// SPDX-License-Identifier: MPL-2.0

package auth

import (
	"context"
	"errors"
)

var ErrDirectoryQuery = errors.New("auth: invalid directory query")

// UserDirectoryQuery requests a bounded instance-wide identity listing. Search
// is literal text, not a query language. AfterID is an exclusive stable-ID cursor;
// Limit defaults to 50 and may not exceed 200.
type UserDirectoryQuery struct {
	Search, AfterID string
	Limit           int
}

type UserDirectoryPage struct {
	Users  []User
	NextID string
}

// UserDirectoryRepository is an optional administrative read capability, not an
// extension of ordinary authentication. Callers MUST authorize instance-wide
// identity access before each call. Results include incomplete/inactive accounts
// but never credentials, session material, recovery codes or permission grants.
// Pagination is a current view, not a snapshot across requests.
type UserDirectoryRepository interface {
	UserDirectory(context.Context, UserDirectoryQuery) (UserDirectoryPage, error)
}