datastore

type Account struct {
	// Unique identifier for the account
	ID uuid.UUID
	// Email address associated with the account
	Email string
	// Simplified email address used in the account recovery flow only
	SimplifiedEmail *string `json:"-"`
	// Optional reference to the OPRF seed used for password hashing
	OprfSeedID *int `json:"-"`
	// Serialized OPAQUE protocol registration data
	OpaqueRegistration []byte `json:"-"`
	// Timestamp when the account was last used (with a MOE of 30 minutes)
	LastUsedAt time.Time `gorm:"<-:update"`
	// Timestamp when the account was last verified via email
	LastEmailVerifiedAt *time.Time `gorm:"<-:update"`
	// Locale preference for the account (e.g., "en-US", "es-ES")
	Locale *string `json:"-"`
	// TOTPEnabled indicates whether the account has TOTP enabled
	TOTPEnabled bool `json:"-"`
	// Timestamp when TOTP was enabled
	TOTPEnabledAt *time.Time `json:"-"`
	// Recovery key hash
	RecoveryKeyHash []byte `json:"-"`
	// Timestamp when the recovery key was created
	RecoveryKeyCreatedAt *time.Time `json:"-"`
	// Timestamp when the account was created
	CreatedAt time.Time `gorm:"<-:false"`
}

type AccountDeletionEventDetails struct {
	// Unique identifier of the deleted account
	AccountID uuid.UUID `json:"accountId"`
}

type DBUserKey struct {
	// AccountID is the UUID of the account that owns this key
	AccountID uuid.UUID `json:"-" gorm:"primaryKey"`
	// Service identifies the service this key is for
	Service string `json:"service" gorm:"primaryKey"`
	// KeyName identifies the name of the key within the service
	KeyName string `json:"keyName" gorm:"primaryKey"`
	// KeyMaterial contains the encrypted key data as bytes
	KeyMaterial []byte `json:"keyMaterial"`
	// SerialNumber is incremented each time the key is overwritten
	SerialNumber int `json:"serialNumber" gorm:"default:1"`
	// UpdatedAt is the timestamp when the key was last updated
	UpdatedAt time.Time `json:"updatedAt" gorm:"autoUpdateTime:false"`
}

type Datastore struct {
	DB *gorm.DB
	// contains filtered or unexported fields
}

type InterimPasswordState struct {
	// ID uniquely identifies the login state instance
	ID uuid.UUID `json:"id"`
	// AccountID links to the associated account
	AccountID *uuid.UUID `json:"-"`
	// Email associated with the account
	Email string `json:"-"`
	// OprfSeedID references the seed used for the Oblivious PRF
	OprfSeedID int `json:"-"`
	// State stores the serialized AKE state data
	State []byte `json:"-"`
	// AwaitingTwoFA indicates whether the login is awaiting two-factor authentication
	AwaitingTwoFA bool `json:"-" gorm:"column:awaiting_twofa"`
	// RequiresTwoFA indicates whether the account requires two-factor authentication
	RequiresTwoFA bool `json:"-" gorm:"column:requires_twofa"`
	// IsRegistration indicates whether the state is for a registration operation
	IsRegistration bool `json:"-" gorm:"column:is_registration"`
	// CreatedAt records when this login state was initialized
	CreatedAt time.Time `json:"createdAt" gorm:"<-:update"`
}

type JWTKey struct {
	// ID is the unique identifier for the JWT key
	ID int
	// SecretKey contains the raw bytes of the signing key
	SecretKey []byte
	// PublicKey contains the raw bytes of the verification key
	PublicKey []byte
	// CreatedAt stores the timestamp when the key was created (read-only)
	CreatedAt time.Time `gorm:"<-:false"`
	// ECDSASecretKey is the decoded secret key, if public key crypto is being used
	ECDSASecretKey *ecdsa.PrivateKey `gorm:"-"`
	// ECDSAPublicKey is the decoded public key, if public key crypto is being used
	ECDSAPublicKey *ecdsa.PublicKey `gorm:"-"`
}

type OPRFSeed struct {
	// ID uniquely identifies the OPRF seed
	ID int
	// Seed contains the raw bytes of the OPRF seed value
	Seed []byte
	// CreatedAt records when the seed was created (read-only)
	CreatedAt time.Time `gorm:"<-:false"`
}

type PendingWebhookEvent struct {
	// Unique identifier for the webhook event
	ID int64 `json:"-"`
	// Type of event
	EventType string `json:"type"`
	// JSON-encoded event payload
	Details interface{} `gorm:"serializer:json" json:"details"`
	// Destination URL for the webhook
	URL string `json:"-"`
	// Number of times delivery has been attempted
	Attempts int `json:"-"`
	// Timestamp when the event was created (managed by database)
	CreatedAt time.Time `gorm:"<-:false" json:"-"`
	// Timestamp of the last update (managed by database)
	UpdatedAt time.Time `gorm:"autoUpdateTime:false" json:"-"`
}

type Session struct {
	// Session UUID
	ID uuid.UUID `json:"id"`
	// AccountID is excluded from JSON
	AccountID uuid.UUID `json:"-"`
	// User agent of client
	UserAgent string `json:"userAgent"`
	// The accounts "phase" the session was created in
	Version int `json:"-"`
	// Session creation timestamp
	CreatedAt time.Time `json:"createdAt" gorm:"<-:false"`
}

type SessionWithAccountInfo struct {
	// Session UUID
	ID uuid.UUID `json:"id"`
	// AccountID is excluded from JSON
	AccountID uuid.UUID `json:"-"`
	// The accounts "phase" the session was created in
	Version int `json:"-"`
	// Account email
	Email string
	// Account last usage time
	LastUsedAt time.Time
}

type TOTPKey struct {
	// AccountID is the UUID of the account that owns this TOTP key
	AccountID uuid.UUID `json:"-" gorm:"primaryKey;table:totp_keys"`
	// Key contains the TOTP key material as text
	Key string `json:"key"`
	// CreatedAt is the timestamp when the key was created
	CreatedAt time.Time `json:"createdAt" gorm:"<-:false"`
}

type TOTPUsedCode struct {
	AccountID uuid.UUID `gorm:"primaryKey"`
	Code      string    `gorm:"primaryKey"`
	CreatedAt time.Time `gorm:"<-:false"`
}

type TwoFADetails struct {
	// TOTP indicates whether Time-based One-Time Password is enabled
	TOTP bool `json:"totp"`
	// TOTPEnabledAt indicates when TOTP was enabled
	TOTPEnabledAt *time.Time `json:"totpEnabledAt,omitempty"`
	// RecoveryKeyCreatedAt indicates when the recovery key was created
	RecoveryKeyCreatedAt *time.Time `json:"recoveryKeyCreatedAt,omitempty"`
}

type Verification struct {
	// ID uniquely identifies the verification request
	ID uuid.UUID
	// Email stores the address to be verified
	Email string
	// Code contains the verification code sent to the user
	Code string
	// Verified indicates whether the email has been successfully verified
	Verified bool
	// Service identifies the actor that initiated the verification
	Service string
	// Intent describes the purpose of the verification
	Intent string
	// NewSessionID stores the session ID after verification with a registration/auth token intent is complete
	NewSessionID *uuid.UUID
	// EmailAttempts tracks the number of times the verification email has been sent
	EmailAttempts int16
	// CodeAttempts tracks the number of wrong-code submission attempts
	CodeAttempts int16
	// CreatedAt records when the verification was initiated
	CreatedAt time.Time `gorm:"<-:update"`
}

type WebhookEventListener struct {
	// contains filtered or unexported fields
}