package db

import "time"

// Mailbox is a real, IMAP-retrievable local mailbox — distinct from Sender (which is
// relay/auth-only). PasswordHash authenticates the self-service web portal only;
// IMAP/SMTP client login always goes through a MailboxAppPassword instead.
type Mailbox struct {
	ID           int64
	Email        string
	DomainID     int64
	PasswordHash string
	IsActive     bool
	QuotaBytes   int64
	UsedBytes    int64
	DEKWrapped   []byte
	DEKNonce     []byte
	CreatedAt    time.Time
	CreatedBy    *int64
	TOTPSecret   string
	TOTPEnabled  bool
	// MFAExempt overrides [Auth] enforce_mailbox_mfa off for this mailbox specifically,
	// even if its domain isn't exempt.
	MFAExempt bool
}

// MailboxSession is a self-service webmail portal login — a parallel schema to
// AdminSession, not shared (see esrv_mailbox_sessions in schema.go).
type MailboxSession struct {
	Token       string
	MailboxID   int64
	MFAVerified bool
	CreatedAt   time.Time
	ExpiresAt   time.Time
}

// MailboxWebAuthnCredential is a mailbox owner's passkey — a parallel schema to
// WebAuthnCredential, not shared.
type MailboxWebAuthnCredential struct {
	ID             int64
	MailboxID      int64
	Name           string
	CredentialID   string
	CredentialData string
	CreatedAt      time.Time
}

// MailboxAlias is an alternate address for a mailbox — receive-only by default, or
// also usable as MAIL FROM once authenticated (CanSendAs). Login is always the
// mailbox's own primary address, never an alias.
type MailboxAlias struct {
	ID        int64
	MailboxID int64
	Email     string
	DomainID  int64
	CanSendAs bool
	IsActive  bool
	CreatedAt time.Time
}

// MailboxAllowBlockEntry is one allow- or block-list pattern for a mailbox.
type MailboxAllowBlockEntry struct {
	ID        int64
	MailboxID int64
	ListType  string // "allow" | "block"
	Pattern   string
	CreatedAt time.Time
}

// MailboxFilterRule is one priority-ordered, first-match-wins delivery rule.
type MailboxFilterRule struct {
	ID             int64
	MailboxID      int64
	Priority       int
	ConditionField string // "from" | "to" | "subject"
	ConditionOp    string // "contains" | "equals" | "starts_with"
	ConditionValue string
	Action         string // "move_to_folder" | "delete" | "mark_read"
	ActionValue    string
	IsActive       bool
	CreatedAt      time.Time
}

// MailboxAppPassword is the only credential an IMAP/SMTP client ever uses. Plaintext
// is shown once at creation and never stored. ExpiresAt is nil for a password that
// never expires (the default).
type MailboxAppPassword struct {
	ID           int64
	MailboxID    int64
	Label        string
	PasswordHash string
	IsActive     bool
	CreatedAt    time.Time
	LastUsedAt   *time.Time
	ExpiresAt    *time.Time
}

// MailboxMessage is one stored message. CachedFrom/CachedSubject are plaintext by
// design (see schema.go); the rest of the message lives encrypted at StoragePath.
type MailboxMessage struct {
	ID              int64
	MailboxID       int64
	Folder          string
	MessageIDHeader string
	Flags           string
	InternalDate    time.Time
	SizeBytes       int64
	CachedFrom      string
	CachedSubject   string
	StoragePath     string
	Nonce           []byte
	CreatedAt       time.Time
}