core

type Authsome interface {
	// Initialize initializes all core services
	Initialize(ctx context.Context) error

	// Mount mounts the auth routes to the Forge router
	Mount(router forge.Router, basePath string) error

	// RegisterPlugin registers a plugin
	RegisterPlugin(plugin Plugin) error

	// RegisterAuthStrategy registers an authentication strategy
	// Strategies are tried in priority order during authentication
	RegisterAuthStrategy(strategy middleware.AuthStrategy) error

	// GetConfig returns the auth config
	GetConfig() Config

	// GetDB returns the database instance
	GetDB() *bun.DB

	// GetForgeApp returns the forge application instance
	GetForgeApp() forge.App

	// GetServiceRegistry returns the service registry for plugins
	GetServiceRegistry() *registry.ServiceRegistry

	// GetHookRegistry returns the hook registry for plugins
	GetHookRegistry() *hooks.HookRegistry

	// GetBasePath returns the base path for AuthSome routes
	GetBasePath() string

	// GetPluginRegistry returns the plugin registry
	GetPluginRegistry() PluginRegistry

	// Logger returns the logger for AuthSome
	Logger() forge.Logger

	// IsPluginEnabled checks if a plugin is registered and enabled
	IsPluginEnabled(pluginID string) bool

	// Repository returns the repository instance
	Repository() repository.Repository

	// AuthMiddleware returns the optional authentication middleware
	// This middleware populates the auth context with API key and/or session data
	AuthMiddleware() forge.Middleware

	// GetGlobalRoutesOptions returns the global routes options
	GetGlobalRoutesOptions() []forge.RouteOption

	// GetGlobalGroupRoutesOptions returns the global group routes options
	GetGlobalGroupRoutesOptions() []forge.GroupOption
}

type Config struct {
	// RequireEmailVerification requires email verification for all users
	RequireEmailVerification bool `json:"requireEmailVerification" yaml:"requireEmailVerification"`

	// BasePath is the base path for auth routes
	BasePath string `json:"basePath" yaml:"basePath"`

	// BaseURL is the base URL for constructing verification links (e.g., "https://myapp.com")
	// Used for password reset, email verification, magic links, and other notification URLs
	BaseURL string `json:"baseUrl" yaml:"baseUrl"`

	// CORS configuration
	CORSEnabled    bool     `json:"corsEnabled" yaml:"corsEnabled"`       // Enable/disable CORS middleware (default: false)
	TrustedOrigins []string `json:"trustedOrigins" yaml:"trustedOrigins"` // Allowed origins for CORS

	// Secret for signing tokens
	Secret string `json:"secret" yaml:"secret"`

	// RBACEnforce toggles handler-level RBAC enforcement (off by default)
	RBACEnforce bool `json:"rbacEnforce" yaml:"rbacEnforce"`

	// SessionCookieName is the name of the session cookie (default: "authsome_session")
	// DEPRECATED: Use SessionCookie.Name instead. Kept for backward compatibility.
	SessionCookieName string `json:"sessionCookieName" yaml:"sessionCookieName"`

	// SessionCookie configures cookie-based session management
	// When enabled, authentication responses will automatically set session cookies
	// Apps can override this configuration via their metadata
	SessionCookie session.CookieConfig `json:"sessionCookie" yaml:"sessionCookie"`

	// SessionConfig configures session behavior (TTL, sliding window, refresh tokens)
	SessionConfig session.Config `json:"sessionConfig" yaml:"sessionConfig"`

	// UserConfig configures user service behavior (password requirements, etc.)
	UserConfig user.Config `json:"userConfig" yaml:"userConfig"`

	// Database configuration - support for Forge database extension
	// DatabaseManager is the Forge database extension manager
	DatabaseManager *forgedb.DatabaseManager `json:"databaseManager" yaml:"databaseManager"`
	// DatabaseManagerName is the name of the database to use from the manager
	DatabaseManagerName string `json:"databaseManagerName" yaml:"databaseManagerName"`
	// UseForgeDI indicates whether to resolve database from Forge DI container
	UseForgeDI bool `json:"useForgeDi" yaml:"useForgeDi"`

	// DatabaseSchema specifies the PostgreSQL schema for AuthSome tables
	// Default: "" (uses database default, typically "public")
	// Example: "auth" will store all tables in the auth schema
	// Note: This is NOT for multi-tenancy, just organizational separation
	DatabaseSchema string `json:"databaseSchema" yaml:"databaseSchema"`
}

type HookFunc func(ctx context.Context, data interface{}) error

type Plugin interface {
	// ID returns the unique plugin identifier
	ID() string

	// Init initializes the plugin with the auth instance
	// The auth parameter will be an *authsome.Auth instance
	// Use type assertion: auth.(*authsome.Auth) or use interface methods
	Init(auth Authsome) error

	// RegisterRoutes registers plugin routes with the router
	// Routes are scoped to the auth base path (e.g., /api/auth)
	RegisterRoutes(router forge.Router) error

	// RegisterHooks registers plugin hooks with the hook registry
	// Hooks allow plugins to intercept auth lifecycle events
	RegisterHooks(hooks *hooks.HookRegistry) error

	// RegisterServiceDecorators allows plugins to replace core services with decorated versions
	// This enables plugins to enhance or modify core functionality
	RegisterServiceDecorators(services *registry.ServiceRegistry) error

	// Migrate runs plugin migrations
	// Create database tables and indexes needed by the plugin
	Migrate() error
}

type PluginRegistry interface {
	Register(p Plugin) error
	Get(id string) (Plugin, bool)
	List() []Plugin
}

type PluginWithDashboardExtension interface {
	Plugin
	// DashboardExtension returns a dashboard extension instance
	// The extension must implement the ui.DashboardExtension interface
	DashboardExtension() ui.DashboardExtension
}

type PluginWithDependencies interface {
	Plugin
	// Dependencies returns a list of plugin IDs that must be initialized before this plugin
	Dependencies() []string
}

type PluginWithRoles interface {
	Plugin
	RegisterRoles(registry rbac.RoleRegistryInterface) error // registry is *rbac.RoleRegistry
}