"""
Authentication Domain

Provides OIDC/OAuth2 authentication via Authentik, user management,
roles, groups, and API key authentication.
"""
from src.domains.auth.oidc import (
    get_current_user,
    get_admin_user,
    get_optional_user,
    get_forward_auth_user,
    get_forward_auth_admin,
    oidc_config,
    # Permission system
    require_permission,
    require_any_permission,
    ACTION_HIERARCHY,
    VALID_DOMAINS,
    DEFAULT_CATEGORY,
)
from src.domains.auth.service import AuthService, get_auth_service
from src.domains.auth.controller import auth_controller
from src.domains.auth.models import (
    User,
    Role,
    UserRole,
    Group,
    UserPreferences,
    ApiKey,
    user_groups,
    group_roles,
)

__all__ = [
    # OIDC dependencies
    "get_current_user",
    "get_admin_user",
    "get_optional_user",
    "get_forward_auth_user",
    "get_forward_auth_admin",
    "oidc_config",
    # Permission system
    "require_permission",
    "require_any_permission",
    "ACTION_HIERARCHY",
    "VALID_DOMAINS",
    "DEFAULT_CATEGORY",
    # Service
    "AuthService",
    "get_auth_service",
    # Controller
    "auth_controller",
    # Models
    "User",
    "Role",
    "UserRole",
    "Group",
    "UserPreferences",
    "ApiKey",
    "user_groups",
    "group_roles",
]