temporal

type Access interface {
	// IssueClientCertificate signs a client certificate (CN = commonName, ttl
	// 1h–397d) from the cluster CA and records only its non-secret metadata.
	IssueClientCertificate(ctx context.Context, rc *engine.Context, commonName string, ttl time.Duration) (IssuedClientCertificate, error)
	ListClientCertificates(ctx context.Context, rc *engine.Context) ([]ClientCertificate, error)
	// ListNamespaces reads namespaces through a Ready frontend member.
	ListNamespaces(ctx context.Context, rc *engine.Context) ([]Namespace, error)
	// DeleteNamespace requests asynchronous deletion; "default" and namespaces
	// still declared in engineOptions.namespaces are refused (conflict).
	DeleteNamespace(ctx context.Context, rc *engine.Context, name string) error
	// SetUIOIDCClientSecret seals the write-only Web UI OIDC client secret.
	SetUIOIDCClientSecret(ctx context.Context, rc *engine.Context, secret string) error
}

type ClientCertificate struct {
	Serial            string    `json:"serial"`
	CommonName        string    `json:"commonName"`
	FingerprintSHA256 string    `json:"fingerprintSha256"`
	IssuedAt          time.Time `json:"issuedAt"`
	NotAfter          time.Time `json:"notAfter"`
	// CAFingerprintSHA256 identifies the issuing CA; certificates of a rotated CA are invalid.
	CAFingerprintSHA256 string `json:"caFingerprintSha256"`
	// CurrentCA is derived on read, never persisted. During rotate-tls, current
	// means the CA used to issue new client certificates now: the old CA during
	// trust staging, then the new CA once the signing CA switches, even while
	// both CAs remain trusted during the rolling transition.
	CurrentCA bool `json:"currentCa"`
}

type EngineOptions struct {
	Persistence struct {
		Postgres PostgresOptions `json:"postgres"`
	} `json:"persistence"`
	HistoryShards int `json:"historyShards"`
	Frontend      struct {
		RequireClientAuth bool `json:"requireClientAuth"`
	} `json:"frontend"`
	Namespaces []tspec.Namespace `json:"namespaces,omitempty"`
	UI         struct {
		PublicHTTPS bool         `json:"publicHttps"`
		OIDC        *OIDCOptions `json:"oidc,omitempty"`
	} `json:"ui"`
}

type IssuedClientCertificate struct {
	ClientCertificate
	CertificatePEM string `json:"certificatePem"`
	PrivateKeyPEM  string `json:"privateKeyPem"`
	CAPEM          string `json:"caPem"`
	// FrontendAddress and ServerName are what an SDK client needs to connect.
	FrontendAddress string `json:"frontendAddress"`
	ServerName      string `json:"serverName"`
}

type Namespace struct {
	Name        string `json:"name"`
	Retention   string `json:"retention"`
	Description string `json:"description,omitempty"`
	State       string `json:"state"`
	// Managed is true when engineOptions.namespaces declares it (or it is "default").
	Managed bool `json:"managed"`
}

type OIDCOptions struct {
	Issuer   string `json:"issuer"`
	ClientID string `json:"clientId"`
}

type Options struct {
	ControlPlaneURL, InternalCAPEM string
	Store                          *store.Store
	Logger                         *slog.Logger
	Bindings                       pgbinding.Service
}

type PostgresOptions struct {
	Cluster            string `json:"cluster"`
	Namespace          string `json:"namespace,omitempty"`
	Database           string `json:"database,omitempty"`
	VisibilityDatabase string `json:"visibilityDatabase,omitempty"`
}

type Provider struct {
	// contains filtered or unexported fields
}