// Code generated by sqlc. DO NOT EDIT.
// versions:
//   sqlc v1.31.1
// source: foundation.sql

package dbgen

import (
	"context"
	"time"

	"github.com/google/uuid"
)

const createUser = `-- name: CreateUser :one
INSERT INTO users (organization_id, email, full_name, role, status)
VALUES ($1,$2,$3,$4,$5)
RETURNING id, organization_id, email, full_name, role, status, last_login_at, created_at, updated_at, mfa_enrolled
`

type CreateUserParams struct {
	OrganizationID uuid.UUID `json:"organization_id"`
	Email          string    `json:"email"`
	FullName       string    `json:"full_name"`
	Role           string    `json:"role"`
	Status         string    `json:"status"`
}

func (q *Queries) CreateUser(ctx context.Context, arg CreateUserParams) (User, error) {
	row := q.db.QueryRow(ctx, createUser,
		arg.OrganizationID,
		arg.Email,
		arg.FullName,
		arg.Role,
		arg.Status,
	)
	var i User
	err := row.Scan(
		&i.ID,
		&i.OrganizationID,
		&i.Email,
		&i.FullName,
		&i.Role,
		&i.Status,
		&i.LastLoginAt,
		&i.CreatedAt,
		&i.UpdatedAt,
		&i.MfaEnrolled,
	)
	return i, err
}

const getOrganization = `-- name: GetOrganization :one
SELECT id, name, slug, status, created_at, updated_at FROM organizations WHERE id = $1
`

func (q *Queries) GetOrganization(ctx context.Context, id uuid.UUID) (Organization, error) {
	row := q.db.QueryRow(ctx, getOrganization, id)
	var i Organization
	err := row.Scan(
		&i.ID,
		&i.Name,
		&i.Slug,
		&i.Status,
		&i.CreatedAt,
		&i.UpdatedAt,
	)
	return i, err
}

const getUser = `-- name: GetUser :one
SELECT id, organization_id, email, full_name, role, status, last_login_at, created_at, updated_at, mfa_enrolled FROM users WHERE id = $1
`

func (q *Queries) GetUser(ctx context.Context, id uuid.UUID) (User, error) {
	row := q.db.QueryRow(ctx, getUser, id)
	var i User
	err := row.Scan(
		&i.ID,
		&i.OrganizationID,
		&i.Email,
		&i.FullName,
		&i.Role,
		&i.Status,
		&i.LastLoginAt,
		&i.CreatedAt,
		&i.UpdatedAt,
		&i.MfaEnrolled,
	)
	return i, err
}

const getUserByEmail = `-- name: GetUserByEmail :one
SELECT id, organization_id, email, full_name, role, status, last_login_at, created_at, updated_at, mfa_enrolled FROM users WHERE lower(email) = lower($1)
`

func (q *Queries) GetUserByEmail(ctx context.Context, lower string) (User, error) {
	row := q.db.QueryRow(ctx, getUserByEmail, lower)
	var i User
	err := row.Scan(
		&i.ID,
		&i.OrganizationID,
		&i.Email,
		&i.FullName,
		&i.Role,
		&i.Status,
		&i.LastLoginAt,
		&i.CreatedAt,
		&i.UpdatedAt,
		&i.MfaEnrolled,
	)
	return i, err
}

const insertAuditLog = `-- name: InsertAuditLog :one
INSERT INTO audit_logs (
    organization_id, actor_user_id, action, entity_type, entity_id,
    old_values, new_values, ip_address, user_agent
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
RETURNING id, created_at
`

type InsertAuditLogParams struct {
	OrganizationID *uuid.UUID `json:"organization_id"`
	ActorUserID    *uuid.UUID `json:"actor_user_id"`
	Action         string     `json:"action"`
	EntityType     *string    `json:"entity_type"`
	EntityID       *string    `json:"entity_id"`
	OldValues      []byte     `json:"old_values"`
	NewValues      []byte     `json:"new_values"`
	IpAddress      *string    `json:"ip_address"`
	UserAgent      *string    `json:"user_agent"`
}

type InsertAuditLogRow struct {
	ID        int64     `json:"id"`
	CreatedAt time.Time `json:"created_at"`
}

// audit_logs is append-only (enforced by trigger); only INSERT/SELECT are granted.
func (q *Queries) InsertAuditLog(ctx context.Context, arg InsertAuditLogParams) (InsertAuditLogRow, error) {
	row := q.db.QueryRow(ctx, insertAuditLog,
		arg.OrganizationID,
		arg.ActorUserID,
		arg.Action,
		arg.EntityType,
		arg.EntityID,
		arg.OldValues,
		arg.NewValues,
		arg.IpAddress,
		arg.UserAgent,
	)
	var i InsertAuditLogRow
	err := row.Scan(&i.ID, &i.CreatedAt)
	return i, err
}

const listAuditLogsForOrg = `-- name: ListAuditLogsForOrg :many
SELECT id, organization_id, actor_user_id, action, entity_type, entity_id, old_values, new_values, ip_address, user_agent, created_at FROM audit_logs
WHERE organization_id = NULLIF(current_setting('app.current_org_id', true), '')::uuid
ORDER BY created_at DESC
LIMIT $1 OFFSET $2
`

type ListAuditLogsForOrgParams struct {
	Limit  int32 `json:"limit"`
	Offset int32 `json:"offset"`
}

// audit_logs has NO RLS policy by design. Bind the read to the validated session GUC (NOT a
// caller-supplied org param) so it inherits the same fail-closed default-deny as every RLS table —
// a missing/wrong org can no longer leak another tenant's trail. Run inside RunInTenantTx so the GUC
// is set [review AUDIT-2/RLS-3].
func (q *Queries) ListAuditLogsForOrg(ctx context.Context, arg ListAuditLogsForOrgParams) ([]AuditLog, error) {
	rows, err := q.db.Query(ctx, listAuditLogsForOrg, arg.Limit, arg.Offset)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	items := []AuditLog{}
	for rows.Next() {
		var i AuditLog
		if err := rows.Scan(
			&i.ID,
			&i.OrganizationID,
			&i.ActorUserID,
			&i.Action,
			&i.EntityType,
			&i.EntityID,
			&i.OldValues,
			&i.NewValues,
			&i.IpAddress,
			&i.UserAgent,
			&i.CreatedAt,
		); err != nil {
			return nil, err
		}
		items = append(items, i)
	}
	if err := rows.Err(); err != nil {
		return nil, err
	}
	return items, nil
}

const listSystemAuditLogs = `-- name: ListSystemAuditLogs :many
SELECT id, organization_id, actor_user_id, action, entity_type, entity_id, old_values, new_values, ip_address, user_agent, created_at FROM audit_logs
WHERE organization_id IS NULL
ORDER BY created_at DESC
LIMIT $1 OFFSET $2
`

type ListSystemAuditLogsParams struct {
	Limit  int32 `json:"limit"`
	Offset int32 `json:"offset"`
}

// Platform/security events with NO org (e.g. failed logins before org resolution). Privileged read
// path only — never the per-tenant app path — so these events are not a black hole [review AUDIT-3].
func (q *Queries) ListSystemAuditLogs(ctx context.Context, arg ListSystemAuditLogsParams) ([]AuditLog, error) {
	rows, err := q.db.Query(ctx, listSystemAuditLogs, arg.Limit, arg.Offset)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	items := []AuditLog{}
	for rows.Next() {
		var i AuditLog
		if err := rows.Scan(
			&i.ID,
			&i.OrganizationID,
			&i.ActorUserID,
			&i.Action,
			&i.EntityType,
			&i.EntityID,
			&i.OldValues,
			&i.NewValues,
			&i.IpAddress,
			&i.UserAgent,
			&i.CreatedAt,
		); err != nil {
			return nil, err
		}
		items = append(items, i)
	}
	if err := rows.Err(); err != nil {
		return nil, err
	}
	return items, nil
}

const listUsers = `-- name: ListUsers :many
SELECT id, organization_id, email, full_name, role, status, last_login_at, created_at, updated_at, mfa_enrolled FROM users ORDER BY created_at DESC LIMIT $1 OFFSET $2
`

type ListUsersParams struct {
	Limit  int32 `json:"limit"`
	Offset int32 `json:"offset"`
}

func (q *Queries) ListUsers(ctx context.Context, arg ListUsersParams) ([]User, error) {
	rows, err := q.db.Query(ctx, listUsers, arg.Limit, arg.Offset)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	items := []User{}
	for rows.Next() {
		var i User
		if err := rows.Scan(
			&i.ID,
			&i.OrganizationID,
			&i.Email,
			&i.FullName,
			&i.Role,
			&i.Status,
			&i.LastLoginAt,
			&i.CreatedAt,
			&i.UpdatedAt,
			&i.MfaEnrolled,
		); err != nil {
			return nil, err
		}
		items = append(items, i)
	}
	if err := rows.Err(); err != nil {
		return nil, err
	}
	return items, nil
}

const touchUserLogin = `-- name: TouchUserLogin :exec
UPDATE users SET last_login_at = now(), updated_at = now() WHERE id = $1
`

func (q *Queries) TouchUserLogin(ctx context.Context, id uuid.UUID) error {
	_, err := q.db.Exec(ctx, touchUserLogin, id)
	return err
}