lazyconn

type Asker interface {
	Ask(ctx context.Context, t *ticket.Ticket, screen render.MaskedScreen) (*ticket.Decision, error)
}

type Config[C io.Closer] struct {
	// Lock is the product ("locksql"), the ticket's Source.Lock.
	Lock  string
	Asker Asker
	// Profile reads a profile's configuration at each connect; an error
	// fails the request without a ticket.
	Profile func(name string) (Profile, error)
	// Dial opens the backend connection for profile name on g.
	Dial func(ctx context.Context, name string, g Grant) (C, error)
	// Idle, AskTimeout and MaxAge default to DefaultIdle,
	// DefaultAskTimeout and DefaultMaxAge when <= 0.
	Idle, AskTimeout, MaxAge time.Duration
	// Now is the clock (nil: time.Now); AfterFunc schedules the idle
	// close (nil: time.AfterFunc).
	Now       func() time.Time
	AfterFunc func(time.Duration, func()) Timer
	// OnEvent, if set, is called for every Event, outside the pool's
	// lock.
	OnEvent func(Event)
}

type Event struct {
	Kind     EventKind
	Profile  string
	Ticket   string
	Decision *ticket.Decision
	Err      error
}

type EventKind string

type Grant struct {
	Ticket   *ticket.Ticket
	Decision *ticket.Decision
	Secret   []byte
}

type Pool[C io.Closer] struct {
	// contains filtered or unexported fields
}

type Profile struct {
	// Endpoint is the backend, without userinfo ("db.internal:5432/shop").
	Endpoint string
	// Credential is the profile's credential source (ticket.Credential*).
	Credential string
	// NeedSecret asks the decider for the secret (credentials "ask", an
	// expired Vault token): the ticket carries a one-use key and Dial gets
	// the secret in Grant.Secret.
	NeedSecret bool
	// PolicyFP is the fingerprint of the policy in force (ticket.HashOf).
	PolicyFP string
	// Risk is the ticket's risk class (ticket.KindRisks of connect); ""
	// is unlock with NeedSecret, prod-write in production, read otherwise.
	Risk ticket.Risk
	// Production marks a production profile; NeverAuto keeps an auto
	// rule from approving the connection.
	Production, NeverAuto bool
	// Masking masks the screen (render.MaskScreen; zero: every detector).
	Masking render.Masking
}

type Request struct {
	Profile string
	// Requester, Workspace and Note are shown with the ticket (display
	// only, untrusted).
	Requester ticket.Requester
	Workspace string
	Note      string
}

type Timer interface{ Stop() bool }