package db

import "time"

type AdminUser struct {
	ID           int64
	Username     string
	PasswordHash string
	// MustChangePassword forces a password change before this admin can use the rest
	// of the dashboard — true for the seeded default account and every newly-created
	// admin (delegated or not). MustChangeUsername additionally forces choosing a new
	// username too — true only for the seeded default account (username "admin"),
	// never for admins created via the delegation flow, who pick their own username
	// up front (see addAdmin/CreateScopedAdminUser).
	MustChangePassword bool
	MustChangeUsername bool
	TOTPSecret         string
	TOTPEnabled        bool
	IsGlobalAdmin      bool
	CreatedBy          *int64
	CreatedAt          time.Time
}

type AdminSession struct {
	Token       string
	UserID      int64
	MFAVerified bool
	CreatedAt   time.Time
	ExpiresAt   time.Time
}

type WebAuthnCredential struct {
	ID             int64
	UserID         int64
	Name           string
	CredentialID   string
	CredentialData string
	CreatedAt      time.Time
}