ws_auth

type Config struct {
	AccessTTL         time.Duration // WS_ACCESS_TOKEN_TTL_MINUTES, default 5
	RefreshTTL        time.Duration // WS_REFRESH_TOKEN_TTL_MINUTES, default 30
	RenewGrace        time.Duration // WS_RENEW_GRACE_SECONDS, default 30
	MaxConcurrent     int64         // WS_UPLOAD_MAX_CONCURRENT, default 3 (per user)
	CounterTTL        time.Duration // WS_UPLOAD_COUNTER_TTL_MINUTES, default 120 (crash safety)
	TokenRatePerMin   int64         // WS_TOKEN_RATE_LIMIT_PER_MIN, default 10
	AccessSecret      string        // WS_JWT_ACCESS_SECRET
	RefreshSecret     string        // WS_JWT_REFRESH_SECRET
	SignMethod        string        // JWT_HMAC_HASH
	EncryptionKey     string        // WS_TOKEN_ENCRYPTION_KEY
	EncryptionKeyPrev string        // WS_TOKEN_ENCRYPTION_KEY_PREVIOUS (decrypt only, for key rotation)
}

type Service interface {
	Config() Config

	// Issue creates a new token pair (new family) for the user.
	Issue(ctx context.Context, req *http.Request, user token_generator.UserDetails) (*TokenPair, error)
	// Authenticate decrypts and validates an access token against JWT and the live Redis record.
	Authenticate(ctx context.Context, encryptedAccess string) (*Session, time.Time, error)
	// Renew rotates the pair using an encrypted refresh token, with reuse detection.
	Renew(ctx context.Context, req *http.Request, encryptedRefresh string) (*TokenPair, *Session, error)
	// SessionAlive reports whether the family has not been revoked or expired.
	SessionAlive(ctx context.Context, familyID string) bool

	// AllowTokenRequest is a fixed window (1 minute) limiter for token issue/refresh.
	AllowTokenRequest(ctx context.Context, key string) (bool, error)
	// AcquireUpload takes one concurrent-upload slot for the user. ok is false when the cap is reached.
	// release is safe to call more than once.
	AcquireUpload(ctx context.Context, userID string) (release func(), ok bool, err error)
}

type Session struct {
	Uuid     string    `json:"uuid"`
	FamilyID string    `json:"family_id"`
	UserID   string    `json:"user_id"`
	Username string    `json:"username"`
	IssuedAt time.Time `json:"issued_at"`
}

type TokenPair struct {
	AccessToken      string    `json:"access_token"`
	RefreshToken     string    `json:"refresh_token"`
	AccessExpiredAt  time.Time `json:"access_expired_at"`
	RefreshExpiredAt time.Time `json:"refresh_expired_at"`
}