mcp

type CallLimiter interface {
	Allow(key string, now time.Time) bool
}

type Config struct {
	Instances  InstanceReader
	Databases  DatabaseReader
	Lineage    LineageReader
	Principals PrincipalReader
	Checker    PermissionChecker
	// CallLimiter bounds how often one principal may call a tool. Wiring it is what
	// keeps a token holder from turning the endpoint into a ledger and query pump;
	// a test that does not exercise the budget leaves it nil.
	CallLimiter CallLimiter
	// SourceCallLimiter bounds how often one source address may reach the endpoint
	// at all, counted before the bearer check. CallLimiter cannot see a request
	// that carries no or an invalid token — it is refused during identity
	// resolution, before the tool path — so without this an unauthenticated
	// caller can drive token verification, and a revocation lookup for every
	// token it invents, without limit. It is deliberately far looser than
	// CallLimiter so it bounds probing without pacing use: agents behind one
	// address share it, and a fleet of them is normal.
	SourceCallLimiter CallLimiter
	Stores            *store.Store
	// TrustedProxies decides whether a forwarded address may be believed in the
	// audit row.
	TrustedProxies []string
	// Endpoints resolves the deployment's MCP resource identifier per request and
	// says whether the surface is enabled.
	Endpoints oauth.EndpointsFunc
	// Now lets a test pin the clock the audit rows measure against.
	Now func() time.Time
}

type DatabaseReader interface {
	ListDatabases(context.Context, *connect.Request[v1pb.ListDatabasesRequest]) (*connect.Response[v1pb.ListDatabasesResponse], error)
	ListMetadata(context.Context, *connect.Request[v1pb.ListMetadataRequest]) (*connect.Response[v1pb.MetadataResponse], error)
	GetMetadata(context.Context, *connect.Request[v1pb.GetMetadataRequest]) (*connect.Response[v1pb.GetMetadataResponse], error)
	SearchMetadata(context.Context, *connect.Request[v1pb.SearchMetadataRequest]) (*connect.Response[v1pb.SearchMetadataResponse], error)
	GetSchemaString(context.Context, *connect.Request[v1pb.GetSchemaStringRequest]) (*connect.Response[v1pb.MetadataSchemaString], error)
}

type EndpointsFunc = oauth.EndpointsFunc

type InstanceReader interface {
	ListInstances(context.Context, *connect.Request[v1pb.ListInstancesRequest]) (*connect.Response[v1pb.ListInstancesResponse], error)
}

type LineageReader interface {
	AnalyzeSQL(context.Context, *connect.Request[v1pb.AnalyzeSQLRequest]) (*connect.Response[v1pb.AnalyzeSQLResponse], error)
	GetLineageGraph(context.Context, *connect.Request[v1pb.GetLineageGraphRequest]) (*connect.Response[v1pb.GetLineageGraphResponse], error)
}

type PermissionChecker interface {
	CheckPermission(ctx context.Context, perm permission.Permission, user *store.UserMessage) (bool, error)
}

type PrincipalReader interface {
	GetCurrentUser(context.Context, *connect.Request[emptypb.Empty]) (*connect.Response[v1pb.User], error)
}

type Server struct {
	// contains filtered or unexported fields
}