package crypto

import (
        "crypto/aes"
        "crypto/cipher"
        "crypto/ecdsa"
        "crypto/elliptic"
        "crypto/rand"
        "crypto/sha256"
        "encoding/hex"
        "errors"
        "io"
        "math/big"

        "golang.org/x/crypto/hkdf"
)

var (
        ErrInvalidKeySize     = errors.New("invalid key size")
        ErrInvalidCipherText  = errors.New("invalid ciphertext")
        ErrEncryptionFailed   = errors.New("encryption failed")
        ErrDecryptionFailed   = errors.New("decryption failed")
        ErrInvalidPublicKey   = errors.New("invalid public key")
        ErrInvalidSignature   = errors.New("invalid signature")
)

// CryptoService provides cryptographic operations
type CryptoService struct {
        masterKey []byte
}

// NewCryptoService creates a new crypto service
func NewCryptoService(masterKey []byte) (*CryptoService, error) {
        if len(masterKey) != 32 {
                return nil, ErrInvalidKeySize
        }
        return &CryptoService{masterKey: masterKey}, nil
}

// GenerateRandomBytes generates random bytes
func GenerateRandomBytes(n int) ([]byte, error) {
        b := make([]byte, n)
        _, err := rand.Read(b)
        if err != nil {
                return nil, err
        }
        return b, nil
}

// GenerateRandomHex generates a random hex string
func GenerateRandomHex(n int) (string, error) {
        bytes, err := GenerateRandomBytes(n)
        if err != nil {
                return "", err
        }
        return hex.EncodeToString(bytes), nil
}

// DeriveKey derives a key from the master key using HKDF
func (c *CryptoService) DeriveKey(context string, length int) ([]byte, error) {
        hkdfReader := hkdf.New(sha256.New, c.masterKey, nil, []byte(context))
        key := make([]byte, length)
        if _, err := io.ReadFull(hkdfReader, key); err != nil {
                return nil, err
        }
        return key, nil
}

// EncryptShare encrypts a key share using AES-256-GCM
func (c *CryptoService) EncryptShare(shareData []byte, partyID string) ([]byte, error) {
        // Derive a unique key for this party
        key, err := c.DeriveKey("share_encryption:"+partyID, 32)
        if err != nil {
                return nil, err
        }

        block, err := aes.NewCipher(key)
        if err != nil {
                return nil, err
        }

        aesGCM, err := cipher.NewGCM(block)
        if err != nil {
                return nil, err
        }

        nonce := make([]byte, aesGCM.NonceSize())
        if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
                return nil, err
        }

        // Encrypt and prepend nonce
        ciphertext := aesGCM.Seal(nonce, nonce, shareData, []byte(partyID))
        return ciphertext, nil
}

// DecryptShare decrypts a key share
func (c *CryptoService) DecryptShare(encryptedData []byte, partyID string) ([]byte, error) {
        // Derive the same key used for encryption
        key, err := c.DeriveKey("share_encryption:"+partyID, 32)
        if err != nil {
                return nil, err
        }

        block, err := aes.NewCipher(key)
        if err != nil {
                return nil, err
        }

        aesGCM, err := cipher.NewGCM(block)
        if err != nil {
                return nil, err
        }

        nonceSize := aesGCM.NonceSize()
        if len(encryptedData) < nonceSize {
                return nil, ErrInvalidCipherText
        }

        nonce, ciphertext := encryptedData[:nonceSize], encryptedData[nonceSize:]
        plaintext, err := aesGCM.Open(nil, nonce, ciphertext, []byte(partyID))
        if err != nil {
                return nil, ErrDecryptionFailed
        }

        return plaintext, nil
}

// EncryptMessage encrypts a message using AES-256-GCM
func (c *CryptoService) EncryptMessage(plaintext []byte) ([]byte, error) {
        block, err := aes.NewCipher(c.masterKey)
        if err != nil {
                return nil, err
        }

        aesGCM, err := cipher.NewGCM(block)
        if err != nil {
                return nil, err
        }

        nonce := make([]byte, aesGCM.NonceSize())
        if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
                return nil, err
        }

        ciphertext := aesGCM.Seal(nonce, nonce, plaintext, nil)
        return ciphertext, nil
}

// DecryptMessage decrypts a message
func (c *CryptoService) DecryptMessage(ciphertext []byte) ([]byte, error) {
        block, err := aes.NewCipher(c.masterKey)
        if err != nil {
                return nil, err
        }

        aesGCM, err := cipher.NewGCM(block)
        if err != nil {
                return nil, err
        }

        nonceSize := aesGCM.NonceSize()
        if len(ciphertext) < nonceSize {
                return nil, ErrInvalidCipherText
        }

        nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
        plaintext, err := aesGCM.Open(nil, nonce, ciphertext, nil)
        if err != nil {
                return nil, ErrDecryptionFailed
        }

        return plaintext, nil
}

// Hash256 computes SHA-256 hash
func Hash256(data []byte) []byte {
        hash := sha256.Sum256(data)
        return hash[:]
}

// VerifyECDSASignature verifies an ECDSA signature
func VerifyECDSASignature(messageHash, signature, publicKey []byte) (bool, error) {
        // Parse public key (assuming secp256k1/P256 uncompressed format)
        curve := elliptic.P256()
        x, y := elliptic.Unmarshal(curve, publicKey)
        if x == nil {
                return false, ErrInvalidPublicKey
        }

        pubKey := &ecdsa.PublicKey{
                Curve: curve,
                X:     x,
                Y:     y,
        }

        // Parse signature (R || S, each 32 bytes)
        if len(signature) != 64 {
                return false, ErrInvalidSignature
        }

        r := new(big.Int).SetBytes(signature[:32])
        s := new(big.Int).SetBytes(signature[32:])

        // Verify signature
        valid := ecdsa.Verify(pubKey, messageHash, r, s)
        return valid, nil
}

// GenerateNonce generates a cryptographic nonce
func GenerateNonce() ([]byte, error) {
        return GenerateRandomBytes(32)
}

// SecureCompare performs constant-time comparison
func SecureCompare(a, b []byte) bool {
        if len(a) != len(b) {
                return false
        }

        var result byte
        for i := 0; i < len(a); i++ {
                result |= a[i] ^ b[i]
        }
        return result == 0
}

// ParsePublicKey parses a public key from bytes (P256 uncompressed format)
func ParsePublicKey(publicKeyBytes []byte) (*ecdsa.PublicKey, error) {
        curve := elliptic.P256()
        x, y := elliptic.Unmarshal(curve, publicKeyBytes)
        if x == nil {
                return nil, ErrInvalidPublicKey
        }

        return &ecdsa.PublicKey{
                Curve: curve,
                X:     x,
                Y:     y,
        }, nil
}

// VerifySignature verifies an ECDSA signature using a public key
func VerifySignature(pubKey *ecdsa.PublicKey, messageHash, signature []byte) bool {
        // Parse signature (R || S, each 32 bytes)
        if len(signature) != 64 {
                return false
        }

        r := new(big.Int).SetBytes(signature[:32])
        s := new(big.Int).SetBytes(signature[32:])

        return ecdsa.Verify(pubKey, messageHash, r, s)
}

// HashMessage computes SHA-256 hash of a message (alias for Hash256)
func HashMessage(message []byte) []byte {
        return Hash256(message)
}

// Encrypt encrypts data using AES-256-GCM with the provided key
func Encrypt(key, plaintext []byte) ([]byte, error) {
        if len(key) != 32 {
                return nil, ErrInvalidKeySize
        }

        block, err := aes.NewCipher(key)
        if err != nil {
                return nil, err
        }

        aesGCM, err := cipher.NewGCM(block)
        if err != nil {
                return nil, err
        }

        nonce := make([]byte, aesGCM.NonceSize())
        if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
                return nil, err
        }

        ciphertext := aesGCM.Seal(nonce, nonce, plaintext, nil)
        return ciphertext, nil
}

// Decrypt decrypts data using AES-256-GCM with the provided key
func Decrypt(key, ciphertext []byte) ([]byte, error) {
        if len(key) != 32 {
                return nil, ErrInvalidKeySize
        }

        block, err := aes.NewCipher(key)
        if err != nil {
                return nil, err
        }

        aesGCM, err := cipher.NewGCM(block)
        if err != nil {
                return nil, err
        }

        nonceSize := aesGCM.NonceSize()
        if len(ciphertext) < nonceSize {
                return nil, ErrInvalidCipherText
        }

        nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
        plaintext, err := aesGCM.Open(nil, nonce, ciphertext, nil)
        if err != nil {
                return nil, ErrDecryptionFailed
        }

        return plaintext, nil
}

// DeriveKey derives a key from secret and salt using HKDF (standalone function)
func DeriveKey(secret, salt []byte, length int) ([]byte, error) {
        hkdfReader := hkdf.New(sha256.New, secret, salt, nil)
        key := make([]byte, length)
        if _, err := io.ReadFull(hkdfReader, key); err != nil {
                return nil, err
        }
        return key, nil
}

// SignMessage signs a message using ECDSA private key
func SignMessage(privateKey *ecdsa.PrivateKey, message []byte) ([]byte, error) {
        hash := Hash256(message)
        r, s, err := ecdsa.Sign(rand.Reader, privateKey, hash)
        if err != nil {
                return nil, err
        }

        // Encode R and S as 32 bytes each (total 64 bytes)
        signature := make([]byte, 64)
        rBytes := r.Bytes()
        sBytes := s.Bytes()

        // Pad with zeros if necessary
        copy(signature[32-len(rBytes):32], rBytes)
        copy(signature[64-len(sBytes):64], sBytes)

        return signature, nil
}

// EncodeToHex encodes bytes to hex string
func EncodeToHex(data []byte) string {
        return hex.EncodeToString(data)
}

// DecodeFromHex decodes hex string to bytes
func DecodeFromHex(s string) ([]byte, error) {
        return hex.DecodeString(s)
}

// EncodeToBase64 encodes bytes to base64 string
func EncodeToBase64(data []byte) string {
        return hex.EncodeToString(data) // Using hex for simplicity, could use base64
}

// DecodeFromBase64 decodes base64 string to bytes
func DecodeFromBase64(s string) ([]byte, error) {
        return hex.DecodeString(s)
}

// MarshalPublicKey marshals an ECDSA public key to bytes
func MarshalPublicKey(pubKey *ecdsa.PublicKey) []byte {
        return elliptic.Marshal(pubKey.Curve, pubKey.X, pubKey.Y)
}

// CompareBytes performs constant-time comparison of two byte slices
func CompareBytes(a, b []byte) bool {
        return SecureCompare(a, b)
}

package jwt

import (
        "errors"
        "time"

        "github.com/golang-jwt/jwt/v5"
        "github.com/google/uuid"
)

var (
        ErrInvalidToken     = errors.New("invalid token")
        ErrExpiredToken     = errors.New("token expired")
        ErrInvalidClaims    = errors.New("invalid claims")
        ErrTokenNotYetValid = errors.New("token not yet valid")
)

// Claims represents custom JWT claims
type Claims struct {
        SessionID string `json:"session_id"`
        PartyID   string `json:"party_id"`
        TokenType string `json:"token_type"` // "join", "access", "refresh"
        jwt.RegisteredClaims
}

// JWTService provides JWT operations
type JWTService struct {
        secretKey     []byte
        issuer        string
        tokenExpiry   time.Duration
        refreshExpiry time.Duration
}

// NewJWTService creates a new JWT service
func NewJWTService(secretKey string, issuer string, tokenExpiry, refreshExpiry time.Duration) *JWTService {
        return &JWTService{
                secretKey:     []byte(secretKey),
                issuer:        issuer,
                tokenExpiry:   tokenExpiry,
                refreshExpiry: refreshExpiry,
        }
}

// GenerateJoinToken generates a token for joining an MPC session
func (s *JWTService) GenerateJoinToken(sessionID uuid.UUID, partyID string, expiresIn time.Duration) (string, error) {
        now := time.Now()
        claims := Claims{
                SessionID: sessionID.String(),
                PartyID:   partyID,
                TokenType: "join",
                RegisteredClaims: jwt.RegisteredClaims{
                        ID:        uuid.New().String(),
                        Issuer:    s.issuer,
                        Subject:   partyID,
                        IssuedAt:  jwt.NewNumericDate(now),
                        NotBefore: jwt.NewNumericDate(now),
                        ExpiresAt: jwt.NewNumericDate(now.Add(expiresIn)),
                },
        }

        token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
        return token.SignedString(s.secretKey)
}

// AccessTokenClaims represents claims in an access token
type AccessTokenClaims struct {
        Subject  string
        Username string
        Issuer   string
}

// GenerateAccessToken generates an access token with username
func (s *JWTService) GenerateAccessToken(userID, username string) (string, error) {
        now := time.Now()
        claims := Claims{
                TokenType: "access",
                RegisteredClaims: jwt.RegisteredClaims{
                        ID:        uuid.New().String(),
                        Issuer:    s.issuer,
                        Subject:   userID,
                        IssuedAt:  jwt.NewNumericDate(now),
                        NotBefore: jwt.NewNumericDate(now),
                        ExpiresAt: jwt.NewNumericDate(now.Add(s.tokenExpiry)),
                },
        }
        // Store username in PartyID field for access tokens
        claims.PartyID = username

        token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
        return token.SignedString(s.secretKey)
}

// GenerateRefreshToken generates a refresh token
func (s *JWTService) GenerateRefreshToken(userID string) (string, error) {
        now := time.Now()
        claims := Claims{
                TokenType: "refresh",
                RegisteredClaims: jwt.RegisteredClaims{
                        ID:        uuid.New().String(),
                        Issuer:    s.issuer,
                        Subject:   userID,
                        IssuedAt:  jwt.NewNumericDate(now),
                        NotBefore: jwt.NewNumericDate(now),
                        ExpiresAt: jwt.NewNumericDate(now.Add(s.refreshExpiry)),
                },
        }

        token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
        return token.SignedString(s.secretKey)
}

// ValidateToken validates a JWT token and returns the claims
func (s *JWTService) ValidateToken(tokenString string) (*Claims, error) {
        token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
                if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
                        return nil, ErrInvalidToken
                }
                return s.secretKey, nil
        })

        if err != nil {
                if errors.Is(err, jwt.ErrTokenExpired) {
                        return nil, ErrExpiredToken
                }
                return nil, ErrInvalidToken
        }

        claims, ok := token.Claims.(*Claims)
        if !ok || !token.Valid {
                return nil, ErrInvalidClaims
        }

        return claims, nil
}

// ValidateJoinToken validates a join token for MPC sessions
func (s *JWTService) ValidateJoinToken(tokenString string, sessionID uuid.UUID, partyID string) (*Claims, error) {
        claims, err := s.ValidateToken(tokenString)
        if err != nil {
                return nil, err
        }

        if claims.TokenType != "join" {
                return nil, ErrInvalidToken
        }

        if claims.SessionID != sessionID.String() {
                return nil, ErrInvalidClaims
        }

        if claims.PartyID != partyID {
                return nil, ErrInvalidClaims
        }

        return claims, nil
}

// RefreshAccessToken creates a new access token from a valid refresh token
func (s *JWTService) RefreshAccessToken(refreshToken string) (string, error) {
        claims, err := s.ValidateToken(refreshToken)
        if err != nil {
                return "", err
        }

        if claims.TokenType != "refresh" {
                return "", ErrInvalidToken
        }

        // PartyID stores the username for access tokens
        return s.GenerateAccessToken(claims.Subject, claims.PartyID)
}

// ValidateAccessToken validates an access token and returns structured claims
func (s *JWTService) ValidateAccessToken(tokenString string) (*AccessTokenClaims, error) {
        claims, err := s.ValidateToken(tokenString)
        if err != nil {
                return nil, err
        }

        if claims.TokenType != "access" {
                return nil, ErrInvalidToken
        }

        return &AccessTokenClaims{
                Subject:  claims.Subject,
                Username: claims.PartyID, // Username stored in PartyID for access tokens
                Issuer:   claims.Issuer,
        }, nil
}

// ValidateRefreshToken validates a refresh token and returns claims
func (s *JWTService) ValidateRefreshToken(tokenString string) (*Claims, error) {
        claims, err := s.ValidateToken(tokenString)
        if err != nil {
                return nil, err
        }

        if claims.TokenType != "refresh" {
                return nil, ErrInvalidToken
        }

        return claims, nil
}

// TokenGenerator interface for dependency injection
type TokenGenerator interface {
        GenerateJoinToken(sessionID uuid.UUID, partyID string, expiresIn time.Duration) (string, error)
}

// TokenValidator interface for dependency injection
type TokenValidator interface {
        ValidateJoinToken(tokenString string, sessionID uuid.UUID, partyID string) (*Claims, error)
}

// Ensure JWTService implements interfaces
var _ TokenGenerator = (*JWTService)(nil)
var _ TokenValidator = (*JWTService)(nil)

package utils

import (
        "context"
        "encoding/json"
        "math/big"
        "reflect"
        "strings"
        "time"

        "github.com/google/uuid"
)

// GenerateID generates a new UUID
func GenerateID() uuid.UUID {
        return uuid.New()
}

// ParseUUID parses a string to UUID
func ParseUUID(s string) (uuid.UUID, error) {
        return uuid.Parse(s)
}

// MustParseUUID parses a string to UUID, panics on error
func MustParseUUID(s string) uuid.UUID {
        id, err := uuid.Parse(s)
        if err != nil {
                panic(err)
        }
        return id
}

// IsValidUUID checks if a string is a valid UUID
func IsValidUUID(s string) bool {
        _, err := uuid.Parse(s)
        return err == nil
}

// ToJSON converts an interface to JSON bytes
func ToJSON(v interface{}) ([]byte, error) {
        return json.Marshal(v)
}

// FromJSON converts JSON bytes to an interface
func FromJSON(data []byte, v interface{}) error {
        return json.Unmarshal(data, v)
}

// NowUTC returns the current UTC time
func NowUTC() time.Time {
        return time.Now().UTC()
}

// TimePtr returns a pointer to the time
func TimePtr(t time.Time) *time.Time {
        return &t
}

// NowPtr returns a pointer to the current time
func NowPtr() *time.Time {
        now := NowUTC()
        return &now
}

// BigIntToBytes converts a big.Int to bytes (32 bytes, left-padded)
func BigIntToBytes(n *big.Int) []byte {
        if n == nil {
                return make([]byte, 32)
        }
        b := n.Bytes()
        if len(b) > 32 {
                return b[:32]
        }
        if len(b) < 32 {
                result := make([]byte, 32)
                copy(result[32-len(b):], b)
                return result
        }
        return b
}

// BytesToBigInt converts bytes to big.Int
func BytesToBigInt(b []byte) *big.Int {
        return new(big.Int).SetBytes(b)
}

// StringSliceContains checks if a string slice contains a value
func StringSliceContains(slice []string, value string) bool {
        for _, s := range slice {
                if s == value {
                        return true
                }
        }
        return false
}

// StringSliceRemove removes a value from a string slice
func StringSliceRemove(slice []string, value string) []string {
        result := make([]string, 0, len(slice))
        for _, s := range slice {
                if s != value {
                        result = append(result, s)
                }
        }
        return result
}

// UniqueStrings returns unique strings from a slice
func UniqueStrings(slice []string) []string {
        seen := make(map[string]struct{})
        result := make([]string, 0, len(slice))
        for _, s := range slice {
                if _, ok := seen[s]; !ok {
                        seen[s] = struct{}{}
                        result = append(result, s)
                }
        }
        return result
}

// TruncateString truncates a string to max length
func TruncateString(s string, maxLen int) string {
        if len(s) <= maxLen {
                return s
        }
        return s[:maxLen]
}

// SafeString returns an empty string if the pointer is nil
func SafeString(s *string) string {
        if s == nil {
                return ""
        }
        return *s
}

// StringPtr returns a pointer to the string
func StringPtr(s string) *string {
        return &s
}

// IntPtr returns a pointer to the int
func IntPtr(i int) *int {
        return &i
}

// BoolPtr returns a pointer to the bool
func BoolPtr(b bool) *bool {
        return &b
}

// IsZero checks if a value is zero/empty
func IsZero(v interface{}) bool {
        return reflect.ValueOf(v).IsZero()
}

// Coalesce returns the first non-zero value
func Coalesce[T comparable](values ...T) T {
        var zero T
        for _, v := range values {
                if v != zero {
                        return v
                }
        }
        return zero
}

// MapKeys returns the keys of a map
func MapKeys[K comparable, V any](m map[K]V) []K {
        keys := make([]K, 0, len(m))
        for k := range m {
                keys = append(keys, k)
        }
        return keys
}

// MapValues returns the values of a map
func MapValues[K comparable, V any](m map[K]V) []V {
        values := make([]V, 0, len(m))
        for _, v := range m {
                values = append(values, v)
        }
        return values
}

// Min returns the minimum of two values
func Min[T ~int | ~int64 | ~float64](a, b T) T {
        if a < b {
                return a
        }
        return b
}

// Max returns the maximum of two values
func Max[T ~int | ~int64 | ~float64](a, b T) T {
        if a > b {
                return a
        }
        return b
}

// Clamp clamps a value between min and max
func Clamp[T ~int | ~int64 | ~float64](value, min, max T) T {
        if value < min {
                return min
        }
        if value > max {
                return max
        }
        return value
}

// ContextWithTimeout creates a context with timeout
func ContextWithTimeout(timeout time.Duration) (context.Context, context.CancelFunc) {
        return context.WithTimeout(context.Background(), timeout)
}

// MaskString masks a string showing only first and last n characters
func MaskString(s string, showChars int) string {
        if len(s) <= showChars*2 {
                return strings.Repeat("*", len(s))
        }
        return s[:showChars] + strings.Repeat("*", len(s)-showChars*2) + s[len(s)-showChars:]
}

// Retry executes a function with retries
func Retry(attempts int, sleep time.Duration, f func() error) error {
        var err error
        for i := 0; i < attempts; i++ {
                if err = f(); err == nil {
                        return nil
                }
                if i < attempts-1 {
                        time.Sleep(sleep)
                        sleep *= 2 // Exponential backoff
                }
        }
        return err
}

package entities

import (
        "time"

        "github.com/google/uuid"
        "github.com/rwadurian/mpc-system/services/account/domain/value_objects"
)

// Account represents a user account with MPC-based authentication
type Account struct {
        ID              value_objects.AccountID
        Username        string
        Email           string
        Phone           *string
        PublicKey       []byte // MPC group public key
        KeygenSessionID uuid.UUID
        ThresholdN      int
        ThresholdT      int
        Status          value_objects.AccountStatus
        CreatedAt       time.Time
        UpdatedAt       time.Time
        LastLoginAt     *time.Time
}

// NewAccount creates a new Account
func NewAccount(
        username string,
        email string,
        publicKey []byte,
        keygenSessionID uuid.UUID,
        thresholdN int,
        thresholdT int,
) *Account {
        now := time.Now().UTC()
        return &Account{
                ID:              value_objects.NewAccountID(),
                Username:        username,
                Email:           email,
                PublicKey:       publicKey,
                KeygenSessionID: keygenSessionID,
                ThresholdN:      thresholdN,
                ThresholdT:      thresholdT,
                Status:          value_objects.AccountStatusActive,
                CreatedAt:       now,
                UpdatedAt:       now,
        }
}

// SetPhone sets the phone number
func (a *Account) SetPhone(phone string) {
        a.Phone = &phone
        a.UpdatedAt = time.Now().UTC()
}

// UpdateLastLogin updates the last login timestamp
func (a *Account) UpdateLastLogin() {
        now := time.Now().UTC()
        a.LastLoginAt = &now
        a.UpdatedAt = now
}

// Suspend suspends the account
func (a *Account) Suspend() error {
        if a.Status == value_objects.AccountStatusRecovering {
                return ErrAccountInRecovery
        }
        a.Status = value_objects.AccountStatusSuspended
        a.UpdatedAt = time.Now().UTC()
        return nil
}

// Lock locks the account
func (a *Account) Lock() error {
        if a.Status == value_objects.AccountStatusRecovering {
                return ErrAccountInRecovery
        }
        a.Status = value_objects.AccountStatusLocked
        a.UpdatedAt = time.Now().UTC()
        return nil
}

// Activate activates the account
func (a *Account) Activate() {
        a.Status = value_objects.AccountStatusActive
        a.UpdatedAt = time.Now().UTC()
}

// StartRecovery marks the account as recovering
func (a *Account) StartRecovery() error {
        if !a.Status.CanInitiateRecovery() {
                return ErrCannotInitiateRecovery
        }
        a.Status = value_objects.AccountStatusRecovering
        a.UpdatedAt = time.Now().UTC()
        return nil
}

// CompleteRecovery completes the recovery process with new public key
func (a *Account) CompleteRecovery(newPublicKey []byte, newKeygenSessionID uuid.UUID) {
        a.PublicKey = newPublicKey
        a.KeygenSessionID = newKeygenSessionID
        a.Status = value_objects.AccountStatusActive
        a.UpdatedAt = time.Now().UTC()
}

// CanLogin checks if the account can login
func (a *Account) CanLogin() bool {
        return a.Status.CanLogin()
}

// IsActive checks if the account is active
func (a *Account) IsActive() bool {
        return a.Status == value_objects.AccountStatusActive
}

// Validate validates the account data
func (a *Account) Validate() error {
        if a.Username == "" {
                return ErrInvalidUsername
        }
        if a.Email == "" {
                return ErrInvalidEmail
        }
        if len(a.PublicKey) == 0 {
                return ErrInvalidPublicKey
        }
        if a.ThresholdT > a.ThresholdN || a.ThresholdT <= 0 {
                return ErrInvalidThreshold
        }
        return nil
}

// Account errors
var (
        ErrInvalidUsername       = &AccountError{Code: "INVALID_USERNAME", Message: "username is required"}
        ErrInvalidEmail          = &AccountError{Code: "INVALID_EMAIL", Message: "email is required"}
        ErrInvalidPublicKey      = &AccountError{Code: "INVALID_PUBLIC_KEY", Message: "public key is required"}
        ErrInvalidThreshold      = &AccountError{Code: "INVALID_THRESHOLD", Message: "invalid threshold configuration"}
        ErrAccountInRecovery     = &AccountError{Code: "ACCOUNT_IN_RECOVERY", Message: "account is in recovery mode"}
        ErrCannotInitiateRecovery = &AccountError{Code: "CANNOT_INITIATE_RECOVERY", Message: "cannot initiate recovery in current state"}
        ErrAccountNotActive      = &AccountError{Code: "ACCOUNT_NOT_ACTIVE", Message: "account is not active"}
        ErrAccountNotFound       = &AccountError{Code: "ACCOUNT_NOT_FOUND", Message: "account not found"}
        ErrDuplicateUsername     = &AccountError{Code: "DUPLICATE_USERNAME", Message: "username already exists"}
        ErrDuplicateEmail        = &AccountError{Code: "DUPLICATE_EMAIL", Message: "email already exists"}
)

// AccountError represents an account domain error
type AccountError struct {
        Code    string
        Message string
}

func (e *AccountError) Error() string {
        return e.Message
}

package entities

import (
        "time"

        "github.com/google/uuid"
        "github.com/rwadurian/mpc-system/services/account/domain/value_objects"
)

// AccountShare represents a mapping of key share to account
// Note: This records share location, not share content
type AccountShare struct {
        ID         uuid.UUID
        AccountID  value_objects.AccountID
        ShareType  value_objects.ShareType
        PartyID    string
        PartyIndex int
        DeviceType *string
        DeviceID   *string
        CreatedAt  time.Time
        LastUsedAt *time.Time
        IsActive   bool
}

// NewAccountShare creates a new AccountShare
func NewAccountShare(
        accountID value_objects.AccountID,
        shareType value_objects.ShareType,
        partyID string,
        partyIndex int,
) *AccountShare {
        return &AccountShare{
                ID:         uuid.New(),
                AccountID:  accountID,
                ShareType:  shareType,
                PartyID:    partyID,
                PartyIndex: partyIndex,
                CreatedAt:  time.Now().UTC(),
                IsActive:   true,
        }
}

// SetDeviceInfo sets device information for user device shares
func (s *AccountShare) SetDeviceInfo(deviceType, deviceID string) {
        s.DeviceType = &deviceType
        s.DeviceID = &deviceID
}

// UpdateLastUsed updates the last used timestamp
func (s *AccountShare) UpdateLastUsed() {
        now := time.Now().UTC()
        s.LastUsedAt = &now
}

// Deactivate deactivates the share (e.g., when device is lost)
func (s *AccountShare) Deactivate() {
        s.IsActive = false
}

// Activate activates the share
func (s *AccountShare) Activate() {
        s.IsActive = true
}

// IsUserDeviceShare checks if this is a user device share
func (s *AccountShare) IsUserDeviceShare() bool {
        return s.ShareType == value_objects.ShareTypeUserDevice
}

// IsServerShare checks if this is a server share
func (s *AccountShare) IsServerShare() bool {
        return s.ShareType == value_objects.ShareTypeServer
}

// IsRecoveryShare checks if this is a recovery share
func (s *AccountShare) IsRecoveryShare() bool {
        return s.ShareType == value_objects.ShareTypeRecovery
}

// Validate validates the account share
func (s *AccountShare) Validate() error {
        if s.AccountID.IsZero() {
                return ErrShareInvalidAccountID
        }
        if !s.ShareType.IsValid() {
                return ErrShareInvalidType
        }
        if s.PartyID == "" {
                return ErrShareInvalidPartyID
        }
        if s.PartyIndex < 0 {
                return ErrShareInvalidPartyIndex
        }
        return nil
}

// AccountShare errors
var (
        ErrShareInvalidAccountID  = &AccountError{Code: "SHARE_INVALID_ACCOUNT_ID", Message: "invalid account ID"}
        ErrShareInvalidType       = &AccountError{Code: "SHARE_INVALID_TYPE", Message: "invalid share type"}
        ErrShareInvalidPartyID    = &AccountError{Code: "SHARE_INVALID_PARTY_ID", Message: "invalid party ID"}
        ErrShareInvalidPartyIndex = &AccountError{Code: "SHARE_INVALID_PARTY_INDEX", Message: "invalid party index"}
        ErrShareNotFound          = &AccountError{Code: "SHARE_NOT_FOUND", Message: "share not found"}
)

package entities

import (
        "time"

        "github.com/google/uuid"
        "github.com/rwadurian/mpc-system/services/account/domain/value_objects"
)

// RecoverySession represents an account recovery session
type RecoverySession struct {
        ID                 uuid.UUID
        AccountID          value_objects.AccountID
        RecoveryType       value_objects.RecoveryType
        OldShareType       *value_objects.ShareType
        NewKeygenSessionID *uuid.UUID
        Status             value_objects.RecoveryStatus
        RequestedAt        time.Time
        CompletedAt        *time.Time
}

// NewRecoverySession creates a new RecoverySession
func NewRecoverySession(
        accountID value_objects.AccountID,
        recoveryType value_objects.RecoveryType,
) *RecoverySession {
        return &RecoverySession{
                ID:           uuid.New(),
                AccountID:    accountID,
                RecoveryType: recoveryType,
                Status:       value_objects.RecoveryStatusRequested,
                RequestedAt:  time.Now().UTC(),
        }
}

// SetOldShareType sets the old share type being replaced
func (r *RecoverySession) SetOldShareType(shareType value_objects.ShareType) {
        r.OldShareType = &shareType
}

// StartKeygen starts the keygen process for recovery
func (r *RecoverySession) StartKeygen(keygenSessionID uuid.UUID) error {
        if r.Status != value_objects.RecoveryStatusRequested {
                return ErrRecoveryInvalidState
        }
        r.NewKeygenSessionID = &keygenSessionID
        r.Status = value_objects.RecoveryStatusInProgress
        return nil
}

// Complete marks the recovery as completed
func (r *RecoverySession) Complete() error {
        if r.Status != value_objects.RecoveryStatusInProgress {
                return ErrRecoveryInvalidState
        }
        now := time.Now().UTC()
        r.CompletedAt = &now
        r.Status = value_objects.RecoveryStatusCompleted
        return nil
}

// Fail marks the recovery as failed
func (r *RecoverySession) Fail() error {
        if r.Status == value_objects.RecoveryStatusCompleted {
                return ErrRecoveryAlreadyCompleted
        }
        r.Status = value_objects.RecoveryStatusFailed
        return nil
}

// IsCompleted checks if recovery is completed
func (r *RecoverySession) IsCompleted() bool {
        return r.Status == value_objects.RecoveryStatusCompleted
}

// IsFailed checks if recovery failed
func (r *RecoverySession) IsFailed() bool {
        return r.Status == value_objects.RecoveryStatusFailed
}

// IsInProgress checks if recovery is in progress
func (r *RecoverySession) IsInProgress() bool {
        return r.Status == value_objects.RecoveryStatusInProgress
}

// Validate validates the recovery session
func (r *RecoverySession) Validate() error {
        if r.AccountID.IsZero() {
                return ErrRecoveryInvalidAccountID
        }
        if !r.RecoveryType.IsValid() {
                return ErrRecoveryInvalidType
        }
        return nil
}

// Recovery errors
var (
        ErrRecoveryInvalidAccountID = &AccountError{Code: "RECOVERY_INVALID_ACCOUNT_ID", Message: "invalid account ID for recovery"}
        ErrRecoveryInvalidType      = &AccountError{Code: "RECOVERY_INVALID_TYPE", Message: "invalid recovery type"}
        ErrRecoveryInvalidState     = &AccountError{Code: "RECOVERY_INVALID_STATE", Message: "invalid recovery state for this operation"}
        ErrRecoveryAlreadyCompleted = &AccountError{Code: "RECOVERY_ALREADY_COMPLETED", Message: "recovery already completed"}
        ErrRecoveryNotFound         = &AccountError{Code: "RECOVERY_NOT_FOUND", Message: "recovery session not found"}
)

package value_objects

import (
        "github.com/google/uuid"
)

// AccountID represents a unique account identifier
type AccountID struct {
        value uuid.UUID
}

// NewAccountID creates a new AccountID
func NewAccountID() AccountID {
        return AccountID{value: uuid.New()}
}

// AccountIDFromString creates an AccountID from a string
func AccountIDFromString(s string) (AccountID, error) {
        id, err := uuid.Parse(s)
        if err != nil {
                return AccountID{}, err
        }
        return AccountID{value: id}, nil
}

// AccountIDFromUUID creates an AccountID from a UUID
func AccountIDFromUUID(id uuid.UUID) AccountID {
        return AccountID{value: id}
}

// String returns the string representation
func (id AccountID) String() string {
        return id.value.String()
}

// UUID returns the UUID value
func (id AccountID) UUID() uuid.UUID {
        return id.value
}

// IsZero checks if the AccountID is zero
func (id AccountID) IsZero() bool {
        return id.value == uuid.Nil
}

// Equals checks if two AccountIDs are equal
func (id AccountID) Equals(other AccountID) bool {
        return id.value == other.value
}

package value_objects

// AccountStatus represents the status of an account
type AccountStatus string

const (
        AccountStatusActive     AccountStatus = "active"
        AccountStatusSuspended  AccountStatus = "suspended"
        AccountStatusLocked     AccountStatus = "locked"
        AccountStatusRecovering AccountStatus = "recovering"
)

// String returns the string representation
func (s AccountStatus) String() string {
        return string(s)
}

// IsValid checks if the status is valid
func (s AccountStatus) IsValid() bool {
        switch s {
        case AccountStatusActive, AccountStatusSuspended, AccountStatusLocked, AccountStatusRecovering:
                return true
        default:
                return false
        }
}

// CanLogin checks if the account can login with this status
func (s AccountStatus) CanLogin() bool {
        return s == AccountStatusActive
}

// CanInitiateRecovery checks if recovery can be initiated
func (s AccountStatus) CanInitiateRecovery() bool {
        return s == AccountStatusActive || s == AccountStatusLocked
}

// ShareType represents the type of key share
type ShareType string

const (
        ShareTypeUserDevice ShareType = "user_device"
        ShareTypeServer     ShareType = "server"
        ShareTypeRecovery   ShareType = "recovery"
)

// String returns the string representation
func (st ShareType) String() string {
        return string(st)
}

// IsValid checks if the share type is valid
func (st ShareType) IsValid() bool {
        switch st {
        case ShareTypeUserDevice, ShareTypeServer, ShareTypeRecovery:
                return true
        default:
                return false
        }
}

// RecoveryType represents the type of account recovery
type RecoveryType string

const (
        RecoveryTypeDeviceLost    RecoveryType = "device_lost"
        RecoveryTypeShareRotation RecoveryType = "share_rotation"
)

// String returns the string representation
func (rt RecoveryType) String() string {
        return string(rt)
}

// IsValid checks if the recovery type is valid
func (rt RecoveryType) IsValid() bool {
        switch rt {
        case RecoveryTypeDeviceLost, RecoveryTypeShareRotation:
                return true
        default:
                return false
        }
}

// RecoveryStatus represents the status of a recovery session
type RecoveryStatus string

const (
        RecoveryStatusRequested  RecoveryStatus = "requested"
        RecoveryStatusInProgress RecoveryStatus = "in_progress"
        RecoveryStatusCompleted  RecoveryStatus = "completed"
        RecoveryStatusFailed     RecoveryStatus = "failed"
)

// String returns the string representation
func (rs RecoveryStatus) String() string {
        return string(rs)
}

// IsValid checks if the recovery status is valid
func (rs RecoveryStatus) IsValid() bool {
        switch rs {
        case RecoveryStatusRequested, RecoveryStatusInProgress, RecoveryStatusCompleted, RecoveryStatusFailed:
                return true
        default:
                return false
        }
}

package entities

// DeviceType represents the type of device
type DeviceType string

const (
        DeviceTypeAndroid  DeviceType = "android"
        DeviceTypeIOS      DeviceType = "ios"
        DeviceTypePC       DeviceType = "pc"
        DeviceTypeServer   DeviceType = "server"
        DeviceTypeRecovery DeviceType = "recovery"
)

// DeviceInfo holds information about a participant's device
type DeviceInfo struct {
        DeviceType DeviceType `json:"device_type"`
        DeviceID   string     `json:"device_id"`
        Platform   string     `json:"platform"`
        AppVersion string     `json:"app_version"`
}

// NewDeviceInfo creates a new DeviceInfo
func NewDeviceInfo(deviceType DeviceType, deviceID, platform, appVersion string) DeviceInfo {
        return DeviceInfo{
                DeviceType: deviceType,
                DeviceID:   deviceID,
                Platform:   platform,
                AppVersion: appVersion,
        }
}

// IsServer checks if the device is a server
func (d DeviceInfo) IsServer() bool {
        return d.DeviceType == DeviceTypeServer
}

// IsMobile checks if the device is mobile
func (d DeviceInfo) IsMobile() bool {
        return d.DeviceType == DeviceTypeAndroid || d.DeviceType == DeviceTypeIOS
}

// IsRecovery checks if the device is a recovery device
func (d DeviceInfo) IsRecovery() bool {
        return d.DeviceType == DeviceTypeRecovery
}

// Validate validates the device info
func (d DeviceInfo) Validate() error {
        if d.DeviceType == "" {
                return ErrInvalidDeviceInfo
        }
        return nil
}

package entities

import (
        "errors"
        "time"

        "github.com/google/uuid"
        "github.com/rwadurian/mpc-system/services/session-coordinator/domain/value_objects"
)

var (
        ErrSessionFull            = errors.New("session is full")
        ErrSessionExpired         = errors.New("session expired")
        ErrSessionNotInProgress   = errors.New("session not in progress")
        ErrParticipantNotFound    = errors.New("participant not found")
        ErrInvalidSessionType     = errors.New("invalid session type")
        ErrInvalidStatusTransition = errors.New("invalid status transition")
)

// SessionType represents the type of MPC session
type SessionType string

const (
        SessionTypeKeygen SessionType = "keygen"
        SessionTypeSign   SessionType = "sign"
)

// IsValid checks if the session type is valid
func (t SessionType) IsValid() bool {
        return t == SessionTypeKeygen || t == SessionTypeSign
}

// MPCSession represents an MPC session
// Coordinator only manages session metadata, does not participate in MPC computation
type MPCSession struct {
        ID           value_objects.SessionID
        SessionType  SessionType
        Threshold    value_objects.Threshold
        Participants []*Participant
        Status       value_objects.SessionStatus
        MessageHash  []byte // Used for Sign sessions
        PublicKey    []byte // Group public key after Keygen completion
        CreatedBy    string
        CreatedAt    time.Time
        UpdatedAt    time.Time
        ExpiresAt    time.Time
        CompletedAt  *time.Time
}

// NewMPCSession creates a new MPC session
func NewMPCSession(
        sessionType SessionType,
        threshold value_objects.Threshold,
        createdBy string,
        expiresIn time.Duration,
        messageHash []byte, // Only for Sign sessions
) (*MPCSession, error) {
        if !sessionType.IsValid() {
                return nil, ErrInvalidSessionType
        }

        if sessionType == SessionTypeSign && len(messageHash) == 0 {
                return nil, errors.New("message hash required for sign session")
        }

        now := time.Now().UTC()
        return &MPCSession{
                ID:           value_objects.NewSessionID(),
                SessionType:  sessionType,
                Threshold:    threshold,
                Participants: make([]*Participant, 0, threshold.N()),
                Status:       value_objects.SessionStatusCreated,
                MessageHash:  messageHash,
                CreatedBy:    createdBy,
                CreatedAt:    now,
                UpdatedAt:    now,
                ExpiresAt:    now.Add(expiresIn),
        }, nil
}

// AddParticipant adds a participant to the session
func (s *MPCSession) AddParticipant(p *Participant) error {
        if len(s.Participants) >= s.Threshold.N() {
                return ErrSessionFull
        }
        s.Participants = append(s.Participants, p)
        s.UpdatedAt = time.Now().UTC()
        return nil
}

// GetParticipant gets a participant by party ID
func (s *MPCSession) GetParticipant(partyID value_objects.PartyID) (*Participant, error) {
        for _, p := range s.Participants {
                if p.PartyID.Equals(partyID) {
                        return p, nil
                }
        }
        return nil, ErrParticipantNotFound
}

// UpdateParticipantStatus updates a participant's status
func (s *MPCSession) UpdateParticipantStatus(partyID value_objects.PartyID, status value_objects.ParticipantStatus) error {
        for _, p := range s.Participants {
                if p.PartyID.Equals(partyID) {
                        switch status {
                        case value_objects.ParticipantStatusJoined:
                                return p.Join()
                        case value_objects.ParticipantStatusReady:
                                return p.MarkReady()
                        case value_objects.ParticipantStatusCompleted:
                                return p.MarkCompleted()
                        case value_objects.ParticipantStatusFailed:
                                p.MarkFailed()
                                return nil
                        default:
                                return errors.New("invalid status")
                        }
                }
        }
        return ErrParticipantNotFound
}

// CanStart checks if all participants have joined and the session can start
func (s *MPCSession) CanStart() bool {
        if len(s.Participants) != s.Threshold.N() {
                return false
        }

        joinedCount := 0
        for _, p := range s.Participants {
                if p.IsJoined() {
                        joinedCount++
                }
        }
        return joinedCount == s.Threshold.N()
}

// Start transitions the session to in_progress
func (s *MPCSession) Start() error {
        if !s.Status.CanTransitionTo(value_objects.SessionStatusInProgress) {
                return ErrInvalidStatusTransition
        }
        if !s.CanStart() {
                return errors.New("not all participants have joined")
        }
        s.Status = value_objects.SessionStatusInProgress
        s.UpdatedAt = time.Now().UTC()
        return nil
}

// Complete marks the session as completed
func (s *MPCSession) Complete(publicKey []byte) error {
        if !s.Status.CanTransitionTo(value_objects.SessionStatusCompleted) {
                return ErrInvalidStatusTransition
        }
        s.Status = value_objects.SessionStatusCompleted
        s.PublicKey = publicKey
        now := time.Now().UTC()
        s.CompletedAt = &now
        s.UpdatedAt = now
        return nil
}

// Fail marks the session as failed
func (s *MPCSession) Fail() error {
        if !s.Status.CanTransitionTo(value_objects.SessionStatusFailed) {
                return ErrInvalidStatusTransition
        }
        s.Status = value_objects.SessionStatusFailed
        s.UpdatedAt = time.Now().UTC()
        return nil
}

// Expire marks the session as expired
func (s *MPCSession) Expire() error {
        if !s.Status.CanTransitionTo(value_objects.SessionStatusExpired) {
                return ErrInvalidStatusTransition
        }
        s.Status = value_objects.SessionStatusExpired
        s.UpdatedAt = time.Now().UTC()
        return nil
}

// IsExpired checks if the session has expired
func (s *MPCSession) IsExpired() bool {
        return time.Now().UTC().After(s.ExpiresAt)
}

// IsActive checks if the session is active
func (s *MPCSession) IsActive() bool {
        return s.Status.IsActive() && !s.IsExpired()
}

// IsParticipant checks if a party is a participant
func (s *MPCSession) IsParticipant(partyID value_objects.PartyID) bool {
        for _, p := range s.Participants {
                if p.PartyID.Equals(partyID) {
                        return true
                }
        }
        return false
}

// AllCompleted checks if all participants have completed
func (s *MPCSession) AllCompleted() bool {
        for _, p := range s.Participants {
                if !p.IsCompleted() {
                        return false
                }
        }
        return true
}

// CompletedCount returns the number of completed participants
func (s *MPCSession) CompletedCount() int {
        count := 0
        for _, p := range s.Participants {
                if p.IsCompleted() {
                        count++
                }
        }
        return count
}

// JoinedCount returns the number of joined participants
func (s *MPCSession) JoinedCount() int {
        count := 0
        for _, p := range s.Participants {
                if p.IsJoined() {
                        count++
                }
        }
        return count
}

// GetPartyIDs returns all party IDs
func (s *MPCSession) GetPartyIDs() []string {
        ids := make([]string, len(s.Participants))
        for i, p := range s.Participants {
                ids[i] = p.PartyID.String()
        }
        return ids
}

// GetOtherParties returns participants except the specified party
func (s *MPCSession) GetOtherParties(excludePartyID value_objects.PartyID) []*Participant {
        others := make([]*Participant, 0, len(s.Participants)-1)
        for _, p := range s.Participants {
                if !p.PartyID.Equals(excludePartyID) {
                        others = append(others, p)
                }
        }
        return others
}

// ToDTO converts to a DTO for API responses
func (s *MPCSession) ToDTO() SessionDTO {
        participants := make([]ParticipantDTO, len(s.Participants))
        for i, p := range s.Participants {
                participants[i] = ParticipantDTO{
                        PartyID:    p.PartyID.String(),
                        PartyIndex: p.PartyIndex,
                        Status:     p.Status.String(),
                        DeviceType: string(p.DeviceInfo.DeviceType),
                }
        }

        return SessionDTO{
                ID:           s.ID.String(),
                SessionType:  string(s.SessionType),
                ThresholdN:   s.Threshold.N(),
                ThresholdT:   s.Threshold.T(),
                Participants: participants,
                Status:       s.Status.String(),
                CreatedAt:    s.CreatedAt,
                ExpiresAt:    s.ExpiresAt,
        }
}

// SessionDTO is a data transfer object for sessions
type SessionDTO struct {
        ID           string           `json:"id"`
        SessionType  string           `json:"session_type"`
        ThresholdN   int              `json:"threshold_n"`
        ThresholdT   int              `json:"threshold_t"`
        Participants []ParticipantDTO `json:"participants"`
        Status       string           `json:"status"`
        CreatedAt    time.Time        `json:"created_at"`
        ExpiresAt    time.Time        `json:"expires_at"`
}

// ParticipantDTO is a data transfer object for participants
type ParticipantDTO struct {
        PartyID    string `json:"party_id"`
        PartyIndex int    `json:"party_index"`
        Status     string `json:"status"`
        DeviceType string `json:"device_type"`
}

// Reconstruct reconstructs an MPCSession from database
func ReconstructSession(
        id uuid.UUID,
        sessionType string,
        thresholdT, thresholdN int,
        status string,
        messageHash, publicKey []byte,
        createdBy string,
        createdAt, updatedAt, expiresAt time.Time,
        completedAt *time.Time,
        participants []*Participant,
) (*MPCSession, error) {
        sessionStatus, err := value_objects.NewSessionStatus(status)
        if err != nil {
                return nil, err
        }

        threshold, err := value_objects.NewThreshold(thresholdT, thresholdN)
        if err != nil {
                return nil, err
        }

        return &MPCSession{
                ID:           value_objects.SessionIDFromUUID(id),
                SessionType:  SessionType(sessionType),
                Threshold:    threshold,
                Participants: participants,
                Status:       sessionStatus,
                MessageHash:  messageHash,
                PublicKey:    publicKey,
                CreatedBy:    createdBy,
                CreatedAt:    createdAt,
                UpdatedAt:    updatedAt,
                ExpiresAt:    expiresAt,
                CompletedAt:  completedAt,
        }, nil
}

package entities

import (
        "errors"
        "time"

        "github.com/rwadurian/mpc-system/services/session-coordinator/domain/value_objects"
)

var (
        ErrInvalidDeviceInfo     = errors.New("invalid device info")
        ErrParticipantNotInvited = errors.New("participant not in invited status")
        ErrInvalidParticipant    = errors.New("invalid participant")
)

// Participant represents a party in an MPC session
type Participant struct {
        PartyID     value_objects.PartyID
        PartyIndex  int
        Status      value_objects.ParticipantStatus
        DeviceInfo  DeviceInfo
        PublicKey   []byte // Party's identity public key (for authentication)
        JoinedAt    time.Time
        CompletedAt *time.Time
}

// NewParticipant creates a new participant
func NewParticipant(partyID value_objects.PartyID, partyIndex int, deviceInfo DeviceInfo) (*Participant, error) {
        if partyID.IsZero() {
                return nil, ErrInvalidParticipant
        }
        if partyIndex < 0 {
                return nil, ErrInvalidParticipant
        }
        if err := deviceInfo.Validate(); err != nil {
                return nil, err
        }

        return &Participant{
                PartyID:    partyID,
                PartyIndex: partyIndex,
                Status:     value_objects.ParticipantStatusInvited,
                DeviceInfo: deviceInfo,
                JoinedAt:   time.Now().UTC(),
        }, nil
}

// Join marks the participant as joined
func (p *Participant) Join() error {
        if !p.Status.CanTransitionTo(value_objects.ParticipantStatusJoined) {
                return errors.New("cannot transition to joined status")
        }
        p.Status = value_objects.ParticipantStatusJoined
        p.JoinedAt = time.Now().UTC()
        return nil
}

// MarkReady marks the participant as ready
func (p *Participant) MarkReady() error {
        if !p.Status.CanTransitionTo(value_objects.ParticipantStatusReady) {
                return errors.New("cannot transition to ready status")
        }
        p.Status = value_objects.ParticipantStatusReady
        return nil
}

// MarkCompleted marks the participant as completed
func (p *Participant) MarkCompleted() error {
        if !p.Status.CanTransitionTo(value_objects.ParticipantStatusCompleted) {
                return errors.New("cannot transition to completed status")
        }
        p.Status = value_objects.ParticipantStatusCompleted
        now := time.Now().UTC()
        p.CompletedAt = &now
        return nil
}

// MarkFailed marks the participant as failed
func (p *Participant) MarkFailed() {
        p.Status = value_objects.ParticipantStatusFailed
}

// IsJoined checks if the participant has joined
func (p *Participant) IsJoined() bool {
        return p.Status == value_objects.ParticipantStatusJoined ||
                p.Status == value_objects.ParticipantStatusReady ||
                p.Status == value_objects.ParticipantStatusCompleted
}

// IsReady checks if the participant is ready
func (p *Participant) IsReady() bool {
        return p.Status == value_objects.ParticipantStatusReady ||
                p.Status == value_objects.ParticipantStatusCompleted
}

// IsCompleted checks if the participant has completed
func (p *Participant) IsCompleted() bool {
        return p.Status == value_objects.ParticipantStatusCompleted
}

// IsFailed checks if the participant has failed
func (p *Participant) IsFailed() bool {
        return p.Status == value_objects.ParticipantStatusFailed
}

// SetPublicKey sets the participant's public key
func (p *Participant) SetPublicKey(publicKey []byte) {
        p.PublicKey = publicKey
}

package entities

import (
        "time"

        "github.com/google/uuid"
        "github.com/rwadurian/mpc-system/services/session-coordinator/domain/value_objects"
)

// SessionMessage represents an MPC message (encrypted, Coordinator does not decrypt)
type SessionMessage struct {
        ID          uuid.UUID
        SessionID   value_objects.SessionID
        FromParty   value_objects.PartyID
        ToParties   []value_objects.PartyID // nil means broadcast
        RoundNumber int
        MessageType string
        Payload     []byte // Encrypted MPC protocol message
        CreatedAt   time.Time
        DeliveredAt *time.Time
}

// NewSessionMessage creates a new session message
func NewSessionMessage(
        sessionID value_objects.SessionID,
        fromParty value_objects.PartyID,
        toParties []value_objects.PartyID,
        roundNumber int,
        messageType string,
        payload []byte,
) *SessionMessage {
        return &SessionMessage{
                ID:          uuid.New(),
                SessionID:   sessionID,
                FromParty:   fromParty,
                ToParties:   toParties,
                RoundNumber: roundNumber,
                MessageType: messageType,
                Payload:     payload,
                CreatedAt:   time.Now().UTC(),
        }
}

// IsBroadcast checks if the message is a broadcast
func (m *SessionMessage) IsBroadcast() bool {
        return len(m.ToParties) == 0
}

// IsFor checks if the message is for a specific party
func (m *SessionMessage) IsFor(partyID value_objects.PartyID) bool {
        if m.IsBroadcast() {
                // Broadcast is for everyone except sender
                return !m.FromParty.Equals(partyID)
        }

        for _, to := range m.ToParties {
                if to.Equals(partyID) {
                        return true
                }
        }
        return false
}

// MarkDelivered marks the message as delivered
func (m *SessionMessage) MarkDelivered() {
        now := time.Now().UTC()
        m.DeliveredAt = &now
}

// IsDelivered checks if the message has been delivered
func (m *SessionMessage) IsDelivered() bool {
        return m.DeliveredAt != nil
}

// GetToPartyStrings returns to parties as strings
func (m *SessionMessage) GetToPartyStrings() []string {
        if m.IsBroadcast() {
                return nil
        }
        result := make([]string, len(m.ToParties))
        for i, p := range m.ToParties {
                result[i] = p.String()
        }
        return result
}

// ToDTO converts to a DTO
func (m *SessionMessage) ToDTO() MessageDTO {
        toParties := m.GetToPartyStrings()
        return MessageDTO{
                ID:          m.ID.String(),
                SessionID:   m.SessionID.String(),
                FromParty:   m.FromParty.String(),
                ToParties:   toParties,
                IsBroadcast: m.IsBroadcast(),
                RoundNumber: m.RoundNumber,
                MessageType: m.MessageType,
                Payload:     m.Payload,
                CreatedAt:   m.CreatedAt,
        }
}

// MessageDTO is a data transfer object for messages
type MessageDTO struct {
        ID          string    `json:"id"`
        SessionID   string    `json:"session_id"`
        FromParty   string    `json:"from_party"`
        ToParties   []string  `json:"to_parties,omitempty"`
        IsBroadcast bool      `json:"is_broadcast"`
        RoundNumber int       `json:"round_number"`
        MessageType string    `json:"message_type"`
        Payload     []byte    `json:"payload"`
        CreatedAt   time.Time `json:"created_at"`
}

package value_objects

import (
        "errors"
        "regexp"
)

var (
        ErrInvalidPartyID = errors.New("invalid party ID")
        partyIDRegex      = regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)
)

// PartyID represents a unique party identifier
type PartyID struct {
        value string
}

// NewPartyID creates a new PartyID
func NewPartyID(value string) (PartyID, error) {
        if value == "" {
                return PartyID{}, ErrInvalidPartyID
        }
        if !partyIDRegex.MatchString(value) {
                return PartyID{}, ErrInvalidPartyID
        }
        if len(value) > 255 {
                return PartyID{}, ErrInvalidPartyID
        }
        return PartyID{value: value}, nil
}

// MustNewPartyID creates a new PartyID, panics on error
func MustNewPartyID(value string) PartyID {
        id, err := NewPartyID(value)
        if err != nil {
                panic(err)
        }
        return id
}

// String returns the string representation
func (id PartyID) String() string {
        return id.value
}

// IsZero checks if the PartyID is zero
func (id PartyID) IsZero() bool {
        return id.value == ""
}

// Equals checks if two PartyIDs are equal
func (id PartyID) Equals(other PartyID) bool {
        return id.value == other.value
}

package value_objects

import (
        "github.com/google/uuid"
)

// SessionID represents a unique session identifier
type SessionID struct {
        value uuid.UUID
}

// NewSessionID creates a new SessionID
func NewSessionID() SessionID {
        return SessionID{value: uuid.New()}
}

// SessionIDFromString creates a SessionID from a string
func SessionIDFromString(s string) (SessionID, error) {
        id, err := uuid.Parse(s)
        if err != nil {
                return SessionID{}, err
        }
        return SessionID{value: id}, nil
}

// SessionIDFromUUID creates a SessionID from a UUID
func SessionIDFromUUID(id uuid.UUID) SessionID {
        return SessionID{value: id}
}

// String returns the string representation
func (id SessionID) String() string {
        return id.value.String()
}

// UUID returns the UUID value
func (id SessionID) UUID() uuid.UUID {
        return id.value
}

// IsZero checks if the SessionID is zero
func (id SessionID) IsZero() bool {
        return id.value == uuid.Nil
}

// Equals checks if two SessionIDs are equal
func (id SessionID) Equals(other SessionID) bool {
        return id.value == other.value
}

package value_objects

import (
        "errors"
)

var ErrInvalidSessionStatus = errors.New("invalid session status")

// SessionStatus represents the status of an MPC session
type SessionStatus string

const (
        SessionStatusCreated    SessionStatus = "created"
        SessionStatusInProgress SessionStatus = "in_progress"
        SessionStatusCompleted  SessionStatus = "completed"
        SessionStatusFailed     SessionStatus = "failed"
        SessionStatusExpired    SessionStatus = "expired"
)

// ValidSessionStatuses contains all valid session statuses
var ValidSessionStatuses = []SessionStatus{
        SessionStatusCreated,
        SessionStatusInProgress,
        SessionStatusCompleted,
        SessionStatusFailed,
        SessionStatusExpired,
}

// NewSessionStatus creates a new SessionStatus from string
func NewSessionStatus(s string) (SessionStatus, error) {
        status := SessionStatus(s)
        if !status.IsValid() {
                return "", ErrInvalidSessionStatus
        }
        return status, nil
}

// String returns the string representation
func (s SessionStatus) String() string {
        return string(s)
}

// IsValid checks if the status is valid
func (s SessionStatus) IsValid() bool {
        for _, valid := range ValidSessionStatuses {
                if s == valid {
                        return true
                }
        }
        return false
}

// CanTransitionTo checks if the status can transition to another
func (s SessionStatus) CanTransitionTo(target SessionStatus) bool {
        transitions := map[SessionStatus][]SessionStatus{
                SessionStatusCreated:    {SessionStatusInProgress, SessionStatusFailed, SessionStatusExpired},
                SessionStatusInProgress: {SessionStatusCompleted, SessionStatusFailed, SessionStatusExpired},
                SessionStatusCompleted:  {},
                SessionStatusFailed:     {},
                SessionStatusExpired:    {},
        }

        allowed, ok := transitions[s]
        if !ok {
                return false
        }

        for _, status := range allowed {
                if status == target {
                        return true
                }
        }
        return false
}

// IsTerminal checks if the status is terminal (cannot transition)
func (s SessionStatus) IsTerminal() bool {
        return s == SessionStatusCompleted || s == SessionStatusFailed || s == SessionStatusExpired
}

// IsActive checks if the session is active
func (s SessionStatus) IsActive() bool {
        return s == SessionStatusCreated || s == SessionStatusInProgress
}

// ParticipantStatus represents the status of a participant
type ParticipantStatus string

const (
        ParticipantStatusInvited   ParticipantStatus = "invited"
        ParticipantStatusJoined    ParticipantStatus = "joined"
        ParticipantStatusReady     ParticipantStatus = "ready"
        ParticipantStatusCompleted ParticipantStatus = "completed"
        ParticipantStatusFailed    ParticipantStatus = "failed"
)

// ValidParticipantStatuses contains all valid participant statuses
var ValidParticipantStatuses = []ParticipantStatus{
        ParticipantStatusInvited,
        ParticipantStatusJoined,
        ParticipantStatusReady,
        ParticipantStatusCompleted,
        ParticipantStatusFailed,
}

// String returns the string representation
func (s ParticipantStatus) String() string {
        return string(s)
}

// IsValid checks if the status is valid
func (s ParticipantStatus) IsValid() bool {
        for _, valid := range ValidParticipantStatuses {
                if s == valid {
                        return true
                }
        }
        return false
}

// CanTransitionTo checks if the status can transition to another
func (s ParticipantStatus) CanTransitionTo(target ParticipantStatus) bool {
        transitions := map[ParticipantStatus][]ParticipantStatus{
                ParticipantStatusInvited:   {ParticipantStatusJoined, ParticipantStatusFailed},
                ParticipantStatusJoined:    {ParticipantStatusReady, ParticipantStatusFailed},
                ParticipantStatusReady:     {ParticipantStatusCompleted, ParticipantStatusFailed},
                ParticipantStatusCompleted: {},
                ParticipantStatusFailed:    {},
        }

        allowed, ok := transitions[s]
        if !ok {
                return false
        }

        for _, status := range allowed {
                if status == target {
                        return true
                }
        }
        return false
}

package value_objects

import (
        "errors"
        "fmt"
)

var (
        ErrInvalidThreshold   = errors.New("invalid threshold")
        ErrThresholdTooLarge  = errors.New("threshold t cannot exceed n")
        ErrThresholdTooSmall  = errors.New("threshold t must be at least 1")
        ErrNTooSmall          = errors.New("n must be at least 2")
        ErrNTooLarge          = errors.New("n cannot exceed maximum allowed")
)

const (
        MinN = 2
        MaxN = 10
        MinT = 1
)

// Threshold represents the t-of-n threshold configuration
type Threshold struct {
        t int // Minimum number of parties required
        n int // Total number of parties
}

// NewThreshold creates a new Threshold value object
func NewThreshold(t, n int) (Threshold, error) {
        if n < MinN {
                return Threshold{}, ErrNTooSmall
        }
        if n > MaxN {
                return Threshold{}, ErrNTooLarge
        }
        if t < MinT {
                return Threshold{}, ErrThresholdTooSmall
        }
        if t > n {
                return Threshold{}, ErrThresholdTooLarge
        }
        return Threshold{t: t, n: n}, nil
}

// MustNewThreshold creates a new Threshold, panics on error
func MustNewThreshold(t, n int) Threshold {
        threshold, err := NewThreshold(t, n)
        if err != nil {
                panic(err)
        }
        return threshold
}

// T returns the minimum required parties
func (th Threshold) T() int {
        return th.t
}

// N returns the total parties
func (th Threshold) N() int {
        return th.n
}

// IsZero checks if the Threshold is zero
func (th Threshold) IsZero() bool {
        return th.t == 0 && th.n == 0
}

// Equals checks if two Thresholds are equal
func (th Threshold) Equals(other Threshold) bool {
        return th.t == other.t && th.n == other.n
}

// String returns the string representation
func (th Threshold) String() string {
        return fmt.Sprintf("%d-of-%d", th.t, th.n)
}

// CanSign checks if the given number of parties can sign
func (th Threshold) CanSign(availableParties int) bool {
        return availableParties >= th.t
}

// RequiresAllParties checks if all parties are required
func (th Threshold) RequiresAllParties() bool {
        return th.t == th.n
}