gateway

type Basis string

type Coverage struct {
	Note    string  `json:"_note"`
	Sources Sources `json:"sources"`

	// Spec maps a gateway path (ProPrefix/ClassicPrefix + normalised path) to the
	// methods the published spec declares for it. This is the whole basis of a
	// verdict: declared is served, undeclared is refused.
	Spec map[string][]string `json:"spec"`

	// Scopes maps the same key to method → the gateway scopes the operation
	// requires, from x-required-privileges.
	//
	// Nothing consumes these yet. They are the missing input for the Platform 403
	// privilege hint (only Pro appends privilege names to a 403 today), and they
	// are why this package no longer needs the GitOps bundle: the bundle's
	// _permissions/routes.yaml carried exactly this map, and as of SDK adb8d7b the
	// two agree entry for entry — 1352 operations, zero disagreements, none on
	// either side alone.
	Scopes map[string]map[string][]string `json:"scopes"`
}

type Entry struct {
	Method string
	Path   string
	Level  Level
	Basis  Basis
	Detail string
}

type Level string

type Op struct {
	Method      string
	GatewayPath string
	// Scope is the granularity of the verdict; see Scope.
	Scope Scope
	// Set records the verdict back onto whatever the caller parsed. It takes the
	// whole Verdict rather than its strings because the scopes travel with it —
	// per operation for a modern path, per method for a Classic subtree.
	Set func(Verdict)
}

type Scope int

type Sources struct {
	Pro     SpecSource `json:"pro"`
	Classic SpecSource `json:"classic"`
	// SDKCommit is the jamfplatform-go-sdk revision the specs were copied from,
	// when the sync was given an SDK checkout. Empty when derived straight from
	// the drop directory, which is the case a developer hits after editing a spec
	// by hand — better empty than confidently wrong.
	SDKCommit string `json:"sdkCommit,omitempty"`
}

type SpecSource struct {
	File       string `json:"file"`
	Title      string `json:"title"`
	Version    string `json:"version"`
	Paths      int    `json:"paths"`
	Operations int    `json:"operations"`
}

type Verdict struct {
	Level Level
	Basis Basis
	// Detail is a sentence fragment naming the evidence, e.g. "not declared by
	// the gateway's Jamf Pro API 11.31.0".
	Detail string
	// Scopes are the gateway scopes the operation requires, from the spec's
	// x-required-privileges. Empty for an unserved operation by definition, and
	// legitimately empty for the 44 unauthenticated Jamf Pro endpoints.
	Scopes []string
	// ScopesByMethod is the subtree form of Scopes, set only by VerdictSubtree:
	// a Classic resource is judged as a whole but its scopes are per method
	// (accounts:read for a GET, accounts:update for a PUT), so one flat list
	// would tell a reader that a list needs the delete permission.
	ScopesByMethod map[string][]string
}