postprocess

type ExtractSpec struct {
	// ResourceType is the TF resource type this spec applies to.
	ResourceType string
	// BlockPath navigates nested HCL blocks to the container holding AttrName.
	BlockPath []string
	// AttrPath navigates nested object-expression attributes to the container.
	AttrPath []string
	// AttrName is the string attribute to extract (e.g. "script_contents", "payloads").
	AttrName string
	// OutputSubdir is the directory under support_files/ to write the file into.
	OutputSubdir string
	// FileKind selects the file extension.
	FileKind FileKind
	// Ext is the literal file extension (including leading dot) used when
	// FileKind is FileKindRaw; ignored for other kinds.
	Ext string
	// NameAttr names the attribute used to derive the filename (default "name").
	NameAttr string
	// NameAttrPath is the object-attribute path to the container holding NameAttr
	// (empty = resource root; e.g. ["general"] for jamfplatform profiles).
	NameAttrPath []string
	// SkipFn, when set, is consulted with the extracted content; a true result
	// means the whole resource should be dropped from output (handled by the caller).
	SkipFn func(content string) (bool, string)
}

type FileKind int

type FixEdit struct {
	Resource string // resource address, e.g. "jamfplatform_pro_policy.install_chrome"
	Attr     string // attribute path
	Action   string // "removed", "set" or "replaced with a variable"
	Reason   string // the diagnostic summary
}

type FixResult struct {
	Fixed        int           // total attributes fixed (removed, set, or replaced)
	RequiredVars []RequiredVar // write-only variables that need user-supplied values
	// Edits records what was changed and why, one entry per fix. The auto-fix
	// edits generated configuration on the user's behalf, so it has to be able
	// to say what it touched — a bare count leaves no way to tell a correct
	// repair from a wrong one, or to notice when a provider fix upstream has
	// made a repair unnecessary.
	Edits []FixEdit
	// StillInvalid reports that the project did not pass terraform validate by
	// the time the fix loop gave up — either nothing left was auto-fixable or
	// the iteration cap was reached. FixValidationErrors returns a nil error in
	// both cases (an unfixable diagnostic is not a jamformer failure), so
	// without this the caller has no way to tell a repaired project from one
	// that still will not plan, and would print a success summary over it.
	StillInvalid bool
}

type LabelComposer func(resourceType string, body *hclwrite.Body, idLookup func() string) string

type ProcessOptions struct {
	// TypeToFileMap maps TF resource type → output filename. Required.
	TypeToFileMap map[string]string
	// Rules defines the cross-resource reference rewriting rules.
	Rules []ReferenceRule
	// PackageFiles maps package filename -> relative path for downloaded packages.
	PackageFiles map[string]string
	// PackageInfo maps package_name -> filename from discovery.
	PackageInfo map[string]string
	// PlatformPackageFiles maps a jamfplatform_pro_package file_name -> relative
	// path for files downloaded from JCDS. When a package's file_name is present,
	// post-processing switches it to upload mode: package_file_source = file(...)
	// and the conflicting server-supplied hash attributes are removed.
	PlatformPackageFiles map[string]string
	// IconURLs maps icon Jamf ID -> CDN URL for icon_file_web_source.
	IconURLs map[string]string
	// EnrollmentCustomizationImageFiles maps enrollment customization Jamf ID -> relative path.
	EnrollmentCustomizationImageFiles map[string]string
	// ExtractSpecs declaratively drives string-attribute extraction to support
	// files (scripts, profile payloads, app configs). Used by providers whose
	// resources expose these as nested object attributes (e.g. jamfplatform).
	// The jamfpro pipeline uses dedicated inline extraction instead.
	ExtractSpecs []ExtractSpec
	// SupportDirs lists extra directories (relative to support_files/) to create
	// as recommended locations for user-supplied files (e.g. token directories).
	SupportDirs []string
	// SkipReferences disables cross-resource reference resolution, leaving raw ID values.
	SkipReferences bool
	// SplitByCategory splits categorised resource types into per-category output files.
	SplitByCategory bool
	// ProviderSchemas is the parsed provider schema from tfexec (for null stripping).
	ProviderSchemas *tfjson.ProviderSchemas
	// SupportFilesPrefix, when set, is inserted into support file paths:
	// support_files/<prefix>/scripts/ instead of support_files/scripts/.
	// Used by multi-env mode to separate files per environment.
	SupportFilesPrefix string
	// InjectRequiredWriteOnly wires Required WriteOnly attributes the server never
	// returns to sensitive Terraform variables (and seeds their _wo_version
	// companions with 1) so a generated config validates. Used by jamfplatform.
	InjectRequiredWriteOnly bool
}

type ProviderSchema struct {
	// contains filtered or unexported fields
}

type ReferenceRule struct {
	// ResourceType is the TF resource type containing the reference (e.g. "jamfpro_policy")
	ResourceType string

	// BlockPath is the HCL block nesting path to the attribute.
	// e.g. ["payloads", "scripts"] means the "id" attr lives inside payloads { scripts { id = ... } }
	BlockPath []string

	// AttrPath is the nested object-attribute path to the container holding the
	// target attribute, e.g. ["scope", "targets"] for scope = { targets = { computer_group_ids = ... } }.
	// Walked after BlockPath. Empty for root-level attributes.
	AttrPath []string

	// AttrName is the attribute within the container that holds the raw ID(s)
	// (e.g. "id", "computer_group_ids"). When ElementAttr is set, AttrName names
	// the list-of-objects attribute and ElementAttr names the per-element field.
	AttrName string

	// TargetTypes are the TF resource types to look up in the registry.
	// Tried in order; first match wins.
	TargetTypes []string

	// TargetAttr is the attribute on the target resource to reference (e.g. "id")
	TargetAttr string

	// Numeric indicates the source attribute is number-typed (e.g. an Int64
	// profile_id) while the target attribute (TargetAttr) is a string. The
	// resolved reference is wrapped in tonumber() so the assignment type-checks.
	// Only honoured for single-attribute (non-list, non-element) rules.
	Numeric bool

	// EmbeddedIDs indicates AttrName is a free-form string that may contain one
	// or more target-type ids embedded in surrounding text (e.g. device-group
	// UUIDs inside a blueprint activation_conditions expression). Each resolvable
	// UUID is replaced in place with a ${addr.TargetAttr} interpolation; the rest
	// of the string and any unresolvable ids are left untouched.
	EmbeddedIDs bool

	// IsList indicates the attribute is a list of IDs rather than a single ID.
	IsList bool

	// ElementAttr, when set, indicates AttrName is a list-of-objects attribute
	// (e.g. scripts = [ { id = "44" }, ... ]) and ElementAttr (e.g. "id") is the
	// field rewritten on each element.
	ElementAttr string

	// DiscriminatorAttr, when set (with ElementAttr), names a sibling field on
	// each list element whose value selects the target type via DiscriminatorMap.
	// Used for polymorphic references where one ID field points at different
	// resource types depending on a type tag (e.g. macOS onboarding items whose
	// entity_id targets a policy, profile, or app per self_service_entity_type).
	DiscriminatorAttr string

	// DiscriminatorMap maps a DiscriminatorAttr value to the TF resource types to
	// resolve the element's ID against, tried in order. An unmapped value, or one
	// no listed type claims, leaves the ID untouched. More than one type is what
	// a wire field written in two forms needs: a user-group "member of" criterion
	// carries the target group's numeric ID on some Jamf Pro versions and its
	// name on others, so both the ID- and name-keyed registry types are listed.
	//
	// With PrefixedIDs the keys are literal value prefixes instead of sibling
	// field values, and the longest matching prefix wins.
	DiscriminatorMap map[string][]string

	// AllowUnresolved says a value no registry entry claims is expected here, so
	// it is left exactly as it was with no TODO marker. Use it where the field
	// legitimately accepts IDs from outside the export — a Jamf Security Cloud
	// gateway reference takes either the tenant's own gateway or one of Jamf's
	// shared gateways, and the shared ones are a Jamf-maintained catalogue with
	// no resource to point at. Marking those TODO sends the reader looking for a
	// broken reference that was never broken.
	AllowUnresolved bool

	// PrefixedIDs indicates the value is an ID carried behind a literal prefix
	// that also selects the target type, e.g. UEM Connect's uem_group_id, which
	// is written "computer_12" or "mobile_7" for a Jamf Pro device group.
	// DiscriminatorMap maps each prefix to the resource type its tail resolves
	// against; the prefix is preserved and the tail becomes a ${...} reference,
	// so "computer_12" becomes "computer_${jamfplatform_device_group.x.jamf_pro_id}".
	//
	// Used with ElementAttr (per list element) or on its own (a single
	// attribute). An unmatched prefix, or a tail that resolves to nothing,
	// leaves the value untouched: unlike a bare ID reference, a prefixed value
	// is still valid on its own and is not evidence of a broken export.
	PrefixedIDs bool
}

type RequiredVar struct {
	VarName  string // Terraform variable name (e.g. "smtp_server_password")
	AttrPath string // original attribute path (e.g. "basic_auth_credentials.0.password")
	Resource string // resource address (e.g. "jamfpro_smtp_server.settings")
	Filename string // source file (e.g. "smtp_server.tf")
	// VarType is the declared Terraform type. Empty means string, which is
	// what a write-only secret wants. A collection attribute has to declare
	// its own type or the config will not accept a list value.
	VarType string
	// NotSensitive suppresses `sensitive = true`. A list of approver email
	// addresses is a required value but not a secret, and marking it sensitive
	// only makes it harder to see what a plan is doing.
	NotSensitive bool
	// Cause names why the value has to be supplied here and becomes the
	// variable's description. Empty falls back to the write-only wording,
	// which is what an unreadable Required secret means. An attribute the
	// server returned empty is a different problem, and a description that
	// calls it a write-only secret sends the operator looking for a value the
	// API is hiding rather than one the tenant never set.
	Cause string
}

type TokenVar struct {
	VarName     string // e.g. "dep_token_path_my_enrollment"
	Description string // e.g. "Path to DEP token file (.p7m) for 'My Enrollment'"
}