webhook

type Deliverer struct {
	Subscriptions repository.WebhookSubscriptions
	Deliveries    repository.WebhookDeliveries
	Events        Events
	Outcomes      Outcomes
	// Encryptor opens the sealed signing secret. This is the only place a webhook secret is ever
	// in memory in clear, and it is in memory for the length of one HMAC.
	Encryptor crypto.Encryptor
	Signer    security.WebhookSigner
	// Client is the guarded one, always. A webhook target is an egress channel exactly as a backup
	// target is: a private range or the cloud metadata address is refused here unless the
	// installation has deliberately released private networks (rule 6, T-07).
	Client httpport.Port
	// UnitOfWork is this handler's own, because it is Detached: the call to somebody else's server
	// happens between two short transactions rather than inside one long one. Holding a database
	// connection for as long as a subscriber's server feels like taking is exactly what
	// observability-reliability.md §8 forbids.
	UnitOfWork persistence.UnitOfWork
	// Jobs is where the next attempt is asked for. A job per attempt rather than a repeating job,
	// so that each attempt has its own row and the log can answer "this event was tried eight
	// times over two days and these are the answers".
	Jobs  Queue
	Clock clock.Clock
	IDs   clock.IDGenerator
	// Source is what the CloudEvent names as its origin. The installation's own identifier, so a
	// subscriber receiving from two installations can tell them apart.
	Source string
	// NextAttempt is the backoff, given the attempts made so far. Injected for the runner's
	// reason: this layer decides when to retry, not how far apart.
	NextAttempt func(attempt int) time.Duration
	// Entitlements is what the workspace's plan leaves out (multi-tenancy.md §4.2). Nil includes
	// every feature.
	Entitlements adminrepo.Entitlements
	// Signals carries each settled attempt into the metrics. Nil skips; the composition root
	// always wires it.
	Signals Signals
}

type Events interface {
	FindEvent(ctx context.Context, id shared.ID) (event.Envelope, error)
}

type Outcomes interface {
	Delivered(ctx context.Context, subscriptionID shared.ID) error
	Failed(ctx context.Context, subscriptionID shared.ID, code string, terminal bool) error
}

type PlatformDeliverer struct {
	Subscriptions adminrepo.PlatformSubscriptions
	Deliveries    adminrepo.PlatformDeliveries
	Events        PlatformEvents
	// Encryptor opens the sealed secret for the length of one HMAC.
	Encryptor crypto.Encryptor
	Signer    security.WebhookSigner
	// Client is the guarded one (rule 6): a private range or the metadata address is refused
	// unless the installation released private networks.
	Client httpport.Port
	// UnitOfWork is this handler's own: the call to the platform happens between two short
	// transactions, never inside one.
	UnitOfWork  persistence.UnitOfWork
	Jobs        Queue
	Clock       clock.Clock
	Source      string
	NextAttempt func(attempt int) time.Duration
	Signals     PlatformSignals
}

type PlatformEvents interface {
	FindEvent(ctx context.Context, id shared.ID) (event.Envelope, error)
}

type PlatformSignals interface {
	PlatformDelivery(ctx context.Context, result, statusClass string)
}

type Queue interface {
	Enqueue(ctx context.Context, request queue.Request) (shared.ID, error)
}

type Signals interface {
	WebhookDelivery(ctx context.Context, result, statusClass string)
}