpoint"`
	IssuerValidation      bool              `json:"issuer_validation"`
	RequiredClaims        map[string]string `json:"required_claims"`
	ClaimMappings         ClaimMappings     `json:"claim_mappings"`
	SessionTimeout        time.Duration     `json:"session_timeout"`
	RefreshTokenEnabled   bool              `json:"refresh_token_enabled"`
	DeviceFlowEnabled     bool              `json:"device_flow_enabled"`
	PkceEnabled           bool              `json:"pkce_enabled"`
}

type OIDCProvider struct {
	// contains filtered or unexported fields
}

type OIDCSession struct {
	UserID       string                 `json:"user_id"`
	Username     string                 `json:"username"`
	Email        string                 `json:"email"`
	Claims       map[string]interface{} `json:"claims"`
	AccessToken  string                 `json:"access_token"`
	RefreshToken string                 `json:"refresh_token"`
	IDToken      string                 `json:"id_token"`
	ExpiresAt    time.Time              `json:"expires_at"`
	CreatedAt    time.Time              `json:"created_at"`
	LastAccess   time.Time              `json:"last_access"`
	Groups       []string               `json:"groups"`
	Roles        []string               `json:"roles"`
	OAuth2Token  *oauth2.Token          `json:"-"` // The underlying oauth2 token
}

type OpenVPNPacket struct {
	Opcode        byte
	KeyID         byte
	SessionID     []byte
	AckPacketID   uint32 // Used in ACK packets
	PacketID      uint32
	PayloadLength uint16
	Payload       []byte
	HMAC          []byte
}

type OpenVPNSession struct {
	SessionID       []byte
	RemoteSessionID []byte
	TLSConfig       *tls.Config
	TLSAuthKey      []byte
	PacketID        uint32
	CipherContext   *CipherContext
	LastPacketTime  time.Time
	IsHandshaking   bool
	HandshakeState  *tls.ConnectionState
	PushOptions     *PushOptions
}

type PasswordCacheEntry struct {
	PasswordHash string
	Salt         string
	CreatedAt    time.Time
	LastUsed     time.Time
	HitCount     int64
}

type PushOptions struct {
	Routes          []string
	DNSServers      []string
	RedirectGateway bool
	OtherOptions    map[string]string
}

type SessionCacheEntry struct {
	UserID       string
	Username     string
	Roles        []string
	Source       string
	CreatedAt    time.Time
	ExpiresAt    time.Time
	LastAccessed time.Time
	Metadata     map[string]interface{}
}

type SimpleLogger struct{}

type TOTPData struct {
	Secret      string   `json:"secret"`  // Base32 encoded secret
	QRCode      string   `json:"qr_code"` // Base64 encoded QR code image (PNG)
	URL         string   `json:"url"`     // Standard otpauth:// URL
	BackupCodes []string `json:"backup_codes"`
	Key         *otp.Key `json:"-"` // The actual key object (not serialized)
}

type TOTPSettings struct {
	Period    uint          `json:"period"`    // Code validity period in seconds (standard library uses uint)
	Digits    otp.Digits    `json:"digits"`    // Number of digits in code (using standard library type)
	Algorithm otp.Algorithm `json:"algorithm"` // SHA1, SHA256, SHA512 (using standard library type)
	Skew      uint          `json:"skew"`      // Allowed time deviation
}

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
	Scope        string `json:"scope,omitempty"`
}

type User struct {
	ID           string                 `json:"id"`
	Username     string                 `json:"username"`
	PasswordHash string                 `json:"password_hash"`
	Salt         string                 `json:"salt"`
	CreatedAt    time.Time              `json:"created_at"`
	LastLogin    time.Time              `json:"last_login"`
	IsActive     bool                   `json:"is_active"`
	Roles        []string               `json:"roles"`
	Metadata     map[string]interface{} `json:"metadata,omitempty"`
	Source       string                 `json:"source"` // local, ldap, oidc
}

type UserAttributes struct {
	Username    string `json:"username"`     // sAMAccountName, uid
	Email       string `json:"email"`        // mail
	FirstName   string `json:"first_name"`   // givenName
	LastName    string `json:"last_name"`    // sn
	DisplayName string `json:"display_name"` // displayName, cn
	Groups      string `json:"groups"`       // memberOf
	DN          string `json:"dn"`           // distinguishedName
}

type UserInfo struct {
	Sub               string                 `json:"sub"`
	Name              string                 `json:"name,omitempty"`
	GivenName         string                 `json:"given_name,omitempty"`
	FamilyName        string                 `json:"family_name,omitempty"`
	PreferredUsername string                 `json:"preferred_username,omitempty"`
	Email             string                 `json:"email,omitempty"`
	EmailVerified     bool                   `json:"email_verified,omitempty"`
	Groups            []string               `json:"groups,omitempty"`
	Roles             []string               `json:"roles,omitempty"`
	CustomClaims      map[string]interface{} `json:"-"`
}

type UserMFAData struct {
	UserID        string    `json:"user_id"`
	TOTPSecret    string    `json:"totp_secret,omitempty"` // Secret from standard library
	HOTPSecret    string    `json:"hotp_secret,omitempty"` // Secret from standard library
	HOTPCounter   uint64    `json:"hotp_counter"`
	BackupCodes   []string  `json:"backup_codes,omitempty"`
	IsEnabled     bool      `json:"is_enabled"`
	SetupComplete bool      `json:"setup_complete"`
	CreatedAt     time.Time `json:"created_at"`
	LastUsed      time.Time `json:"last_used"`
	DeviceName    string    `json:"device_name,omitempty"`
	TOTPKey       *otp.Key  `json:"-"` // The key object from standard library (not serialized)
	HOTPKey       *otp.Key  `json:"-"` // The HOTP key object (not serialized)
}