web

type ACMEAdmin interface {
	// Waiting counts orders whose certificate waits for the unseal.
	Waiting(ctx context.Context) (int64, error)
	// Pending counts accounts and names that wait for an admin.
	Pending(ctx context.Context) (accounts, names int64, err error)
	Accounts(ctx context.Context, who keys.Who) ([]acme.AccountInfo, error)
	Account(ctx context.Context, who keys.Who, id string) (*acme.AccountInfo, error)
	ApproveAccount(ctx context.Context, id string, who keys.Who) error
	Names(ctx context.Context, who keys.Who) ([]acme.NameInfo, error)
	DecideName(ctx context.Context, name string, approve bool, who keys.Who) error
	Orders(ctx context.Context, who keys.Who) ([]acme.OrderInfo, error)
	EABKeys(ctx context.Context, who keys.Who) ([]acme.EABKeyInfo, error)
	CreateEABKey(ctx context.Context, label string, days int, who keys.Who) (*acme.NewEABKey, error)
}

type AppDeps struct {
	Auth    *auth.Service
	Engine  *ca.Engine
	Keys    *keys.Keyring
	Presets *preset.Set
	Clock   clock.Clock
	// TrustedProxies may set X-Forwarded-For (auth.trusted_proxies).
	TrustedProxies []netip.Prefix
	Demo           bool
	Tenant         string // the tenant of this instance (phase 1: one)
	// Settings, TenantAudit and InstanceAudit serve the pages of step 19
	// (tenant settings, audit log); nil hides those pages.
	Settings                   *tenant.Store
	TenantAudit, InstanceAudit *sql.DB
	// ACME is the ACME server (PHASE2); nil while ACME is off.
	ACME ACMEAdmin
	// ACMEDirectory is the directory URL clients use (shown with EAB keys).
	ACMEDirectory string
}

type Options struct {
	// Dev shows the DEV MODE banner on every page and enables the UI
	// prototype on fixture data.
	Dev    bool
	Logger *slog.Logger
	// App, if set, serves the real UI on the services (phase 1 step 14)
	// instead of the gallery; Dev and App are exclusive.
	App *AppDeps
}