add auth

internal/model/user.go

@@ -2,24 +2,51 @@ package model
 
 import "time"
 
-// User represents a user in PostgreSQL.
+// User represents a row in the `users` table.
+//
+// PasswordHash is tagged `json:"-"` so it never leaks via JSON marshalling
+// even if a caller accidentally passes a User through response.JSON.
+//
+// EmailVerifiedAt is a pointer so JSON-encoded users carry an explicit `null`
+// when the user has not yet verified, instead of an omitted field — the
+// frontend uses this to decide whether to show the "verify your email" ribbon.
 type User struct {
-	ID        string    `json:"id"`
-	Email     string    `json:"email"`
-	Name      string    `json:"name"`
-	Avatar    *string   `json:"avatar,omitempty"`
-	Role      string    `json:"role"` // "user" | "admin" | "moderator"
-	CreatedAt time.Time `json:"created_at"`
-	UpdatedAt time.Time `json:"updated_at"`
+	ID              string     `json:"id"`
+	Email           string     `json:"email"`
+	Name            string     `json:"name"`
+	AvatarURL       *string    `json:"avatar_url"`
+	Role            string     `json:"role"`
+	EmailVerifiedAt *time.Time `json:"email_verified_at"`
+	PasswordHash    string     `json:"-"`
+	TokenVersion    int        `json:"-"`
+	CreatedAt       time.Time  `json:"created_at"`
+	UpdatedAt       time.Time  `json:"updated_at"`
 }
 
+// AuthToken represents a row in the `auth_tokens` table.
+// Used for both password reset and email verification flows.
+type AuthToken struct {
+	ID        string     `json:"id"`
+	UserID    string     `json:"user_id"`
+	Purpose   string     `json:"purpose"` // "password_reset" | "email_verification"
+	TokenHash string     `json:"-"`
+	ExpiresAt time.Time  `json:"expires_at"`
+	UsedAt    *time.Time `json:"used_at,omitempty"`
+	CreatedAt time.Time  `json:"created_at"`
+}
+
+const (
+	PurposePasswordReset     = "password_reset"
+	PurposeEmailVerification = "email_verification"
+)
+
 // Bookmark represents a user's bookmarked content.
 type Bookmark struct {
 	ID           string    `json:"id"`
 	UserID       string    `json:"user_id"`
-	ContentType  string    `json:"content_type"` // "verse" | "letter" | "essay" | "transcription" | etc.
+	ContentType  string    `json:"content_type"`
 	ContentID    string    `json:"content_id"`
-	ContentRef   string    `json:"content_ref"` // human-readable reference (e.g., "BG 1.1")
+	ContentRef   string    `json:"content_ref"`
 	SelectedText *string   `json:"selected_text,omitempty"`
 	Note         *string   `json:"note,omitempty"`
 	CreatedAt    time.Time `json:"created_at"`