package auth

import "time"

type Role string

const (
	RoleFull  Role = "full"  // All permissions (super admin)
	RoleWrite Role = "write" // Config/operation permissions, cannot manage users
	RoleRead  Role = "read"  // View-only permissions
)

type User struct {
	Username     string    `json:"username"`
	PasswordHash string    `json:"password_hash,omitempty"`
	Role         Role      `json:"role"`
	Comment      string    `json:"comment"`
	Disabled     bool      `json:"disabled"`
	CreatedAt    time.Time `json:"created_at"`
	LastLoginAt  time.Time `json:"last_login_at,omitempty"`
}

type PublicUser struct {
	Username    string    `json:"username"`
	Role        Role      `json:"role"`
	Comment     string    `json:"comment"`
	Disabled    bool      `json:"disabled"`
	CreatedAt   time.Time `json:"created_at"`
	LastLoginAt time.Time `json:"last_login_at,omitempty"`
}

type Session struct {
	Token     string    `json:"token"`
	Username  string    `json:"username"`
	Role      Role      `json:"role"`
	ExpiresAt time.Time `json:"expires_at"`
}

type LoginRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

type LoginResponse struct {
	Success bool       `json:"success"`
	Token   string     `json:"token"`
	User    PublicUser `json:"user"`
	Message string     `json:"message,omitempty"`
}

type CreateUserRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
	Role     Role   `json:"role"`
	Comment  string `json:"comment"`
}

type UpdateUserRequest struct {
	Role     Role   `json:"role"`
	Comment  string `json:"comment"`
	Disabled bool   `json:"disabled"`
}

type ChangePasswordRequest struct {
	OldPassword string `json:"old_password,omitempty"`
	NewPassword string `json:"new_password"`
}

type AdminResetPasswordRequest struct {
	NewPassword string `json:"new_password"`
}