accountsConfig:
  # JWT claim name used to carry the active tenant identifier.
  # Default: "tenant". Change to e.g. "org" if your domain uses organisations.
  tenant-claim-name: tenant

  # Role name assigned to regular (non-admin) team members.
  # Default: "member". Set to "user" if your existing ACL rules use that label.
  member-role-name: member

  # Set to false to disable the built-in membership management endpoints:
  #   POST  /auth/invite
  #   POST  /auth/resend-invite
  #   GET   /auth/tenants
  #   POST  /auth/switch-tenant
  # Useful when your custom provider exposes its own equivalent endpoints.
  # Default: true
  membership-endpoints-enabled: true

// package org.restheart.plugins.accounts  (in restheart-commons)

/**
 * Called when an OAuth-authenticated user has status "invited".
 * Return a non-empty Optional to activate the user and issue a JWT.
 * Return Optional.empty() to fall back to the default behaviour
 * (JWT with status:"invited" — blocked by ACL rules).
 */
default Optional<Membership> activateViaOAuth(String userId, ConsentRecord consents) {
    return Optional.empty(); // deny by default (preserves 9.4.1 behaviour)
}

// package org.restheart.plugins.accounts  (in restheart-commons)
public record ConsentRecord(String termsVersion, String privacyVersion,
                             String ip, Instant acceptedAt) {}

// package org.restheart.plugins.accounts  (in restheart-commons)

public interface MembershipProvider {

    /**
     * Creates an initial team for a newly registered user and assigns them
     * the owner role. Called during /auth/register and the OAuth new-user path.
     *
     * The user document already exists when this is called.
     * The returned TenantRef is embedded as the JWT tenant claim.
     */
    TenantRef createInitialTeam(String userId, String teamName);

    /**
     * Returns true if the user is already a member of the given tenant.
     * Used by /auth/invite to prevent duplicate memberships.
     */
    boolean isMember(String userId, BsonValue tenantId);

    /**
     * Adds a user to a tenant with the specified role (idempotent).
     * If the user has no active tenant yet, this should also set it.
     */
    void addMember(String userId, BsonValue tenantId, String role);

    /**
     * Returns the user's currently active membership, or empty if none.
     * Consumed by every JWT issuance path.
     */
    Optional<Membership> activeMembership(String userId);

    /**
     * Returns all memberships for the user.
     * Used by GET /auth/tenants.
     */
    List<Membership> listMemberships(String userId);

    /**
     * Sets the given tenant as the user's active membership.
     * Used by POST /auth/switch-tenant.
     * Must throw IllegalArgumentException if the user is not a member.
     */
    void setActiveMembership(String userId, BsonValue tenantId);

    /**
     * Removes a user from the given tenant.
     * Called by DELETE /auth/remove-member.
     * Must remove the entry from both the user-side and the team-side store.
     * If the tenant was the user's active tenant, the active-tenant field must be cleared.
     * No-op if the user is not a member.
     * Default: throws UnsupportedOperationException.
     */
    default void removeMember(String userId, BsonValue tenantId) {
        throw new UnsupportedOperationException("removeMember not implemented by this provider");
    }

    /**
     * Updates the org-level role of a member within the given tenant.
     * Called by PATCH /auth/member-role.
     * Must update the role on both the user-side and the team-side store.
     * No-op if the user is not a member.
     * Default: throws UnsupportedOperationException.
     */
    default void updateMemberRole(String userId, BsonValue tenantId, String newRole) {
        throw new UnsupportedOperationException("updateMemberRole not implemented by this provider");
    }

    /**
     * Called when an OAuth-authenticated user has status "invited".
     * Return Optional.empty() to deny (default, preserves 9.4.1 behaviour).
     */
    default Optional<Membership> activateViaOAuth(String userId, ConsentRecord consents) {
        return Optional.empty();
    }
}

// Tenant reference returned by createInitialTeam — id is the native BsonValue
public record TenantRef(BsonValue id, String displayName) {}

// Snapshot of a single membership — tenantId is the native BsonValue
public record Membership(BsonValue tenantId, String displayName, String role, boolean active) {}

// users collection — schema managed by DefaultMembershipProvider
{
  "_id":     "alice@example.com",
  "tenant":  { "$oid": "64a1b2c3d4e5f6a7b8c9d0e1" },   // active tenant (ObjectId)
  "tenants": [
    { "id": { "$oid": "64a1b2c3d4e5f6a7b8c9d0e1" }, "role": "owner"  },
    { "id": { "$oid": "64a1b2c3d4e5f6a7b8c9d0e2" }, "role": "member" }
  ]
}

// teams collection — created by createInitialTeam / addMember
{
  "_id":       { "$oid": "64a1b2c3d4e5f6a7b8c9d0e1" },
  "name":      "Acme Corp",
  "createdBy": "alice@example.com",
  "createdAt": { "$date": "…" },
  "members":   [{ "userId": "alice@example.com", "role": "owner", "joinedAt": { "$date": "…" } }]
}