dbaccess

type CreateParams struct {
	Role       string
	Database   string
	AdminRole  string
	Preset     Preset
	Verifier   string
	ConnLimit  int
	ValidUntil time.Time
}

type CreateParamsIn struct {
	Role       string
	Preset     Preset
	ConnLimit  int
	ValidUntil time.Time
	// Temporary skips the user-name reservation so a generated tmp_ name is accepted.
	Temporary bool
}

type Credential struct {
	Role       string
	Password   string
	ValidUntil time.Time
}

type Exec interface {
	ExecWithInput(ctx context.Context, containerID string, cmd []string, stdin io.Reader) (io.ReadCloser, error)
}

type Placement struct {
	Name          string `json:"name"`
	ProjectID     string `json:"project_id,omitempty"`
	EnvironmentID string `json:"environment_id,omitempty"`
	// ProjectName and EnvironmentName are only used to word reasons.
	ProjectName     string `json:"project_name,omitempty"`
	EnvironmentName string `json:"environment_name,omitempty"`
}

type Postgres struct {
	Exec        Exec
	ContainerID string
	Admin       string
	Database    string
}

type Preset string

type Revoker interface {
	RevokeTemp(ctx context.Context, database, role string) error
}

type Role struct {
	Name        string `json:"name"`
	CanLogin    bool   `json:"can_login"`
	Superuser   bool   `json:"superuser"`
	CreateDB    bool   `json:"create_db"`
	CreateRole  bool   `json:"create_role"`
	Replication bool   `json:"replication"`
	ConnLimit   int    `json:"connection_limit"`
	ValidUntil  string `json:"valid_until,omitempty"`
	Connections int    `json:"connections"`
}

type Scope string

type StatementError struct{ Message string }

type StoreAdapter struct{ DB *store.DB }

type SweepAuditor interface {
	RecordRevoked(ctx context.Context, c TempCredential)
}

type SweepStore interface {
	// DueTempCredentials lists credentials past ExpiresAt that are not yet revoked.
	DueTempCredentials(ctx context.Context, now time.Time) ([]TempCredential, error)
	// ClaimTempCredential moves one to revoking. A stale claim from a
	// crashed pass is reclaimable after lease. False means someone else has it.
	ClaimTempCredential(ctx context.Context, id string, now time.Time, lease time.Duration) (bool, error)
	CompleteTempCredential(ctx context.Context, id string, now time.Time) error
	// ReleaseTempCredential returns a claimed credential for the next pass.
	ReleaseTempCredential(ctx context.Context, id string) error
}

type Sweeper struct {
	Store   SweepStore
	Revoker Revoker
	Auditor SweepAuditor
	Logger  *slog.Logger
	Now     func() time.Time
	// Lease is how long a revoking claim is honoured before another pass retakes it.
	Lease time.Duration
}

type TTLLimits struct {
	Min, Max, Default time.Duration
}

type TempCredential struct {
	ID        string
	Database  string
	Role      string
	Preset    Preset
	CreatedBy string
	CreatedAt time.Time
	ExpiresAt time.Time
}

type Verdict struct {
	App     Placement `json:"app"`
	Allowed bool      `json:"allowed"`
	Reason  string    `json:"reason,omitempty"`
}