src/auth.h

#ifndef GT_AUTH_H
#define GT_AUTH_H

#include "db.h"
#include "httpd.h"

/* CLI-level operations */
int  auth_user_add(sqlite3 *db, const char *name, const char *pass,
                   const char *email, int is_admin);
int  auth_user_passwd(sqlite3 *db, const char *name, const char *pass);
int  auth_user_id(sqlite3 *db, const char *name); /* -1 unknown */
int  auth_is_admin(sqlite3 *db, int uid);
/* hash scheme of a user's stored password ("scrypt"|"pbkdf2"|...),
 * NULL if no such user — ops/migration diagnostic */
const char *auth_pw_scheme(sqlite3 *db, const char *name);

/* billing tiers: free < pro < self < enterprise — entitlement only,
 * payment is an operator workflow outside the forge */
int         tier_rank(const char *t);              /* free=0, pro=1, ... */
int         auth_tier_ok(const char *t);           /* valid tier name */
const char *auth_user_tier(sqlite3 *db, int uid, long *exp_out);
int         auth_tier_set(sqlite3 *db, const char *name,
                          const char *tier, long expires);
int  auth_mktoken(sqlite3 *db, const char *name, const char *label,
                  char *token_out, size_t n);

/* token-only check ("name", "secret") → uid or -1; used by mailrecv */
int  auth_token(sqlite3 *db, const char *name, const char *secret);
/* bare token → uid or -1 (tokens are unique 256-bit random) */
int  auth_token_lookup(sqlite3 *db, const char *secret);
/* registered email → uid or -1 (mail From: fallback; the MTA is
 * expected to have enforced SPF/DKIM upstream) */
int  auth_email_uid(sqlite3 *db, const char *email);
/* "user:secret" against password_hash, then auth_tokens. uid or -1 */
int  auth_check_secret(sqlite3 *db, const char *name, const char *secret);

/* HTTP */
int  auth_basic(sqlite3 *db, struct request *r);           /* uid or 0 */
void auth_identify(sqlite3 *db, struct request *r);        /* cookie -> r->user_* */
int  session_create(sqlite3 *db, int uid, char token_out[65]);
void session_delete(sqlite3 *db, const char *token);

/* permission lattice: 'n' none < 'r' pull < 'w' push < 'a' admin/owner.
 * NEVER compare permission chars directly — use the rank helpers. */
static inline int  perm_rank(char p)
{
    return p == 'a' ? 3 : p == 'w' ? 2 : p == 'r' ? 1 : 0;
}
static inline char perm_char(int rank)
{
    return "nrwa"[rank < 0 ? 0 : rank > 3 ? 3 : rank];
}
char repo_perm(sqlite3 *db, const char *owner, const char *name, int uid);
int  repo_register(sqlite3 *db, int owner_uid, const char *name,
                   int is_public, const char *desc);

/* form-urlencoded body helper: extract key into out (url-decoded) */
int  form_get(const char *body, size_t blen, const char *key,
              char *out, size_t outlen);

/* ---- SSH keys ---- */
/* returns new key id, -1 on error; name = label for the key */
int  sshkey_add(sqlite3 *db, const char *user, const char *pubkey_line,
                const char *label);
int  sshkey_rm(sqlite3 *db, long keyid);
/* resolve a key id to (uid, uname); returns uid or -1 */
int  sshkey_uid(sqlite3 *db, long keyid, char *uname, size_t unlen);
/* self-service: remove only if the key belongs to uid */
int  sshkey_rm_own(sqlite3 *db, int uid, long keyid);
/* self-service: revoke only if the token belongs to uid */
int  auth_token_rm(sqlite3 *db, int uid, long tokid);
/* self-service: update/clear the account email (mail-in auth) */
int  auth_set_email(sqlite3 *db, int uid, const char *email);

#endif