middleware

type AccessRequest struct {
	SessionID              string                 `json:"session_id"`
	UserID                 string                 `json:"user_id"`
	Operation              string                 `json:"operation"`
	Namespace              string                 `json:"namespace,omitempty"`
	UserGroups             []string               `json:"user_groups"`
	Role                   string                 `json:"role"`
	IPAddress              string                 `json:"ip_address"`
	UserAgent              string                 `json:"user_agent"`
	SessionContext         map[string]interface{} `json:"session_context"`
	StepUp                 bool                   `json:"step_up"`
	EmergencyAccess        bool                   `json:"emergency_access"`
	EmergencyJustification string                 `json:"emergency_justification,omitempty"`
}

type AdminSessionManager struct {
	// contains filtered or unexported fields
}

type ApprovalInfo struct {
	Required        bool                         `json:"required"`
	Approvers       []models.ApprovalRequirement `json:"approvers"`
	Status          ApprovalStatus               `json:"status"`
	SubmittedAt     *time.Time                   `json:"submitted_at,omitempty"`
	ApprovedAt      *time.Time                   `json:"approved_at,omitempty"`
	ApprovedBy      string                       `json:"approved_by,omitempty"`
	RejectedAt      *time.Time                   `json:"rejected_at,omitempty"`
	RejectedBy      string                       `json:"rejected_by,omitempty"`
	RejectionReason string                       `json:"rejection_reason,omitempty"`
	EscalatedAt     *time.Time                   `json:"escalated_at,omitempty"`
	EscalatedTo     []string                     `json:"escalated_to,omitempty"`
}

type ApprovalStatus string

type AuditConfig struct {
	// Collector is the audit event collector
	Collector EventCollectorInterface

	// ServiceName identifies the service generating audit events
	ServiceName string

	// ServiceVersion identifies the service version
	ServiceVersion string

	// SkipPaths are paths to skip auditing (e.g., health checks)
	SkipPaths []string

	// SkipMethods are HTTP methods to skip auditing
	SkipMethods []string

	// LogRequestBody enables request body logging
	LogRequestBody bool

	// LogResponseBody enables response body logging
	LogResponseBody bool

	// MaxBodySize limits the size of request/response bodies to log
	MaxBodySize int64

	// UserContextExtractor extracts user context from the request
	UserContextExtractor func(c fiber.Ctx) (*models.User, *models.SessionAuthContext, error)

	// CorrelationIDExtractor extracts correlation ID from request
	CorrelationIDExtractor func(c fiber.Ctx) string

	// TraceIDExtractor extracts trace ID from request
	TraceIDExtractor func(c fiber.Ctx) string
}

type AuditEntry struct {
	Timestamp      time.Time `json:"timestamp"`
	User           string    `json:"user"`
	SessionID      string    `json:"session_id"`
	ValidationID   string    `json:"validation_id"`
	Resource       string    `json:"resource"`
	Verb           string    `json:"verb"`
	Namespace      string    `json:"namespace"`
	Allowed        bool      `json:"allowed"`
	Reason         string    `json:"reason"`
	ClientIP       string    `json:"client_ip,omitempty"`
	UserAgent      string    `json:"user_agent,omitempty"`
	CommandContext string    `json:"command_context,omitempty"`
}

type AuditSeverity string

type AuthAuditConfig struct {
	RedisClient     redis.UniversalClient
	SecretKey       string        // HMAC secret key for tamper-proof signatures
	RetentionPeriod time.Duration // How long to retain audit logs (default: 7 years for compliance)
	SIEMIntegration bool          // Enable SIEM integration
	SIEMEndpoint    string        // SIEM system endpoint
	SIEMAPIKey      string        // SIEM API key
	BatchSize       int           // Batch size for high-performance logging (default: 100)
	FlushInterval   time.Duration // Flush interval for batched logs (default: 5 seconds)
}

type AuthAuditEntry struct {
	// Event identification
	EventID   string        `json:"event_id"`
	EventType AuthEvent     `json:"event_type"`
	EventTime time.Time     `json:"event_time"`
	Severity  AuditSeverity `json:"severity"`

	// User context
	UserID           string   `json:"user_id,omitempty"`
	Username         string   `json:"username,omitempty"`
	Email            string   `json:"email,omitempty"`
	KubernetesUser   string   `json:"kubernetes_user,omitempty"`
	KubernetesGroups []string `json:"kubernetes_groups,omitempty"`

	// Session context
	SessionID         string `json:"session_id,omitempty"`
	DeviceFingerprint string `json:"device_fingerprint,omitempty"`

	// Request context
	IPAddress      string            `json:"ip_address,omitempty"`
	UserAgent      string            `json:"user_agent,omitempty"`
	RequestID      string            `json:"request_id,omitempty"`
	HTTPMethod     string            `json:"http_method,omitempty"`
	RequestPath    string            `json:"request_path,omitempty"`
	RequestHeaders map[string]string `json:"request_headers,omitempty"`

	// Authentication details
	AuthMethod   string `json:"auth_method,omitempty"`   // "oidc", "jwt", "saml"
	OIDCProvider string `json:"oidc_provider,omitempty"` // "google", "azure", "okta"
	TokenType    string `json:"token_type,omitempty"`    // "access", "refresh", "id"

	// Event details
	Success        bool                   `json:"success"`
	FailureReason  string                 `json:"failure_reason,omitempty"`
	ErrorCode      string                 `json:"error_code,omitempty"`
	Message        string                 `json:"message,omitempty"`
	AdditionalData map[string]interface{} `json:"additional_data,omitempty"`

	// Kubernetes command context (Story 2.3 AC2)
	KubernetesCommand    string `json:"kubernetes_command,omitempty"`
	NaturalLanguageInput string `json:"natural_language_input,omitempty"`

	// Security and compliance
	RiskScore       int      `json:"risk_score,omitempty"`       // 1-10 risk assessment
	ComplianceFlags []string `json:"compliance_flags,omitempty"` // SOC2, HIPAA, etc.

	// Tamper-proof signature (Story 2.3 requirement)
	Signature       string `json:"signature"`
	SignatureMethod string `json:"signature_method"`
}

type AuthAuditLogger struct {
	// contains filtered or unexported fields
}

type AuthEvent string

type AuthMiddleware struct {
	// contains filtered or unexported fields
}

type AuthenticationError struct {
	Code    string `json:"code"`
	Message string `json:"message"`
	Details string `json:"details,omitempty"`
}

type BruteForceEntry struct {
	Attempts    int       `json:"attempts"`
	LastAttempt time.Time `json:"last_attempt"`
	LockedUntil time.Time `json:"locked_until"`
	IsLocked    bool      `json:"is_locked"`
}

type BruteForceProtection struct {
	// contains filtered or unexported fields
}

type BulkSessionOperation struct {
	Operation   string         `json:"operation"` // "terminate", "extend", "audit"
	Criteria    SessionFilters `json:"criteria"`  // Selection criteria
	Reason      string         `json:"reason"`
	ScheduledAt time.Time      `json:"scheduled_at,omitempty"`
}

type CacheAccess struct {
	CacheKey  string        `json:"cache_key"`
	Operation string        `json:"operation"` // "get", "set", "delete"
	Hit       bool          `json:"hit"`
	Value     interface{}   `json:"value,omitempty"`
	TTL       time.Duration `json:"ttl,omitempty"`
	Error     string        `json:"error,omitempty"`
	Timestamp time.Time     `json:"timestamp"`
}

type CircuitBreaker struct {
	// contains filtered or unexported fields
}

type CircuitBreakerConfig struct {
	FailureThreshold int                       `json:"failure_threshold"` // Number of failures to trigger open state
	SuccessThreshold int                       `json:"success_threshold"` // Number of successes to close from half-open
	Timeout          time.Duration             `json:"timeout"`           // Time to wait before transitioning to half-open
	MaxRequests      int                       `json:"max_requests"`      // Max requests allowed in half-open state
	OnStateChange    func(CircuitBreakerState) `json:"-"`                 // Callback for state changes
}

type CircuitBreakerError struct {
	State   CircuitBreakerState `json:"state"`
	Message string              `json:"message"`
}

type CircuitBreakerState int

type ComplianceConfig struct {
	Frameworks      []ComplianceFramework `json:"frameworks"`
	ReportingPeriod string                `json:"reporting_period"` // daily, weekly, monthly
	RetentionDays   int                   `json:"retention_days"`
	AlertThresholds map[string]int        `json:"alert_thresholds"`
	NotificationURL string                `json:"notification_url,omitempty"`
}

type ComplianceContext struct {
	Framework   ComplianceFramework `json:"framework"`
	ControlID   string              `json:"control_id"`
	Requirement string              `json:"requirement"`
	RiskLevel   string              `json:"risk_level"`
	Evidence    map[string]string   `json:"evidence,omitempty"`
}

type ComplianceFramework string

type ComplianceReport struct {
	ID              string                   `json:"id"`
	Framework       ComplianceFramework      `json:"framework"`
	Period          string                   `json:"period"`
	GeneratedAt     time.Time                `json:"generated_at"`
	TotalEvents     int64                    `json:"total_events"`
	SecurityEvents  int64                    `json:"security_events"`
	ComplianceScore float64                  `json:"compliance_score"`
	Violations      []ComplianceViolation    `json:"violations"`
	Recommendations []string                 `json:"recommendations"`
	Controls        map[string]ControlStatus `json:"controls"`
}

type ComplianceViolation struct {
	ID          string    `json:"id"`
	ControlID   string    `json:"control_id"`
	Severity    string    `json:"severity"`
	Description string    `json:"description"`
	FirstSeen   time.Time `json:"first_seen"`
	LastSeen    time.Time `json:"last_seen"`
	Count       int       `json:"count"`
	Evidence    []string  `json:"evidence"`
}

type ConflictingPolicy struct {
	PolicyName   string   `json:"policy_name"`
	ConflictType string   `json:"conflict_type"` // "allow_deny", "precedence", "ambiguous"
	Description  string   `json:"description"`
	Resolution   string   `json:"resolution"`
	Affected     []string `json:"affected"`
}

type ControlStatus struct {
	ID          string    `json:"id"`
	Name        string    `json:"name"`
	Status      string    `json:"status"` // compliant, non-compliant, partial
	Score       float64   `json:"score"`
	LastChecked time.Time `json:"last_checked"`
}

type CorrelationEntry struct {
	Timestamp     time.Time              `json:"timestamp"`
	Component     string                 `json:"component"`
	Event         string                 `json:"event"`
	Details       map[string]interface{} `json:"details"`
	CorrelationID string                 `json:"correlation_id"`
}

type EmergencyAccessConfig struct {
	Enabled       bool     `json:"enabled"`
	AdminUsers    []string `json:"admin_users"`
	BypassCodes   []string `json:"bypass_codes"`
	AuditRequired bool     `json:"audit_required"`
}

type EnhancedErrorDetails struct {
	PrimaryError         *models.PermissionError `json:"primary_error"`
	RootCause            string                  `json:"root_cause"`
	ErrorHierarchy       []string                `json:"error_hierarchy"`
	SystemContext        map[string]interface{}  `json:"system_context"`
	UserImpact           string                  `json:"user_impact"`
	AdminGuidance        *models.AdminGuidance   `json:"admin_guidance"`
	TroubleshootingSteps []TroubleshootingStep   `json:"troubleshooting_steps"`
	RelatedIssues        []RelatedIssue          `json:"related_issues,omitempty"`
	CorrelationTrail     []CorrelationEntry      `json:"correlation_trail"`
}

type EnhancedRBACContext struct {
	// contains filtered or unexported fields
}

type EnhancedRBACContextConfig struct {
	KubeClient      kubernetes.Interface
	RedisClient     redis.UniversalClient
	Validator       *RBACValidator
	Advisor         *RBACAdvisor
	GuidanceService *models.UserGuidanceService
	AuditLogger     *AuthAuditLogger
	EnableTrace     bool
	CacheTTL        time.Duration
}

type EvaluatedRule struct {
	RuleSource    string            `json:"rule_source"` // "ClusterRole:admin", "Role:viewer"
	PolicyRule    rbacv1.PolicyRule `json:"policy_rule"`
	Matched       bool              `json:"matched"`
	MatchDetails  RuleMatchDetails  `json:"match_details"`
	Priority      int               `json:"priority"`
	ConflictsWith []string          `json:"conflicts_with,omitempty"`
}

type EvaluationStep struct {
	StepNumber  int                    `json:"step_number"`
	StepType    string                 `json:"step_type"` // "cache_check", "api_call", "policy_eval", "decision"
	Description string                 `json:"description"`
	Timestamp   time.Time              `json:"timestamp"`
	Duration    time.Duration          `json:"duration"`
	Success     bool                   `json:"success"`
	Details     map[string]interface{} `json:"details"`
	Error       string                 `json:"error,omitempty"`
}

type EventCollectorInterface interface {
	CollectEvent(event *models.AuditEvent) error
	CollectEventWithTimeout(event *models.AuditEvent, timeout time.Duration) error
}

type HardwareTokenConfig struct {
	SupportedTypes []string          `json:"supported_types"` // "yubikey", "fido2", "webauthn"
	Settings       map[string]string `json:"settings"`
	Timeout        time.Duration     `json:"timeout"`
}

type IPSessionCount struct {
	IPAddress    string `json:"ip_address"`
	SessionCount int64  `json:"session_count"`
}

type InputRequirement struct {
	Name        string           `json:"name"`
	Type        string           `json:"type"` // "text", "select", "multiselect", "boolean"
	Label       string           `json:"label"`
	Description string           `json:"description"`
	Required    bool             `json:"required"`
	Default     interface{}      `json:"default,omitempty"`
	Options     []StepOption     `json:"options,omitempty"`
	Validation  *InputValidation `json:"validation,omitempty"`
}

type InputValidation struct {
	Pattern       string   `json:"pattern,omitempty"`
	MinLength     int      `json:"min_length,omitempty"`
	MaxLength     int      `json:"max_length,omitempty"`
	AllowedValues []string `json:"allowed_values,omitempty"`
	CustomRules   []string `json:"custom_rules,omitempty"`
}

type InteractivePermissionResolver struct {
	// contains filtered or unexported fields
}

type InteractiveResolutionSession struct {
	SessionID     string                  `json:"session_id"`
	UserContext   *JWTClaims              `json:"user_context"`
	OriginalError *models.PermissionError `json:"original_error"`
	WorkflowSteps []ResolutionStep        `json:"workflow_steps"`
	CurrentStep   int                     `json:"current_step"`
	Status        SessionStatus           `json:"status"`
	CreatedAt     time.Time               `json:"created_at"`
	UpdatedAt     time.Time               `json:"updated_at"`
	ExpiresAt     time.Time               `json:"expires_at"`
	Metadata      map[string]interface{}  `json:"metadata"`
	TestResults   []PermissionTestResult  `json:"test_results,omitempty"`
	ApprovalInfo  *ApprovalInfo           `json:"approval_info,omitempty"`
}

type JWTClaims struct {
	// Existing fields (backward compatibility)
	UserID    string    `json:"user_id"`
	Email     string    `json:"email"`
	Name      string    `json:"name"`
	SessionID string    `json:"session_id"`
	IssuedAt  time.Time `json:"iat"`
	ExpiresAt time.Time `json:"exp"`

	// Enhanced RBAC fields
	Role   string   `json:"role"`   // Required KubeChat role
	Groups []string `json:"groups"` // Required OIDC groups

	// NEW: Kubernetes-specific RBAC fields
	KubernetesUser     string   `json:"kubernetes_user"`           // K8s user for impersonation
	KubernetesGroups   []string `json:"kubernetes_groups"`         // K8s groups for RBAC
	DefaultNamespace   string   `json:"default_namespace"`         // User's default namespace
	AllowedNamespaces  []string `json:"allowed_namespaces"`        // Accessible namespaces
	ClusterAccess      bool     `json:"cluster_access"`            // Cluster-level permissions
	ServiceAccountName string   `json:"service_account,omitempty"` // For service account auth

	// Claims metadata
	ClaimsVersion       int       `json:"claims_version"`        // For backward compatibility
	LastPermissionCheck time.Time `json:"last_permission_check"` // Claims freshness

	// MFA fields (Story 2.4)
	MFACompleted        bool          `json:"mfa_completed"`        // MFA validation status
	MFAMethod           string        `json:"mfa_method,omitempty"` // TOTP, SMS, Push, etc.
	MFATimestamp        time.Time     `json:"mfa_timestamp"`        // When MFA was completed
	MFAValidityDuration time.Duration `json:"mfa_validity"`         // How long MFA is valid
	RequiresMFAStepUp   bool          `json:"requires_mfa_stepup"`  // High-risk operation flag

	jwt.RegisteredClaims
}

type JWTConfig struct {
	PrivateKeyPEM        string        `json:"private_key_pem"`
	RedisAddr            string        `json:"redis_addr"`             // Redis server address (single instance)
	RedisCluster         []string      `json:"redis_cluster"`          // Redis cluster addresses
	RedisPassword        string        `json:"redis_password"`         // Redis password
	RedisDB              int           `json:"redis_db"`               // Redis database number
	TokenDuration        time.Duration `json:"token_duration"`         // Access token lifetime
	RefreshDuration      time.Duration `json:"refresh_duration"`       // Refresh token lifetime
	Issuer               string        `json:"issuer"`                 // JWT issuer
	PoolSize             int           `json:"pool_size"`              // Redis connection pool size
	MinIdleConns         int           `json:"min_idle_conns"`         // Minimum idle connections
	MaxRetries           int           `json:"max_retries"`            // Maximum retry attempts
	RetryDelay           time.Duration `json:"retry_delay"`            // Delay between retries
	DialTimeout          time.Duration `json:"dial_timeout"`           // Connection dial timeout
	ReadTimeout          time.Duration `json:"read_timeout"`           // Read operation timeout
	WriteTimeout         time.Duration `json:"write_timeout"`          // Write operation timeout
	EnableCircuitBreaker bool          `json:"enable_circuit_breaker"` // Enable circuit breaker for Redis failures

	// Enhanced Session Management (Story 2.3 Task 1)
	IdleTimeout     time.Duration `json:"idle_timeout"`      // Session idle timeout (default 4 hours)
	AbsoluteTimeout time.Duration `json:"absolute_timeout"`  // Session absolute timeout (default 24 hours)
	ConcurrentLimit int           `json:"concurrent_limit"`  // Max concurrent sessions per user (default 5)
	EnableIdleCheck bool          `json:"enable_idle_check"` // Enable idle timeout checking (default true)
}

type JWTService struct {
	// contains filtered or unexported fields
}

type JWTServiceInterface interface {
	GenerateToken(userID, email, name string) (*TokenPair, error)
	GenerateTokenWithClaims(claims *JWTClaims) (*TokenPair, error)
	GenerateTokenWithNamespaceValidation(claims *JWTClaims, validateNamespaces bool) (*TokenPair, error)
	ValidateToken(tokenString string) (*JWTClaims, error)
	ValidateTokenWithRefresh(tokenString string, refreshPermissions bool) (*JWTClaims, error)
	RefreshToken(refreshToken string) (*TokenPair, error)
	RefreshTokenWithNamespaceValidation(refreshToken string, validateNamespaces bool) (*TokenPair, error)
	BlacklistToken(sessionID string) error
	CleanupExpiredSessions() error
	GetPublicKey() *rsa.PublicKey
	GetPublicKeyPEM() (string, error)
	MigrateLegacyClaims(claims *JWTClaims) *JWTClaims
	SetNamespaceValidator(validator *NamespaceValidator)

	// Enhanced Session Lifecycle Management (Story 2.3 Task 1)
	UpdateSessionActivity(sessionID string) error
	GetSessionInfo(sessionID string) (*SessionInfo, error)
	GetAllActiveSessions(userID string) ([]*SessionInfo, error)
	TerminateSession(sessionID string, reason string) error
	TerminateAllUserSessions(userID string, reason string) error
	SetSessionTimeoutPolicies(idle, absolute time.Duration) error
	GetSessionMetrics() *SessionMetrics

	// MFA Session State Management (Story 2.4 Task 4)
	UpdateMFAStatus(sessionID string, mfaCompleted bool, method string, validity time.Duration) error
	GetMFAStatus(sessionID string) (*MFASessionStatus, error)
	RequiresMFAStepUp(sessionID string, operation string) (bool, error)
	SetMFAStepUpRequirement(sessionID string, required bool, operation string) error
	ValidateMFAForOperation(sessionID string, operation string) (bool, error)
	InvalidateMFAForSessions(userID string) error
}

type KubernetesAPICall struct {
	CallID       string                 `json:"call_id"`
	APIPath      string                 `json:"api_path"`
	Method       string                 `json:"method"`
	RequestBody  interface{}            `json:"request_body,omitempty"`
	ResponseCode int                    `json:"response_code"`
	ResponseBody interface{}            `json:"response_body,omitempty"`
	Duration     time.Duration          `json:"duration"`
	Error        string                 `json:"error,omitempty"`
	Timestamp    time.Time              `json:"timestamp"`
	Metadata     map[string]interface{} `json:"metadata,omitempty"`
}

type MFAChallenge struct {
	ChallengeID  string                 `json:"challenge_id"`
	UserID       string                 `json:"user_id"`
	Method       MFAMethod              `json:"method"`
	CreatedAt    time.Time              `json:"created_at"`
	ExpiresAt    time.Time              `json:"expires_at"`
	AttemptCount int                    `json:"attempt_count"`
	MaxAttempts  int                    `json:"max_attempts"`
	Status       string                 `json:"status"` // "pending", "completed", "failed", "expired"
	ProviderData map[string]interface{} `json:"provider_data,omitempty"`
	SessionData  map[string]interface{} `json:"session_data,omitempty"`
}

type MFAComplianceReport struct {
	ReportID    string    `json:"report_id"`
	GeneratedAt time.Time `json:"generated_at"`
	PeriodStart time.Time `json:"period_start"`
	PeriodEnd   time.Time `json:"period_end"`

	// Overall statistics
	TotalAccessAttempts  int64 `json:"total_access_attempts"`
	MFARequiredAttempts  int64 `json:"mfa_required_attempts"`
	MFACompletedAttempts int64 `json:"mfa_completed_attempts"`
	MFAFailedAttempts    int64 `json:"mfa_failed_attempts"`
	EmergencyAccessCount int64 `json:"emergency_access_count"`

	// Compliance rates
	MFAComplianceRate    float64 `json:"mfa_compliance_rate"`
	PolicyComplianceRate float64 `json:"policy_compliance_rate"`

	// Breakdown by policy
	PolicyStats map[string]*PolicyStats `json:"policy_stats"`

	// Risk analysis
	RiskFactorStats    map[RiskFactorType]int64 `json:"risk_factor_stats"`
	HighRiskOperations []OperationStat          `json:"high_risk_operations"`

	// User analysis
	TopNonCompliantUsers []UserComplianceStats `json:"top_non_compliant_users"`
	MFAMethodUsage       map[MFAMethod]int64   `json:"mfa_method_usage"`
}

type MFAConfig struct {
	Enabled          bool                   `json:"enabled"`
	RequiredMethods  []MFAMethod            `json:"required_methods"`
	TOTPConfig       TOTPConfig             `json:"totp_config"`
	SMSConfig        SMSConfig              `json:"sms_config"`
	PushConfig       PushConfig             `json:"push_config"`
	HardwareConfig   HardwareTokenConfig    `json:"hardware_config"`
	PolicyConfig     MFAPolicyEngineConfig  `json:"policy_config"`
	ProviderSettings map[string]interface{} `json:"provider_settings"`
}

type MFAHandler struct {
	// contains filtered or unexported fields
}

type MFAIntegrationConfig struct {
	DefaultPolicyEngine bool          `json:"default_policy_engine"` // Use default policy engine
	AuditLoggingEnabled bool          `json:"audit_logging_enabled"` // Enable audit logging
	ComplianceMode      bool          `json:"compliance_mode"`       // Enable strict compliance mode
	HealthCheckInterval time.Duration `json:"health_check_interval"` // Health check interval
}

type MFAIntegrationDecision struct {
	SessionID          string                 `json:"session_id"`
	UserID             string                 `json:"user_id"`
	Operation          string                 `json:"operation"`
	PolicyDecision     *PolicyDecision        `json:"policy_decision"`
	CurrentMFAStatus   *MFASessionStatus      `json:"current_mfa_status"`
	RequiredAction     MFARequiredAction      `json:"required_action"`
	ChallengeRequired  bool                   `json:"challenge_required"`
	Challenge          *MFAChallenge          `json:"challenge,omitempty"`
	Reason             string                 `json:"reason"`
	ComplianceMetadata map[string]interface{} `json:"compliance_metadata"`
}

type MFAIntegrationService struct {
	// contains filtered or unexported fields
}

type MFAMethod string

type MFAOperationConfig struct {
	Operation      string           `json:"operation"`
	RiskLevel      MFAOperationRisk `json:"risk_level"`
	RequiresMFA    bool             `json:"requires_mfa"`
	MFAValidity    time.Duration    `json:"mfa_validity"`
	AllowedMethods []MFAMethod      `json:"allowed_methods"`
	Description    string           `json:"description"`
}

type MFAOperationRisk string

type MFAPolicy struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	Enabled     bool   `json:"enabled"`
	Priority    int    `json:"priority"` // Higher priority overrides lower

	// Target criteria
	UserGroups       []string `json:"user_groups"`       // OIDC/SAML groups
	KubernetesGroups []string `json:"kubernetes_groups"` // K8s RBAC groups
	Roles            []string `json:"roles"`             // KubeChat roles
	Namespaces       []string `json:"namespaces"`        // Namespace restrictions

	// MFA requirements
	RequireMFA          bool          `json:"require_mfa"`
	AllowedMethods      []MFAMethod   `json:"allowed_methods"` // TOTP, SMS, Push, Hardware
	MFAValidityDuration time.Duration `json:"mfa_validity_duration"`
	StepUpOperations    []string      `json:"stepup_operations"` // Operations requiring fresh MFA
	StepUpInterval      time.Duration `json:"stepup_interval"`   // How fresh MFA must be for step-up

	// Risk-based conditions
	RiskFactors    []RiskFactor `json:"risk_factors"`
	ConditionalMFA bool         `json:"conditional_mfa"` // Enable risk-based MFA

	// Emergency access
	AllowEmergencyAccess bool        `json:"allow_emergency_access"`
	EmergencyMethods     []MFAMethod `json:"emergency_methods"`

	// Compliance and audit
	LogAllAccess       bool `json:"log_all_access"`      // Log all access attempts
	ComplianceRequired bool `json:"compliance_required"` // Mark as compliance-critical

	// Temporal restrictions
	ActiveHours    *TimeWindow `json:"active_hours,omitempty"`
	ExpirationDate *time.Time  `json:"expiration_date,omitempty"`

	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
	CreatedBy string    `json:"created_by"`
}

type MFAPolicyConfig struct {
	EnforceForAllUsers    bool                   `json:"enforce_for_all_users"`
	UserGroupRequirements map[string][]MFAMethod `json:"user_group_requirements"`
	RiskBasedMFA          RiskBasedMFAConfig     `json:"risk_based_mfa"`
	EmergencyAccess       EmergencyAccessConfig  `json:"emergency_access"`
}

type MFAPolicyEngine struct {
	// contains filtered or unexported fields
}

type MFAPolicyEngineConfig struct {
	DefaultPolicy            string        `json:"default_policy"`             // Default policy name
	PolicyRefreshInterval    time.Duration `json:"policy_refresh_interval"`    // How often to refresh policies
	EmergencyAccessEnabled   bool          `json:"emergency_access_enabled"`   // Enable emergency access
	ComplianceLoggingEnabled bool          `json:"compliance_logging_enabled"` // Enable compliance logging
	PolicyCacheTimeout       time.Duration `json:"policy_cache_timeout"`       // Policy cache timeout

	// Legacy fields for backward compatibility with MFAConfig
	EnforceForAllUsers    bool                   `json:"enforce_for_all_users"`
	UserGroupRequirements map[string][]MFAMethod `json:"user_group_requirements"`
	RiskBasedMFA          RiskBasedMFAConfig     `json:"risk_based_mfa"`
	EmergencyAccess       EmergencyAccessConfig  `json:"emergency_access"`
}

type MFARequiredAction string

type MFAResponse struct {
	Success          bool          `json:"success"`
	Message          string        `json:"message"`
	Method           MFAMethod     `json:"method"`
	NextStep         string        `json:"next_step,omitempty"`
	ChallengeID      string        `json:"challenge_id,omitempty"`
	ExpiresAt        time.Time     `json:"expires_at,omitempty"`
	RetryAfter       int           `json:"retry_after,omitempty"` // seconds
	SessionID        string        `json:"session_id,omitempty"`
	UserID           string        `json:"user_id,omitempty"`
	ValidityDuration time.Duration `json:"validity_duration,omitempty"`
	ErrorMessage     string        `json:"error_message,omitempty"`
}

type MFASessionManager struct {
	// contains filtered or unexported fields
}

type MFASessionStatus struct {
	SessionID           string        `json:"session_id"`
	UserID              string        `json:"user_id"`
	MFACompleted        bool          `json:"mfa_completed"`
	MFAMethod           string        `json:"mfa_method,omitempty"`
	MFATimestamp        time.Time     `json:"mfa_timestamp"`
	MFAValidityDuration time.Duration `json:"mfa_validity_duration"`
	MFAExpiresAt        time.Time     `json:"mfa_expires_at"`
	RequiresMFAStepUp   bool          `json:"requires_mfa_stepup"`
	StepUpOperations    []string      `json:"stepup_operations,omitempty"`
	LastMFAValidation   time.Time     `json:"last_mfa_validation"`
	MFAFailureCount     int           `json:"mfa_failure_count"`
	MFALockedUntil      time.Time     `json:"mfa_locked_until,omitempty"`
}

type MFAValidationResult struct {
	Success      bool      `json:"success"`
	SessionID    string    `json:"session_id"`
	UserID       string    `json:"user_id"`
	Method       MFAMethod `json:"method"`
	CompletedAt  time.Time `json:"completed_at"`
	ErrorCode    string    `json:"error_code,omitempty"`
	ErrorMessage string    `json:"error_message,omitempty"`
}

type NamespaceAccessResult struct {
	AllowedNamespaces []string        `json:"allowed_namespaces"`
	DefaultNamespace  string          `json:"default_namespace"`
	ClusterAccess     bool            `json:"cluster_access"`
	AccessMap         map[string]bool `json:"access_map"` // namespace -> has access
	ValidationTime    time.Time       `json:"validation_time"`
	CacheHit          bool            `json:"cache_hit"`
}

type NamespaceValidator struct {
	// contains filtered or unexported fields
}

type NamespaceValidatorConfig struct {
	// Kubernetes client configuration
	KubeConfig *rest.Config

	// Redis configuration for caching
	RedisClient   redis.UniversalClient
	CacheTTL      time.Duration
	EnableCaching bool
	CachePrefix   string

	// Performance tuning
	BatchSize      int
	MaxConcurrency int
}

type OIDCProvider struct {
	Name         string   `json:"name"`
	Issuer       string   `json:"issuer"`
	ClientID     string   `json:"client_id"`
	ClientSecret string   `json:"client_secret"`
	RedirectURL  string   `json:"redirect_url"`
	Scopes       []string `json:"scopes"`
	// Provider-specific settings
	ExtraParams map[string]string `json:"extra_params,omitempty"`
}

type OperationStat struct {
	Operation        string `json:"operation"`
	Count            int64  `json:"count"`
	MFARequiredCount int64  `json:"mfa_required_count"`
	FailureCount     int64  `json:"failure_count"`
}

type PermissionEvaluationContext struct {
	RequestID          string                      `json:"request_id"`
	Timestamp          time.Time                   `json:"timestamp"`
	UserContext        *JWTClaims                  `json:"user_context"`
	Request            *PermissionRequest          `json:"request"`
	EvaluationPath     []EvaluationStep            `json:"evaluation_path"`
	KubernetesAPICalls []KubernetesAPICall         `json:"kubernetes_api_calls"`
	CacheAccesses      []CacheAccess               `json:"cache_accesses"`
	Result             *PermissionEvaluationResult `json:"result"`
	Duration           time.Duration               `json:"duration"`
	ErrorDetails       *EnhancedErrorDetails       `json:"error_details,omitempty"`
}

type PermissionEvaluationResult struct {
	Allowed             bool                       `json:"allowed"`
	Reason              string                     `json:"reason"`
	EvaluatedRules      []EvaluatedRule            `json:"evaluated_rules"`
	ApplicableRoles     []string                   `json:"applicable_roles"`
	ApplicableBindings  []string                   `json:"applicable_bindings"`
	ConflictingPolicies []ConflictingPolicy        `json:"conflicting_policies,omitempty"`
	Recommendations     *PermissionRecommendations `json:"recommendations,omitempty"`
	AuditTrail          []models.AuditEntry        `json:"audit_trail"`
}

type PermissionGap struct {
	MissingPermissions []models.RequiredPermission `json:"missing_permissions"`
	ExcessPermissions  []models.RequiredPermission `json:"excess_permissions"`
	CurrentRoles       []string                    `json:"current_roles"`
	CurrentBindings    []string                    `json:"current_bindings"`
	Recommendations    *PermissionRecommendations  `json:"recommendations"`
}

type PermissionRecommendations struct {
	SuggestedRoles         []RoleRecommendation        `json:"suggested_roles"`
	SuggestedBindings      []RoleBindingRecommendation `json:"suggested_bindings"`
	KubectlCommands        []string                    `json:"kubectl_commands"`
	SecurityConsiderations []string                    `json:"security_considerations"`
	MinimalPermissionSet   []models.RequiredPermission `json:"minimal_permission_set"`
}

type PermissionRequest struct {
	// User context from JWT claims
	KubernetesUser   string   `json:"kubernetes_user"`   // From JWT claims
	KubernetesGroups []string `json:"kubernetes_groups"` // From JWT claims
	SessionID        string   `json:"session_id"`        // From JWT claims

	// Resource details to check
	Namespace    string `json:"namespace"`     // Target namespace
	Verb         string `json:"verb"`          // K8s verb (get, list, create, etc.)
	Resource     string `json:"resource"`      // K8s resource type (pods, deployments, etc.)
	ResourceName string `json:"resource_name"` // Specific resource name (optional)
	APIGroup     string `json:"api_group"`     // K8s API group (optional)
	Subresource  string `json:"subresource"`   // K8s subresource (optional)

	// Additional context
	CommandContext string   `json:"command_context"` // Natural language context
	AllowedActions []string `json:"allowed_actions"` // Pre-validated actions from JWT
}

type PermissionResponse struct {
	Allowed      bool          `json:"allowed"`
	Reason       string        `json:"reason"`
	EvaluatedAt  time.Time     `json:"evaluated_at"`
	CacheHit     bool          `json:"cache_hit"`
	ResponseTime time.Duration `json:"response_time"`

	// Detailed permission information
	UserInfo       UserPermissionInfo `json:"user_info"`
	ResourceAccess ResourceAccess     `json:"resource_access"`
	Suggestions    []string           `json:"suggestions,omitempty"`

	// Audit trail
	ValidationID string     `json:"validation_id"`
	AuditTrail   AuditEntry `json:"audit_trail"`
}

type PermissionTestResult struct {
	TestID      string                    `json:"test_id"`
	TestType    string                    `json:"test_type"` // "current", "impersonation", "proposed"
	TestedAs    string                    `json:"tested_as"` // User or role being tested
	Permission  models.RequiredPermission `json:"permission"`
	Result      bool                      `json:"result"`
	Reason      string                    `json:"reason"`
	TestCommand string                    `json:"test_command"`
	ExecutedAt  time.Time                 `json:"executed_at"`
	Duration    time.Duration             `json:"duration"`
	RawOutput   string                    `json:"raw_output,omitempty"`
}

type PolicyDecision struct {
	Allow               bool          `json:"allow"`
	RequireMFA          bool          `json:"require_mfa"`
	AllowedMethods      []MFAMethod   `json:"allowed_methods"`
	MFAValidityDuration time.Duration `json:"mfa_validity_duration"`
	RequireStepUp       bool          `json:"require_stepup"`
	StepUpInterval      time.Duration `json:"stepup_interval"`
	AppliedPolicies     []string      `json:"applied_policies"`
	RiskFactorsDetected []RiskFactor  `json:"risk_factors_detected"`
	EmergencyAccess     bool          `json:"emergency_access"`
	Reason              string        `json:"reason"`
	ComplianceRequired  bool          `json:"compliance_required"`
}

type PolicyEvaluationContext struct {
	UserID             string                 `json:"user_id"`
	Email              string                 `json:"email"`
	UserGroups         []string               `json:"user_groups"`       // OIDC/SAML groups
	KubernetesGroups   []string               `json:"kubernetes_groups"` // K8s RBAC groups
	Role               string                 `json:"role"`              // KubeChat role
	RequestedOperation string                 `json:"requested_operation"`
	TargetNamespace    string                 `json:"target_namespace"`
	IPAddress          string                 `json:"ip_address"`
	UserAgent          string                 `json:"user_agent"`
	DeviceFingerprint  string                 `json:"device_fingerprint"`
	SessionContext     map[string]interface{} `json:"session_context"`
	Timestamp          time.Time              `json:"timestamp"`
}

type PolicyStats struct {
	PolicyName       string  `json:"policy_name"`
	TotalEvaluations int64   `json:"total_evaluations"`
	AllowedCount     int64   `json:"allowed_count"`
	DeniedCount      int64   `json:"denied_count"`
	MFARequiredCount int64   `json:"mfa_required_count"`
	ComplianceRate   float64 `json:"compliance_rate"`
}

type ProviderConfig struct {
	Provider     *oidc.Provider
	OAuth2Config oauth2.Config
	Settings     OIDCProvider
	Verifier     *oidc.IDTokenVerifier
}

type PushConfig struct {
	Providers []string          `json:"providers"` // "okta_verify", "duo", "auth0_guardian"
	Settings  map[string]string `json:"settings"`
	Timeout   time.Duration     `json:"timeout"`
}

type RBACAdvisor struct {
	// contains filtered or unexported fields
}

type RBACAdvisorConfig struct {
	KubeClient    kubernetes.Interface
	RedisClient   redis.UniversalClient
	Validator     *RBACValidator
	CacheTTL      time.Duration
	EnableCaching bool
	CachePrefix   string
}

type RBACAdvisorMetrics struct {
	AnalysisRequests       int64         `json:"analysis_requests"`
	CacheHits              int64         `json:"cache_hits"`
	CacheMisses            int64         `json:"cache_misses"`
	AverageAnalysisTime    time.Duration `json:"average_analysis_time"`
	RecommendationAccuracy float64       `json:"recommendation_accuracy"`
	// contains filtered or unexported fields
}

type RBACValidationMetrics struct {
	TotalValidations    int64         `json:"total_validations"`
	AllowedValidations  int64         `json:"allowed_validations"`
	DeniedValidations   int64         `json:"denied_validations"`
	CacheHits           int64         `json:"cache_hits"`
	CacheMisses         int64         `json:"cache_misses"`
	AverageLatency      time.Duration `json:"average_latency"`
	MaxLatency          time.Duration `json:"max_latency"`
	MinLatency          time.Duration `json:"min_latency"`
	TotalLatency        time.Duration `json:"total_latency"`
	K8sAPICallCount     int64         `json:"k8s_api_call_count"`
	CircuitBreakerTrips int64         `json:"circuit_breaker_trips"`
	ErrorCount          int64         `json:"error_count"`
	LastValidationTime  time.Time     `json:"last_validation_time"`
	// contains filtered or unexported fields
}

type RBACValidator struct {
	// contains filtered or unexported fields
}

type RBACValidatorConfig struct {
	// Kubernetes client configuration
	KubeConfig *rest.Config

	// Redis configuration for caching
	RedisClient   redis.UniversalClient
	CacheTTL      time.Duration
	EnableCaching bool
	CachePrefix   string

	// Circuit breaker configuration for K8s API reliability
	CircuitBreakerConfig CircuitBreakerConfig
}

type RateLimitEntry struct {
	Count     int       `json:"count"`
	ResetTime time.Time `json:"reset_time"`
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type RelatedIssue struct {
	IssueID     string    `json:"issue_id"`
	Description string    `json:"description"`
	Frequency   int       `json:"frequency"`
	LastSeen    time.Time `json:"last_seen"`
	Resolution  string    `json:"resolution,omitempty"`
	Similarity  float64   `json:"similarity"` // 0.0-1.0
}

type RequestInfo struct {
	Method      string            `json:"method"`
	URL         string            `json:"url"`
	Path        string            `json:"path"`
	Headers     map[string]string `json:"headers"`
	QueryParams map[string]string `json:"query_params"`
	Body        string            `json:"body,omitempty"`
	BodySize    int64             `json:"body_size"`
	IPAddress   string            `json:"ip_address"`
	UserAgent   string            `json:"user_agent"`
}

type ResolutionStep struct {
	StepID        string                 `json:"step_id"`
	StepNumber    int                    `json:"step_number"`
	Type          ResolutionStepType     `json:"type"`
	Title         string                 `json:"title"`
	Description   string                 `json:"description"`
	Status        StepStatus             `json:"status"`
	UserInput     map[string]interface{} `json:"user_input,omitempty"`
	SystemOutput  map[string]interface{} `json:"system_output,omitempty"`
	Options       []StepOption           `json:"options,omitempty"`
	RequiredInput []InputRequirement     `json:"required_input,omitempty"`
	Validation    *models.StepValidation `json:"validation,omitempty"`
	ExecutedAt    *time.Time             `json:"executed_at,omitempty"`
	Duration      time.Duration          `json:"duration,omitempty"`
	Error         string                 `json:"error,omitempty"`
}

type ResolutionStepType string

type ResolverConfig struct {
	EnableTesting        bool          `json:"enable_testing"`
	EnableImpersonation  bool          `json:"enable_impersonation"`
	EnableSelfService    bool          `json:"enable_self_service"`
	WorkflowTimeout      time.Duration `json:"workflow_timeout"`
	MaxRetries           int           `json:"max_retries"`
	RequireApproval      bool          `json:"require_approval"`
	AutoApprovalRoles    []string      `json:"auto_approval_roles"`
	EscalationTimeout    time.Duration `json:"escalation_timeout"`
	NotificationChannels []string      `json:"notification_channels"`
}

type ResourceAccess struct {
	Namespace    string   `json:"namespace"`
	Resource     string   `json:"resource"`
	Verb         string   `json:"verb"`
	AllowedVerbs []string `json:"allowed_verbs,omitempty"`
	DeniedReason string   `json:"denied_reason,omitempty"`
}

type ResponseInfo struct {
	StatusCode int               `json:"status_code"`
	Headers    map[string]string `json:"headers"`
	Body       string            `json:"body,omitempty"`
	BodySize   int64             `json:"body_size"`
}

type RiskAction string

type RiskBasedMFAConfig struct {
	Enabled                  bool     `json:"enabled"`
	UnknownIPRequiresMFA     bool     `json:"unknown_ip_requires_mfa"`
	UnknownDeviceRequiresMFA bool     `json:"unknown_device_requires_mfa"`
	OffHoursRequiresMFA      bool     `json:"off_hours_requires_mfa"`
	HighRiskCountries        []string `json:"high_risk_countries"`
	TrustedNetworks          []string `json:"trusted_networks"`
}

type RiskFactor struct {
	Type        RiskFactorType `json:"type"`
	Threshold   string         `json:"threshold"`
	Action      RiskAction     `json:"action"`
	Description string         `json:"description"`
}

type RiskFactorType string

type RoleBindingRecommendation struct {
	Name                 string `json:"name"`
	Type                 string `json:"type"` // "ClusterRoleBinding" or "RoleBinding"
	RoleName             string `json:"role_name"`
	Namespace            string `json:"namespace,omitempty"`
	Subject              string `json:"subject"`
	SubjectType          string `json:"subject_type"` // "User", "Group", "ServiceAccount"
	Justification        string `json:"justification"`
	TemporarySuggestion  bool   `json:"temporary_suggestion"`
	ExpiryRecommendation string `json:"expiry_recommendation,omitempty"`
}

type RoleRecommendation struct {
	Name          string   `json:"name"`
	Type          string   `json:"type"` // "ClusterRole" or "Role"
	Namespace     string   `json:"namespace,omitempty"`
	Reason        string   `json:"reason"`
	Permissions   []string `json:"permissions"`
	SecurityLevel string   `json:"security_level"` // "minimal", "standard", "elevated"
	Exists        bool     `json:"exists"`         // Whether role already exists
}

type RuleMatchDetails struct {
	APIGroupMatch  bool    `json:"api_group_match"`
	ResourceMatch  bool    `json:"resource_match"`
	VerbMatch      bool    `json:"verb_match"`
	NamespaceMatch bool    `json:"namespace_match"`
	FailureReason  string  `json:"failure_reason,omitempty"`
	MatchScore     float64 `json:"match_score"` // 0.0-1.0 indicating closeness of match
}

type SAMLAssertion struct {
	Subject      string                 `json:"subject"`
	NameID       string                 `json:"name_id"`
	Email        string                 `json:"email"`
	DisplayName  string                 `json:"display_name"`
	GivenName    string                 `json:"given_name"`
	Surname      string                 `json:"surname"`
	Groups       []string               `json:"groups"`
	Attributes   map[string]interface{} `json:"attributes"`
	SessionIndex string                 `json:"session_index"`
	NotOnOrAfter time.Time              `json:"not_on_or_after"`
	// MFA fields (Story 2.4)
	MFACompleted bool      `json:"mfa_completed"`
	MFAMethod    string    `json:"mfa_method,omitempty"`
	MFATimestamp time.Time `json:"mfa_timestamp,omitempty"`
	AuthContexts []string  `json:"auth_contexts,omitempty"` // SAML AuthnContext values
}

type SAMLConfig struct {
	EntityID       string `json:"entity_id"`        // Service Provider Entity ID
	ACSURL         string `json:"acs_url"`          // Assertion Consumer Service URL
	SLOUrl         string `json:"slo_url"`          // Single Logout URL
	IDPMetadataURL string `json:"idp_metadata_url"` // Identity Provider metadata URL
	IDPMetadataXML string `json:"idp_metadata_xml"` // Alternative: raw IDP metadata XML
	PrivateKeyPEM  string `json:"private_key_pem"`  // Private key for signing
	CertificatePEM string `json:"certificate_pem"`  // Certificate for signing
	SignRequests   bool   `json:"sign_requests"`    // Whether to sign SAML requests
	ForceAuthn     bool   `json:"force_authn"`      // Force re-authentication
	AllowIDPInit   bool   `json:"allow_idp_init"`   // Allow IDP-initiated login
}

type SAMLError struct {
	Code    string `json:"code"`
	Message string `json:"message"`
	Details string `json:"details,omitempty"`
}

type SAMLProvider struct {
	// contains filtered or unexported fields
}

type SAMLUserMapper struct {
	EmailAttribute   string            `json:"email_attribute"`
	NameAttribute    string            `json:"name_attribute"`
	GroupsAttribute  string            `json:"groups_attribute"`
	AttributeMapping map[string]string `json:"attribute_mapping"`
	DefaultRole      string            `json:"default_role"`
}

type SIEMConfig struct {
	Provider       SIEMProvider      `json:"provider"`
	Endpoint       string            `json:"endpoint"`
	APIKey         string            `json:"api_key,omitempty"`
	Username       string            `json:"username,omitempty"`
	Password       string            `json:"password,omitempty"`
	Index          string            `json:"index,omitempty"`
	CustomHeaders  map[string]string `json:"custom_headers,omitempty"`
	TLSConfig      *tls.Config       `json:"-"`
	BatchSize      int               `json:"batch_size"`
	FlushInterval  time.Duration     `json:"flush_interval"`
	RetryAttempts  int               `json:"retry_attempts"`
	TimeoutSeconds int               `json:"timeout_seconds"`
}

type SIEMEvent struct {
	Timestamp         time.Time              `json:"timestamp"`
	EventID           string                 `json:"event_id"`
	Source            string                 `json:"source"`
	EventType         string                 `json:"event_type"`
	Severity          string                 `json:"severity"`
	UserID            string                 `json:"user_id,omitempty"`
	SessionID         string                 `json:"session_id,omitempty"`
	IPAddress         string                 `json:"ip_address,omitempty"`
	UserAgent         string                 `json:"user_agent,omitempty"`
	Description       string                 `json:"description"`
	Metadata          map[string]interface{} `json:"metadata,omitempty"`
	ComplianceContext *ComplianceContext     `json:"compliance_context,omitempty"`
}

type SIEMIntegrationManager struct {
	// contains filtered or unexported fields
}

type SIEMProvider string

type SMSConfig struct {
	Provider        string            `json:"provider"` // "twilio", "aws_sns", "azure", etc.
	Settings        map[string]string `json:"settings"`
	MessageTemplate string            `json:"message_template"`
	CodeLength      int               `json:"code_length"`
	CodeExpiry      time.Duration     `json:"code_expiry"`
}

type SecurityConfig struct {
	// Rate limiting configuration
	RateLimitRequests int           `json:"rate_limit_requests"` // Max requests per window
	RateLimitWindow   time.Duration `json:"rate_limit_window"`   // Rate limit time window

	// Brute force protection
	MaxFailedAttempts int           `json:"max_failed_attempts"` // Max failed login attempts
	LockoutDuration   time.Duration `json:"lockout_duration"`    // Account lockout duration

	// JWT token rotation
	TokenRotationEnabled bool          `json:"token_rotation_enabled"` // Enable automatic token rotation
	RotationInterval     time.Duration `json:"rotation_interval"`      // How often to rotate tokens

	// Redis configuration for distributed security features
	RedisClient redis.UniversalClient `json:"-"` // Redis client for distributed storage
}

type SecurityContext struct {
	SessionID         string
	UserID            string
	DeviceFingerprint string
	IPAddress         string
	UserAgent         string
	CreatedAt         time.Time
	LastActivity      time.Time
	LoginAttempts     int
	SuspiciousFlags   []string
	Locked            bool
	LockReason        string
	LockExpiry        time.Time
}

type SecurityMiddleware struct {
	// contains filtered or unexported fields
}

type SessionActivityReport struct {
	Period             string           `json:"period"`
	TotalSessions      int64            `json:"total_sessions"`
	ActiveSessions     int64            `json:"active_sessions"`
	ExpiredSessions    int64            `json:"expired_sessions"`
	TerminatedSessions int64            `json:"terminated_sessions"`
	SessionsByType     map[string]int64 `json:"sessions_by_type"`
	SessionsByUser     map[string]int64 `json:"sessions_by_user"`
	AverageSessionTime time.Duration    `json:"average_session_time"`
	SecurityEvents     int64            `json:"security_events"`
	ComplianceIssues   int64            `json:"compliance_issues"`
	TopIPAddresses     []IPSessionCount `json:"top_ip_addresses"`
}

type SessionAdminConfig struct {
	JWTService   JWTServiceInterface
	AuditLogger  *AuthAuditLogger
	AllowedRoles []string // Roles that can access admin endpoints
}

type SessionCookieConfig struct {
	Name     string
	Domain   string
	Path     string
	MaxAge   int
	Secure   bool
	HttpOnly bool
	SameSite http.SameSite
}

type SessionFilters struct {
	UserID      string `json:"user_id,omitempty"`
	Active      *bool  `json:"active,omitempty"`
	SessionType string `json:"session_type,omitempty"`
	IPAddress   string `json:"ip_address,omitempty"`
	Since       string `json:"since,omitempty"`
	Until       string `json:"until,omitempty"`
}

type SessionInfo struct {
	SessionID          string        `json:"session_id"`
	UserID             string        `json:"user_id"`
	Email              string        `json:"email"`
	Name               string        `json:"name"`
	KubernetesUser     string        `json:"kubernetes_user"`
	KubernetesGroups   []string      `json:"kubernetes_groups"`
	CreatedAt          time.Time     `json:"created_at"`
	LastActivity       time.Time     `json:"last_activity"`
	ExpiresAt          time.Time     `json:"expires_at"`
	RefreshExpiresAt   time.Time     `json:"refresh_expires_at"`
	Active             bool          `json:"active"`
	IPAddress          string        `json:"ip_address,omitempty"`
	UserAgent          string        `json:"user_agent,omitempty"`
	DeviceFingerprint  string        `json:"device_fingerprint,omitempty"`
	SessionType        string        `json:"session_type"` // "web", "api", "mobile"
	IdleTimeout        time.Duration `json:"idle_timeout"`
	AbsoluteTimeout    time.Duration `json:"absolute_timeout"`
	TerminationReason  string        `json:"termination_reason,omitempty"`
	ConcurrentSessions int           `json:"concurrent_sessions"`
	// MFA fields (Story 2.4)
	MFACompleted      bool      `json:"mfa_completed"`
	MFAMethod         string    `json:"mfa_method,omitempty"`
	MFATimestamp      time.Time `json:"mfa_timestamp"`
	MFAExpiresAt      time.Time `json:"mfa_expires_at"`
	RequiresMFAStepUp bool      `json:"requires_mfa_stepup"`
}

type SessionListResponse struct {
	Sessions []*SessionInfo `json:"sessions"`
	Total    int            `json:"total"`
	Page     int            `json:"page"`
	PageSize int            `json:"page_size"`
	HasMore  bool           `json:"has_more"`
	Filters  SessionFilters `json:"filters_applied,omitempty"`
}

type SessionMetrics struct {
	TotalActiveSessions     int64            `json:"total_active_sessions"`
	TotalExpiredSessions    int64            `json:"total_expired_sessions"`
	TotalTerminatedSessions int64            `json:"total_terminated_sessions"`
	AverageSessionDuration  time.Duration    `json:"average_session_duration"`
	ActiveSessionsByType    map[string]int64 `json:"active_sessions_by_type"`
	SessionTimeouts         int64            `json:"session_timeouts"`
	ConcurrentSessionLimits int64            `json:"concurrent_session_limits"`
}

type SessionSecurityConfig struct {
	JWTService           JWTServiceInterface
	AuditLogger          *AuthAuditLogger
	ConcurrentLimit      int           // Max concurrent sessions per user (default: 5)
	EnableFingerprinting bool          // Enable device fingerprinting (default: true)
	EnableIPBinding      bool          // Bind sessions to IP addresses (default: true)
	EnableUserAgentCheck bool          // Check user agent consistency (default: true)
	SuspiciousThreshold  int           // Threshold for suspicious activity (default: 3)
	LockoutDuration      time.Duration // Account lockout duration (default: 30 minutes)
}

type SessionSecurityManager struct {
	// contains filtered or unexported fields
}

type SessionStatus string

type SessionTerminationRequest struct {
	SessionIDs []string `json:"session_ids"`
	UserIDs    []string `json:"user_ids,omitempty"`
	Reason     string   `json:"reason"`
	Force      bool     `json:"force"` // Force termination even for active operations
}

type SessionTerminationResponse struct {
	TerminatedSessions []string `json:"terminated_sessions"`
	FailedSessions     []string `json:"failed_sessions"`
	Errors             []string `json:"errors,omitempty"`
	TotalTerminated    int      `json:"total_terminated"`
}

type SessionTimeoutPolicy struct {
	IdleTimeout     time.Duration `json:"idle_timeout"`     // Default 4 hours
	AbsoluteTimeout time.Duration `json:"absolute_timeout"` // Default 24 hours
	EnableIdleCheck bool          `json:"enable_idle_check"`
}

type StepOption struct {
	ID          string                 `json:"id"`
	Label       string                 `json:"label"`
	Description string                 `json:"description"`
	Value       interface{}            `json:"value"`
	Metadata    map[string]interface{} `json:"metadata,omitempty"`
	Recommended bool                   `json:"recommended"`
}

type StepStatus string

type SuspiciousTracker struct {
	UserID             string
	FailedLogins       int
	LastFailedLogin    time.Time
	SuspiciousIPs      map[string]int
	DeviceChanges      int
	ConcurrentSessions int
	RiskScore          int
	AlertTriggered     bool
}

type TOTPConfig struct {
	Issuer       string `json:"issuer"`
	AccountName  string `json:"account_name"`
	SecretLength int    `json:"secret_length"`
	Period       uint   `json:"period"`
	Skew         uint   `json:"skew"`
	Digits       int    `json:"digits"`
}

type TimeWindow struct {
	StartHour  int      `json:"start_hour"`   // 0-23
	EndHour    int      `json:"end_hour"`     // 0-23
	DaysOfWeek []string `json:"days_of_week"` // "monday", "tuesday", etc.
	TimeZone   string   `json:"timezone"`     // IANA timezone
}

type TokenPair struct {
	AccessToken  string    `json:"access_token"`
	RefreshToken string    `json:"refresh_token"`
	ExpiresAt    time.Time `json:"expires_at"`
	TokenType    string    `json:"token_type"`
}

type TokenRotator struct {
	// contains filtered or unexported fields
}

type TokenValidationError struct {
	Code    string `json:"code"`
	Message string `json:"message"`
}

type TroubleshootingStep struct {
	StepNumber     int      `json:"step_number"`
	Title          string   `json:"title"`
	Description    string   `json:"description"`
	Commands       []string `json:"commands"`
	ExpectedResult string   `json:"expected_result"`
	NextSteps      []string `json:"next_steps"`
	Difficulty     string   `json:"difficulty"` // "easy", "medium", "hard"
}

type UserComplianceStats struct {
	UserID              string    `json:"user_id"`
	Email               string    `json:"email"`
	TotalAttempts       int64     `json:"total_attempts"`
	MFARequiredAttempts int64     `json:"mfa_required_attempts"`
	MFAFailedAttempts   int64     `json:"mfa_failed_attempts"`
	ComplianceRate      float64   `json:"compliance_rate"`
	LastViolation       time.Time `json:"last_violation"`
}

type UserMFAStatus struct {
	UserID              string    `json:"user_id"`
	ActiveSessions      int       `json:"active_sessions"`
	MFAEnabledSessions  int       `json:"mfa_enabled_sessions"`
	LastMFACompletion   time.Time `json:"last_mfa_completion"`
	ApplicablePolicies  []string  `json:"applicable_policies"`
	ComplianceStatus    string    `json:"compliance_status"` // "compliant", "non_compliant", "partially_compliant"
	EmergencyAccessUsed bool      `json:"emergency_access_used"`
}

type UserPermissionInfo struct {
	User                string   `json:"user"`
	Groups              []string `json:"groups"`
	ServiceAccount      string   `json:"service_account,omitempty"`
	ClusterRoleBindings []string `json:"cluster_role_bindings,omitempty"`
	RoleBindings        []string `json:"role_bindings,omitempty"`
}

type ValidationMetrics struct {
	CacheHits          int64         `json:"cache_hits"`
	CacheMisses        int64         `json:"cache_misses"`
	ValidationCount    int64         `json:"validation_count"`
	AverageLatency     time.Duration `json:"average_latency"`
	MaxLatency         time.Duration `json:"max_latency"`
	MinLatency         time.Duration `json:"min_latency"`
	TotalLatency       time.Duration `json:"total_latency"`
	K8sAPICallCount    int64         `json:"k8s_api_call_count"`
	FailureCount       int64         `json:"failure_count"`
	LastValidationTime time.Time     `json:"last_validation_time"`
	// contains filtered or unexported fields
}

type ValidationRequest struct {
	KubernetesUser   string   `json:"kubernetes_user"`
	KubernetesGroups []string `json:"kubernetes_groups"`
	RequestedNS      []string `json:"requested_namespaces,omitempty"` // If empty, validate all
}