package model

// User model
type User struct {
	Username string `json:"username"`
	Password string `json:"password"`
	// PasswordHash takes precedence over Password.
	PasswordHash string `json:"password_hash"`
	Admin        bool   `json:"admin"`
	// ServerIDs restricts a non-admin user to only these servers.
	// Empty/nil means no server access at all (secure by default).
	// Admins always have access to every server regardless of this field.
	ServerIDs []string `json:"server_ids,omitempty"`
	// ClientIDs grants a non-admin user visibility into these individual
	// clients regardless of which server they belong to, in addition to
	// whatever ServerIDs already grants full-server visibility into.
	ClientIDs []string `json:"client_ids,omitempty"`
	// TOTPSecret is the base32-encoded shared secret for this user's TOTP
	// two-factor login (RFC 6238). Empty means 2FA is not enrolled.
	TOTPSecret string `json:"totp_secret,omitempty"`
	// TOTPEnabled gates whether TOTP is actually required at login. A user
	// can have a secret provisioned but not yet confirm/enable it.
	TOTPEnabled bool `json:"totp_enabled,omitempty"`
}