services

type AESEncryptionService struct {
	// contains filtered or unexported fields
}

type APITokenService interface {
	Create(ctx context.Context, name string, scopes []string, resourceIDs []string, expiresAt *time.Time) (*models.APIToken, string, *errors.ServiceError)
	GetByID(ctx context.Context, id string) (*models.APIToken, *errors.ServiceError)
	List(ctx context.Context) ([]*models.APIToken, *errors.ServiceError)
	Revoke(ctx context.Context, id string) *errors.ServiceError
	ValidateToken(ctx context.Context, rawToken string) (*models.APIToken, *errors.ServiceError)
}

type APITokenServiceSpec struct {
	SessionFactory db.SessionFactory
	Logger         logger.Logger
}

type AffectedStackRef struct {
	ID   string
	Name string
}

type BackgroundJobEnqueuerDep = clusterresource.BackgroundJobEnqueuerDep

type BackgroundJobEnqueuerInjectable = clusterresource.BackgroundJobEnqueuerInjectable

type ClusterClientGetter interface {
	GetClient(clusterID string) (client.Client, error)
}

type ClusterResourceServiceDeps = clusterresource.ClusterResourceServiceDeps

type ClusterResourceServiceInjectable = clusterresource.ClusterResourceServiceInjectable

type ClusterService interface {
	BackgroundJobEnqueuerInjectable
	GetClusterForOrg(ctx context.Context, orgID string) (*models.Cluster, *errors.ServiceError)
	GetOwnedClusterForOrg(ctx context.Context, orgID string) (*models.Cluster, *errors.ServiceError)
	Get(ctx context.Context, ID string) (*models.Cluster, *errors.ServiceError)
	InternalGet(ctx context.Context, ID string) (*models.Cluster, *errors.ServiceError)
	Delete(ctx context.Context, ID string) *errors.ServiceError
	AddCluster(ctx context.Context, cluster *models.Cluster) (*models.Cluster, *errors.ServiceError)
	InternalUpsertSharedComputeCluster(ctx context.Context, spec *models.Cluster) (*models.Cluster, *errors.ServiceError)
	InternalListAllClusters(ctx context.Context) ([]*models.Cluster, *errors.ServiceError)
	InjectClusterManager(clusterManager clustermanager.ClusterManager)
	InternalUpdateClusterInfo(ctx context.Context, clusterID string, info *models.ClusterInfo) *errors.ServiceError
	InternalEnsurePlatformWildcardTLS(ctx context.Context, cluster *models.Cluster, cfg *config.PlatformConfig) *errors.ServiceError
	DefaultStorageClass(ctx context.Context, clusterID string) (string, *errors.ServiceError)
}

type ClusterServiceSpec struct {
	SessionFactory       db.SessionFactory
	ClusterStore         stores.ClusterStore
	ClusterManager       clustermanager.ClusterManager
	ImageRegistryService ImageRegistryService
	ComputeMode          config.ComputeMode
	PlatformTLSEnabled   bool
	Permissions          auth.PermissionService
	EncryptionService    EncryptionService
	Logger               logger.Logger
}

type CredentialResolver = credentials.Resolver

type CredentialResolverSpec struct {
	// RegistryCredentialService is optional; when unset, registry resolution
	// falls through to anonymous.
	RegistryCredentialService registryCredentialResolverSource
	// GitIntegrationService is optional; when unset, git resolution falls
	// through to anonymous.
	GitIntegrationService gitIntegrationResolverSource
}

type CredentialSource = credentials.Source

type DefaultingService[T any] interface {
	PopulateDefaultValues(resource T) (T, error)
}

type EncryptionService interface {
	EncryptData(in []byte) (string, error)
	DecryptData(in string) ([]byte, error)
}

type EncryptionServiceSpec struct {
	Masterkey string // Master key for encryption/decryption
}

type GitHubWebhookService interface {
	// ProcessGitHubWebhook resolves the integration a delivery belongs to,
	// HMAC-verifies the payload against that integration's webhook secret,
	// and dispatches installation and pull_request events.
	ProcessGitHubWebhook(ctx context.Context, event string, payload []byte, signature string) *errors.ServiceError
}

type GitHubWebhookServiceSpec struct {
	Store             stores.GitIntegrationStore
	InstallationStore stores.GitInstallationStore
	EncryptionService EncryptionService
	PreviewWebhook    PreviewWebhookService
	Logger            logger.Logger
	// PlatformApp mirrors GitIntegrationServiceSpec.PlatformApp; nil means
	// per-org apps.
	PlatformApp *githubapp.AppCredentials
}

type GitIntegrationService interface {
	Create(ctx context.Context, integration *models.GitIntegration) (*models.GitIntegration, *errors.ServiceError)
	GetByID(ctx context.Context, ID string) (*models.GitIntegration, *errors.ServiceError)
	ListByOrgID(ctx context.Context, organisationID string) ([]*models.GitIntegration, *errors.ServiceError)
	Update(ctx context.Context, ID string, integration *models.GitIntegration) (*models.GitIntegration, *errors.ServiceError)
	Delete(ctx context.Context, ID string) *errors.ServiceError
	Verify(ctx context.Context, ID, repoURL string) *errors.ServiceError

	// InternalGetForHost returns the decrypted git_credentials integration for
	// (org, host). No permission checks; used by the credential resolver.
	InternalGetForHost(ctx context.Context, organisationID, host string) (*models.GitIntegration, *errors.ServiceError)
	// InternalGetByID returns the decrypted integration by ID. No permission
	// checks; used by the credential resolver for explicit overrides.
	InternalGetByID(ctx context.Context, ID string) (*models.GitIntegration, *errors.ServiceError)

	// GitHub App manifest flow, installations, and discovery.
	CreateGitHubAppManifest(ctx context.Context, organisationID string) (*models.GitHubAppManifestFlow, *errors.ServiceError)
	HandleGitHubManifestCallback(ctx context.Context, code, state string) (string, *errors.ServiceError)
	HandleGitHubAppSetup(ctx context.Context, installationID int64, state string) (string, *errors.ServiceError)
	ListInstallations(ctx context.Context, integrationID string, refresh bool) ([]*models.GitInstallation, *errors.ServiceError)
	ListRepositories(ctx context.Context, integrationID string, page int, installationUUID string) (*githubapp.RepoPage, *errors.ServiceError)
	GetRepository(ctx context.Context, integrationID, owner, repo string) (*githubapp.Repo, *errors.ServiceError)
	ListRepositoryBranches(ctx context.Context, integrationID, owner, repo string) ([]string, *errors.ServiceError)

	// InternalMintForRepo mints an installation token for the org's installed
	// GitHub App when it covers the repository owner (404 to fall through).
	InternalMintForRepo(ctx context.Context, organisationID, repoURL string) (*models.GitHubAppMintResult, *errors.ServiceError)
	// InternalMintCloneToken re-mints a token for a known integration; used
	// by the hub-side token refresher.
	InternalMintCloneToken(ctx context.Context, integrationID, repoURL string) (*models.GitHubAppMintResult, *errors.ServiceError)
}

type GitIntegrationServiceSpec struct {
	Store             stores.GitIntegrationStore
	InstallationStore stores.GitInstallationStore
	OAuthStateStore   stores.OAuthStateStore
	OrganisationStore stores.OrganisationStore
	AtomicExecutor    stores.AtomicExecutor
	GitHubAppClient   githubapp.Client
	EncryptionService EncryptionService
	Permissions       auth.PermissionService
	Logger            logger.Logger
	// ExternalURL is the hub's externally reachable base URL, required for
	// the GitHub App manifest flow.
	ExternalURL string
	// PlatformApp is the platform-wide GitHub App every org installs. Nil
	// keeps each org creating its own app through the manifest flow.
	PlatformApp *githubapp.AppCredentials
	// GitClients is optional; it defaults to real git clients.
	GitClients verifyGitClientProvider
}

type ImageBuildService interface {
	InternalCreate(ctx context.Context, resourceBuild *models.ImageBuild) (*models.ImageBuild, *errors.ServiceError)
	InternalUpdateStatus(ctx context.Context, BuildID string, status *models.ImageBuildStatus) *errors.ServiceError
	ListByResourceName(ctx context.Context, stackID string, resourceName string) ([]*models.ImageBuild, *errors.ServiceError)
	ListByStackID(ctx context.Context, stackID string) ([]*models.ImageBuild, *errors.ServiceError)
	GetByID(ctx context.Context, ID string) (*models.ImageBuild, *errors.ServiceError)
	InternalGetByID(ctx context.Context, ID string) (*models.ImageBuild, *errors.ServiceError)
}

type ImageBuildServiceSpec struct {
	SessionFactory       db.SessionFactory
	StackResourceService StackResourceService
	Logger               logger.Logger
	Permissions          auth.PermissionService
	StackStore           stores.StackStore
}

type ImageRegistryService interface {
	BackgroundJobEnqueuerInjectable
	Get(ctx context.Context, ID string) (*models.ClusterImageRegistry, *errors.ServiceError)
	InternalGet(ctx context.Context, ID string) (*models.ClusterImageRegistry, *errors.ServiceError)
	InternalMarkAllDeletingByClusterIDWithTx(ctx context.Context, clusterID string) *errors.ServiceError
	ListForOrg(ctx context.Context, orgID string) ([]*models.ClusterImageRegistry, *errors.ServiceError)
	ListByClusterID(ctx context.Context, orgID, clusterID string) ([]*models.ClusterImageRegistry, *errors.ServiceError)
	Create(ctx context.Context, spec *models.ClusterImageRegistry) (*models.ClusterImageRegistry, *errors.ServiceError)
	InternalCreateSeedRegistry(ctx context.Context, spec *models.ClusterImageRegistry) (*models.ClusterImageRegistry, *errors.ServiceError)
	CreateWithTx(ctx context.Context, spec *models.ClusterImageRegistry) (*models.ClusterImageRegistry, *errors.ServiceError)
	DeleteWithTx(ctx context.Context, orgID string, registry *models.ClusterImageRegistry) *errors.ServiceError
	UpdateStatus(ctx context.Context, ID string, status *models.ClusterImageRegistryStatus) *errors.ServiceError
	PopulateInClusterRegistryNameForResource(ctx context.Context, orgID, clusterID, stackName string, resource *models.StackResource) *errors.ServiceError
	Delete(ctx context.Context, orgID, ID string) *errors.ServiceError
}

type ImageRegistryServiceSpec struct {
	SessionFactory db.SessionFactory
	Permissions    auth.PermissionService
	Logger         logger.Logger
}

type LoggingParams struct {
	// contains filtered or unexported fields
}

type LoggingService interface {
	StreamLogsForStackResource(ctx context.Context, orgID string, stackID string, stackResourceName string, options *LoggingParams) (interfaces.ServerSideStreamable, *errors.ServiceError)
	StreamLogsForStack(ctx context.Context, orgID string, stackID string, options *LoggingParams) (interfaces.ServerSideStreamable, *errors.ServiceError)
	StreamLogsForBuild(ctx context.Context, orgID string, buildID string, options *LoggingParams) (interfaces.ServerSideStreamable, *errors.ServiceError)
	ClusterResourceServiceInjectable
}

type LoggingServiceSpec struct {
	ClusterService       ClusterService
	StackResourceService StackResourceService
	ImageBuildService    ImageBuildService
	Logger               logger.Logger
}

type MetricsService interface {
	GetMetricsForStackResource(ctx context.Context, orgID string, stackID string, stackResourceName string) (*models.ResourceMetrics, error)
	GetMetricsForStack(ctx context.Context, orgID string, stackID string) (*models.ResourceMetrics, error)
	StreamMetricsForStackResource(ctx context.Context, orgID string, stackID string, stackResourceName string) (interfaces.ServerSideStreamable, error)
	StreamMetricsForStack(ctx context.Context, orgID string, stackID string) (interfaces.ServerSideStreamable, error)
	ClusterResourceServiceInjectable
}

type MetricsServiceSpec struct {
	ClusterService       ClusterService
	StackResourceService StackResourceService
	StackService         StackService
	Logger               logger.Logger
}

type MockClusterLoggingService struct {
	// contains filtered or unexported fields
}

type MockClusterLoggingServiceMockRecorder struct {
	// contains filtered or unexported fields
}

type MockImageBuildService struct {
	// contains filtered or unexported fields
}

type MockImageBuildServiceMockRecorder struct {
	// contains filtered or unexported fields
}

type MockPreviewCommentService struct {
	// contains filtered or unexported fields
}

type MockPreviewCommentServiceMockRecorder struct {
	// contains filtered or unexported fields
}

type MockPreviewStackService struct {
	// contains filtered or unexported fields
}

type MockPreviewStackServiceMockRecorder struct {
	// contains filtered or unexported fields
}

type MockPreviewWebhookService struct {
	// contains filtered or unexported fields
}

type MockPreviewWebhookServiceMockRecorder struct {
	// contains filtered or unexported fields
}

type MockReleaseEventRecorder struct {
	// contains filtered or unexported fields
}

type MockReleaseEventRecorderMockRecorder struct {
	// contains filtered or unexported fields
}

type MockStackService struct {
	// contains filtered or unexported fields
}

type MockStackServiceMockRecorder struct {
	// contains filtered or unexported fields
}

type NamespaceService interface {
	CreateInDB(ctx context.Context, ns *models.Namespace) (*models.Namespace, *errors.ServiceError)
	CreateInCluster(ctx context.Context, ns *models.Namespace) *errors.ServiceError
	CreateInDBWithTx(ctx context.Context, ns *models.Namespace) (*models.Namespace, *errors.ServiceError)
	Get(ctx context.Context, id string) (*models.Namespace, *errors.ServiceError)
	DeleteFromDB(ctx context.Context, id string) *errors.ServiceError
	InternalDeleteFromDB(ctx context.Context, id string) *errors.ServiceError
	DeleteFromDBWithTx(ctx context.Context, id string) *errors.ServiceError
	UpdateInDB(ctx context.Context, id string, ns *models.Namespace) (*models.Namespace, *errors.ServiceError)
	ListByOrganisation(ctx context.Context, organisationID string) ([]*models.Namespace, *errors.ServiceError)
	ListByStack(ctx context.Context, stackID string) ([]*models.Namespace, *errors.ServiceError)
	PrepareNamespaceForStack(ctx context.Context, stack *models.Stack) (*models.Namespace, *errors.ServiceError)
	PrepareNamespaceForAddon(ctx context.Context, addon models.Addon, orgID string) (*models.Namespace, *errors.ServiceError)
	ClusterResourceServiceInjectable
}

type NamespaceServiceSpec struct {
	SessionFactory db.SessionFactory
	Logger         logger.Logger
	SharedCompute  bool
}

type ObjectStoreService interface {
	Create(ctx context.Context, objectStore *models.ObjectStore) (*models.ObjectStore, *errors.ServiceError)
	GetByID(ctx context.Context, ID string) (*models.ObjectStore, *errors.ServiceError)
	InternalGetByID(ctx context.Context, ID string) (*models.ObjectStore, *errors.ServiceError)
	GetByName(ctx context.Context, organisationID, name string) (*models.ObjectStore, *errors.ServiceError)
	Update(ctx context.Context, id string, objectStore *models.ObjectStore) (*models.ObjectStore, *errors.ServiceError)
	Delete(ctx context.Context, ID string) *errors.ServiceError
	ListByOrganisation(ctx context.Context, organisationID string) ([]*models.ObjectStore, *errors.ServiceError)
	ListByProjectID(ctx context.Context, projectID string) ([]*models.ObjectStore, *errors.ServiceError)
	ListObjectStoresForCurrentUser(ctx context.Context, orgID string) ([]*models.ObjectStore, *errors.ServiceError)
	ValidateObjectStoreExists(ctx context.Context, objectStoreID string) (bool, *errors.ServiceError)
	TestConnection(ctx context.Context, objectStoreID string) *errors.ServiceError
	UpdateStatus(ctx context.Context, id string, status models.ObjectStoreStatus) *errors.ServiceError
}

type ObjectStoreServiceSpec struct {
	SessionFactory db.SessionFactory
	SecretService  SecretService
	ProjectService ProjectService
	ClusterManager clustermanager.ClusterManager
	Permissions    auth.PermissionService
	Logger         logger.Logger
}

type OrgInviteService interface {
	BackgroundJobEnqueuerInjectable
	Create(ctx context.Context, email, projectName string, role models.ProjectRole, expiresInDays int) (*models.OrgInvite, string, *errors.ServiceError)
	List(ctx context.Context, orgID string, params stores.ListParams) (*stores.PaginatedResult[*models.OrgInvite], *errors.ServiceError)
	GetByID(ctx context.Context, orgID, id string) (*models.OrgInvite, *errors.ServiceError)
	Revoke(ctx context.Context, orgID, id string) *errors.ServiceError
	Resend(ctx context.Context, orgID, id string) *errors.ServiceError
	PublicGetInviteInfo(ctx context.Context, rawToken string) (*models.OrgInvite, *errors.ServiceError)
	ValidateAndConsume(ctx context.Context, rawToken, email string) (*models.OrgInvite, *errors.ServiceError)
	InternalGetByID(ctx context.Context, id string) (*models.OrgInvite, *errors.ServiceError)
	InternalGetPendingUnsent(ctx context.Context, params stores.ListParams) (*stores.PaginatedResult[*models.OrgInvite], *errors.ServiceError)
	InternalMarkEmailSent(ctx context.Context, id string) *errors.ServiceError
	InternalMarkEmailError(ctx context.Context, id string, errMsg string) *errors.ServiceError
	InternalDecryptToken(ctx context.Context, encryptedToken string) (string, *errors.ServiceError)
	InternalListExpiredOrPastDue(ctx context.Context, now time.Time, params stores.ListParams) (*stores.PaginatedResult[*models.OrgInvite], *errors.ServiceError)
	InternalMarkExpiredAndDelete(ctx context.Context, invites []*models.OrgInvite) *errors.ServiceError
	InternalWithTransaction(ctx context.Context, fn func(ctx context.Context) *errors.ServiceError) *errors.ServiceError
}

type OrgInviteServiceSpec struct {
	InviteStore       stores.OrgInviteStore
	ProjectService    ProjectService
	UserService       UserService
	EncryptionService EncryptionService
	Permissions       auth.PermissionService
	Logger            logger.Logger
}

type OrganisationDomainsService interface {
	Create(ctx context.Context, spec *models.OrganisationDomain) (*models.OrganisationDomain, *errors.ServiceError)
	InternalCreateWithTx(ctx context.Context, spec *models.OrganisationDomain) (*models.OrganisationDomain, *errors.ServiceError)
	Get(ctx context.Context, id string) (*models.OrganisationDomain, *errors.ServiceError)
	Delete(ctx context.Context, id string) *errors.ServiceError
	InternalDeleteWithTx(ctx context.Context, id string) *errors.ServiceError
	Update(ctx context.Context, id string, spec *models.OrganisationDomain) (*models.OrganisationDomain, *errors.ServiceError)
	ListByOrganisationID(ctx context.Context, organisationID string) ([]*models.OrganisationDomain, *errors.ServiceError)
	// TODO
	GetDefaultDomainForOrganisation(ctx context.Context, organisationID string) (*models.OrganisationDomain, *errors.ServiceError)
}

type OrganisationDomainsServiceSpec struct {
	SessionFactory        db.SessionFactory
	Logger                logger.Logger
	CustomDomainsDisabled bool
}

type OrganisationService interface {
	InternalCreate(ctx context.Context, spec *models.Organisation) (*models.Organisation, *errors.ServiceError)
	InternalGetPlatformOrg(ctx context.Context) (*models.Organisation, *errors.ServiceError)
	Get(ctx context.Context, ID string) (*models.Organisation, *errors.ServiceError)
	Delete(ctx context.Context, ID string) *errors.ServiceError
	Update(ctx context.Context, ID string, spec *models.Organisation) (*models.Organisation, *errors.ServiceError)

	PromoteToOrgAdmin(ctx context.Context, orgID, userID string) *errors.ServiceError
	DemoteOrgAdmin(ctx context.Context, orgID, userID, projectID string, role models.ProjectRole) *errors.ServiceError
	ListOrgAdmins(ctx context.Context, orgID string) ([]*models.User, *errors.ServiceError)
}

type OrganisationServiceSpec struct {
	SessionFactory            db.SessionFactory
	OrganisationDomainService OrganisationDomainsService
	ImageRegistryService      ImageRegistryService
	OrgRegistryDefaults       models.OrgRegistryDefaults
	StackQueryService         StackQueryService
	ProjectService            ProjectService
	PolicyManager             resourceaccess.ResourceAccessPolicyManager
	Permissions               auth.PermissionService
	Logger                    logger.Logger
	CustomDomainsDisabled     bool
}

type PostgresAddonDatabaseService interface {
	Create(ctx context.Context, database *models.PostgresAddonDatabase) (*models.PostgresAddonDatabase, *errors.ServiceError)
	CreateWithTx(ctx context.Context, database *models.PostgresAddonDatabase) (*models.PostgresAddonDatabase, *errors.ServiceError)
	GetByID(ctx context.Context, ID string) (*models.PostgresAddonDatabase, *errors.ServiceError)
	GetByName(ctx context.Context, postgresAddonID, name string) (*models.PostgresAddonDatabase, *errors.ServiceError)
	Update(ctx context.Context, id string, database *models.PostgresAddonDatabase) (*models.PostgresAddonDatabase, *errors.ServiceError)
	UpdateWithTx(ctx context.Context, id string, database *models.PostgresAddonDatabase) (*models.PostgresAddonDatabase, *errors.ServiceError)
	Delete(ctx context.Context, ID string) *errors.ServiceError
	DeleteWithTx(ctx context.Context, ID string) *errors.ServiceError
	ListByPostgresAddon(ctx context.Context, postgresAddonID string) ([]*models.PostgresAddonDatabase, *errors.ServiceError)
	ValidateDatabaseExists(ctx context.Context, databaseID string) (bool, *errors.ServiceError)
}

type PostgresAddonDatabaseServiceSpec struct {
	SessionFactory db.SessionFactory
	Logger         logger.Logger
}

type PostgresAddonService interface {
	CreatePostgresAddon(ctx context.Context, postgresAddon *models.PostgresAddon) (*models.PostgresAddon, *errors.ServiceError)
	GetPostgresAddon(ctx context.Context, id string) (*models.PostgresAddon, *errors.ServiceError)
	GetPostgresAddonByName(ctx context.Context, organisationID, name string) (*models.PostgresAddon, *errors.ServiceError)
	UpdatePostgresAddon(ctx context.Context, id string, postgresAddon *models.PostgresAddon) (*models.PostgresAddon, *errors.ServiceError)
	DeletePostgresAddon(ctx context.Context, id string) (*models.PostgresAddon, *errors.ServiceError)
	ListPostgresAddonsByOrganisation(ctx context.Context, organisationID string) ([]*models.PostgresAddon, *errors.ServiceError)
	ListPostgresAddonsForCurrentUser(ctx context.Context, orgID string) ([]*models.PostgresAddon, *errors.ServiceError)
	ListPostgresAddonsByProjectID(ctx context.Context, projectID string) ([]*models.PostgresAddon, *errors.ServiceError)
	UpdatePostgresAddonStatus(ctx context.Context, id string, status *models.PostgresAddonStatus) *errors.ServiceError

	// Lifecycle operations
	TriggerBackup(ctx context.Context, id string) *errors.ServiceError
	TriggerHibernate(ctx context.Context, id string, enabled bool) *errors.ServiceError
	TriggerFence(ctx context.Context, id string, enabled bool) *errors.ServiceError

	// Backup operations
	ListBackups(ctx context.Context, postgresAddonID string) ([]*models.PostgresBackup, *errors.ServiceError)

	// Credentials
	GetCredentials(ctx context.Context, addonID string, database string, superuser bool) (*models.PostgresCredentials, *errors.ServiceError)

	// Internal operations
	InternalGetPostgresAddon(ctx context.Context, id string) (*models.PostgresAddon, *errors.ServiceError)
	InternalGetCredentials(ctx context.Context, addonID string, database string, superuser bool) (*models.PostgresCredentials, *errors.ServiceError)
	InternalDeleteFromDB(ctx context.Context, id string) *errors.ServiceError
	InternalList(ctx context.Context, query string, args ...any) ([]*models.PostgresAddon, *errors.ServiceError)

	InjectClusterManager(clusterManager clustermanager.ClusterManager)

	BackgroundJobEnqueuerInjectable
	ClusterResourceServiceInjectable
}

type PostgresAddonServiceSpec struct {
	SessionFactory         db.SessionFactory
	ReferenceService       ReferenceService
	ObjectStoreService     ObjectStoreService
	ClusterService         ClusterService
	NamespaceService       NamespaceService
	SecretService          SecretService
	PostgresBackupService  PostgresBackupService
	ClusterManager         clustermanager.ClusterManager
	ProjectService         ProjectService
	Logger                 logger.Logger
	Permissions            auth.PermissionService
	ExternalImportDisabled bool
	ComputePolicy          computequota.Policy
}

type PostgresBackupService interface {
	Create(ctx context.Context, backup *models.PostgresBackup) (*models.PostgresBackup, *errors.ServiceError)
	GetByID(ctx context.Context, ID string) (*models.PostgresBackup, *errors.ServiceError)
	GetByName(ctx context.Context, postgresAddonID string, name string) (*models.PostgresBackup, *errors.ServiceError)
	Update(ctx context.Context, id string, backup *models.PostgresBackup) (*models.PostgresBackup, *errors.ServiceError)
	Delete(ctx context.Context, ID string) *errors.ServiceError
	ListByPostgresAddon(ctx context.Context, postgresAddonID string) ([]*models.PostgresBackup, *errors.ServiceError)
	ValidateBackupExists(ctx context.Context, backupID string) (bool, *errors.ServiceError)

	// Status update methods for backup lifecycle
	UpdateBackupStatus(ctx context.Context, backupID, phase string, error *string) *errors.ServiceError
	MarkBackupCompleted(ctx context.Context, backupID string, sizeBytes *int32) *errors.ServiceError
	MarkBackupFailed(ctx context.Context, backupID string, errorMessage string) *errors.ServiceError
}

type PostgresBackupServiceSpec struct {
	SessionFactory db.SessionFactory
	Logger         logger.Logger
}

type PreviewCommentService interface {
	// InternalUpsertComment renders the comment for the preview's current
	// state and creates or edits the sticky PR comment. On create it sets
	// preview.GitHubCommentID in place; the caller owns persisting it.
	InternalUpsertComment(ctx context.Context, preview *models.PreviewStack) error
}

type PreviewCommentServiceSpec struct {
	ConfigStore     stores.StackPreviewConfigStore
	GitIntegrations GitIntegrationService
	Commenter       githubapp.PullRequestCommenter
	Logger          logger.Logger
}

type PreviewStackService interface {
	BackgroundJobEnqueuerInjectable
	Create(ctx context.Context, preview *models.PreviewStack) (*models.PreviewStack, *errors.ServiceError)
	Sync(ctx context.Context, previewStackID string, opts PreviewSyncOpts) *errors.ServiceError
	Delete(ctx context.Context, previewStackID string) *errors.ServiceError
	Get(ctx context.Context, previewStackID string) (*models.PreviewStack, *errors.ServiceError)
	List(ctx context.Context, projectID string, params stores.ListParams) (*stores.PaginatedResult[*models.PreviewStack], *errors.ServiceError)
	InternalFetchStackfile(ctx context.Context, config *models.StackPreviewConfig, commitSHA string) (content []byte, hash string, opErr *errors.OperationError)
	InternalBuildStackFromContent(ctx context.Context, config *models.StackPreviewConfig, preview *models.PreviewStack, stackFileBytes []byte) (*models.Stack, *errors.OperationError)
	// InternalCreateFromWebhook provisions a preview stack from a GitHub PR
	// webhook event. No permission check: the webhook has already been
	// authenticated and authorized by config resolution (org+repo match).
	InternalCreateFromWebhook(ctx context.Context, config *models.StackPreviewConfig, prNumber, branch, headSHA string) (*models.PreviewStack, *errors.ServiceError)
	// InternalSyncFromWebhook re-syncs an existing preview stack to a new head
	// commit from a GitHub PR webhook event. No permission check.
	InternalSyncFromWebhook(ctx context.Context, previewStackID, headSHA string) *errors.ServiceError
	// InternalDeleteFromWebhook tears down a preview stack from a GitHub PR
	// webhook event (PR closed/merged). No permission check.
	InternalDeleteFromWebhook(ctx context.Context, previewStackID string) *errors.ServiceError
}

type PreviewStackServiceSpec struct {
	Store              stores.PreviewStackStore
	ConfigStore        stores.StackPreviewConfigStore
	StackService       StackService
	ReleaseService     StackReleaseService
	SecretService      SecretService
	CredentialResolver CredentialResolver
	Permissions        auth.PermissionService
	Logger             logger.Logger
}

type PreviewSyncOpts struct {
	Commit           string
	StackfileContent *string
	ForceSync        bool
	ImageOverrides   map[string]string
}

type PreviewWebhookService interface {
	HandlePullRequest(ctx context.Context, ev PullRequestEvent) *errors.ServiceError
}

type PreviewWebhookServiceSpec struct {
	ConfigStore       stores.StackPreviewConfigStore
	PreviewStackStore stores.PreviewStackStore
	PreviewService    PreviewStackService
	Logger            logger.Logger
}

type ProjectService interface {
	CreateProject(ctx context.Context, orgID string, project *models.Project) (*models.Project, *errors.ServiceError)
	GetProject(ctx context.Context, orgID, projectID string) (*models.Project, *errors.ServiceError)
	GetProjectByOrgAndName(ctx context.Context, orgID, name string) (*models.Project, *errors.ServiceError)
	ListProjects(ctx context.Context, orgID string) ([]*models.Project, *errors.ServiceError)
	UpdateProject(ctx context.Context, id string, project *models.Project) (*models.Project, *errors.ServiceError)
	DeleteProject(ctx context.Context, id string) *errors.ServiceError
	InternalCreateDefaultProject(ctx context.Context, orgID string) (*models.Project, *errors.ServiceError)
	InternalGetProjectByOrgAndName(ctx context.Context, orgID, name string) (*models.Project, *errors.ServiceError)
	InternalAddMember(ctx context.Context, projectID, userID string, role models.ProjectRole) (*models.ProjectMembership, *errors.ServiceError)

	AddMember(ctx context.Context, projectID, userID string, role models.ProjectRole) (*models.ProjectMembership, *errors.ServiceError)
	RemoveMember(ctx context.Context, membershipID string) *errors.ServiceError
	UpdateMemberRole(ctx context.Context, membershipID string, role models.ProjectRole) (*models.ProjectMembership, *errors.ServiceError)
	ListMembers(ctx context.Context, projectID string) ([]*models.ProjectMembership, *errors.ServiceError)
	ListUserProjects(ctx context.Context, userID string) ([]*models.ProjectMembership, *errors.ServiceError)
	InternalListUserProjects(ctx context.Context, userID, orgID string) ([]*models.ProjectMembership, *errors.ServiceError)
}

type ProjectServiceSpec struct {
	SessionFactory db.SessionFactory
	PolicyManager  resourceaccess.ResourceAccessPolicyManager
	Permissions    auth.PermissionService
	Logger         logger.Logger
}

type PullRequestAction string

type PullRequestEvent struct {
	OrganisationID string
	RepoURL        string
	Branch         string // PR head ref
	BaseBranch     string // PR base ref
	HeadSHA        string
	PRNumber       string
	Action         PullRequestAction
}

type ReferenceService interface {
	ReprojectSpec(ctx context.Context, stackID string) *errors.ServiceError
	ProjectRelease(ctx context.Context, release *models.StackRelease) *errors.ServiceError
	IsReferentInUse(ctx context.Context, referentType models.ReferentType, referentID string) (
		bool,
		[]models.ResourceReference,
		*errors.ServiceError,
	)
}

type ReferenceServiceSpec struct {
	SessionFactory db.SessionFactory
	StackStore     stores.StackStore
}

type RegistryCredentialDeleteResult struct {
	AffectedStacks []AffectedStackRef
}

type RegistryCredentialService interface {
	Create(ctx context.Context, credential *models.RegistryCredential) (*models.RegistryCredential, *errors.ServiceError)
	GetByID(ctx context.Context, ID string) (*models.RegistryCredential, *errors.ServiceError)
	ListByOrgID(ctx context.Context, organisationID string) ([]*models.RegistryCredential, *errors.ServiceError)
	Update(ctx context.Context, ID string, credential *models.RegistryCredential) (*models.RegistryCredential, *errors.ServiceError)
	Delete(ctx context.Context, ID string) (*RegistryCredentialDeleteResult, *errors.ServiceError)
	Verify(ctx context.Context, ID, repository string, purpose models.RegistryCredentialPurpose) *errors.ServiceError

	// InternalGetForHost returns the decrypted credential covering the given
	// purpose for (org, normalized host). No permission checks; used by the
	// credential resolver.
	InternalGetForHost(ctx context.Context, organisationID, host string, purpose models.RegistryCredentialPurpose) (*models.RegistryCredential, *errors.ServiceError)
	// InternalGetByID returns the decrypted credential by ID. No permission
	// checks; used by the credential resolver for explicit overrides.
	InternalGetByID(ctx context.Context, ID string) (*models.RegistryCredential, *errors.ServiceError)
}

type RegistryCredentialServiceSpec struct {
	Store             stores.RegistryCredentialStore
	StackStore        stores.StackStore
	ReferenceService  ReferenceService
	EncryptionService EncryptionService
	Permissions       auth.PermissionService
	Logger            logger.Logger
	// RegistryClients is optional; it defaults to real registry clients.
	RegistryClients verifyRegistryClientProvider
}

type RegistryPurpose = credentials.RegistryPurpose

type ReleaseEventInput struct {
	Release      *models.StackRelease
	ResourceName string // required for resource-scoped types
	Type         models.ReleaseEventType
	Message      string
	DedupeKey    string // defaulted from type/resource when empty
	Links        models.ReleaseEventLinks
	Metadata     models.ReleaseEventMetadata
}

type ReleaseEventPage struct {
	Events            []*models.ReleaseEvent
	NextAfterSequence int
}

type ReleaseEventRecorder interface {
	Record(ctx context.Context, input ReleaseEventInput) (*models.ReleaseEvent, *errors.ServiceError)
	RecordReleaseCreated(ctx context.Context, release *models.StackRelease) *errors.ServiceError
	RecordReleaseChecksStarted(ctx context.Context, release *models.StackRelease) *errors.ServiceError
	RecordReleaseCheckFailed(ctx context.Context, release *models.StackRelease, resourceName, check, reason string) *errors.ServiceError
	RecordReleaseChecksPassed(ctx context.Context, release *models.StackRelease) *errors.ServiceError
	RecordReleaseStarted(ctx context.Context, release *models.StackRelease) *errors.ServiceError
	RecordBuildEvent(ctx context.Context, release *models.StackRelease, resourceName string, eventType models.ReleaseEventType, buildID string, failure *models.BuildFailureDetail) *errors.ServiceError
	RecordResourceEvent(ctx context.Context, release *models.StackRelease, resourceName string, eventType models.ReleaseEventType, reason string, message string) *errors.ServiceError
	RecordReleaseTerminal(ctx context.Context, release *models.StackRelease, state models.StackReleaseState, message string) *errors.ServiceError
}

type ReleaseEventRecorderSpec struct {
	Store stores.ReleaseEventStore
}

type ResolvedGitCredential = credentials.ResolvedGitCredential

type ResolvedRegistryCredential = credentials.ResolvedRegistryCredential

type SecretService interface {
	Create(ctx context.Context, secret *models.Secret) (*models.Secret, *errors.ServiceError)
	GetByID(ctx context.Context, ID string) (*models.Secret, *errors.ServiceError)
	// InternalGetByID is used internally to get the secret with decrypted data.
	InternalGetByID(ctx context.Context, ID string) (*models.Secret, *errors.ServiceError)
	InternalGetByName(ctx context.Context, organisationID, name string) (*models.Secret, *errors.ServiceError)
	GetByName(ctx context.Context, organisationID, name string) (*models.Secret, *errors.ServiceError)
	Update(ctx context.Context, id string, secret *models.Secret) (*models.Secret, *errors.ServiceError)
	Delete(ctx context.Context, ID string) *errors.ServiceError
	ListByOrganisation(ctx context.Context, organisationID string, params stores.ListParams) ([]*models.Secret, *errors.ServiceError)
	ListByProjectID(ctx context.Context, projectID string, params stores.ListParams) ([]*models.Secret, *errors.ServiceError)
	ListSecretsForCurrentUser(ctx context.Context, orgID string, params stores.ListParams) ([]*models.Secret, *errors.ServiceError)
	ListByUser(ctx context.Context, organisationID, userID string) ([]*models.Secret, *errors.ServiceError)
	ListByType(ctx context.Context, organisationID, secretType models.SecretType) ([]*models.Secret, *errors.ServiceError)
	ValidateSecretExists(ctx context.Context, secretID string) (bool, *errors.ServiceError)
	GetSecretKeys(ctx context.Context, secretID string) ([]string, *errors.ServiceError)
	ValidateSecretHasKeys(ctx context.Context, secretID string, requiredKeys []string) (bool, []string, *errors.ServiceError)
}

type SecretServiceSpec struct {
	SessionFactory      db.SessionFactory
	EncryptionService   EncryptionService
	ReferenceService    ReferenceService
	ClusterClientGetter ClusterClientGetter
	ProjectService      ProjectService
	Logger              logger.Logger
	Permissions         auth.PermissionService
}

type SignupService interface {
	Signup(ctx context.Context, user *models.User, inviteToken string) (*openapi.UserSignupResponse, *errors.ServiceError)
}

type SignupServiceSpec struct {
	UserService         UserService
	OrgInviteService    OrgInviteService
	OrganisationService OrganisationService
	ProjectService      ProjectService
	PolicyManager       resourceaccess.ResourceAccessPolicyManager
	RefreshTokenStore   stores.RefreshTokenStore
	AtomicExecutor      stores.AtomicExecutor
	JWTSecretKey        string
	JWTClaimsBuilder    jwtClaimsBuilder
	Logger              logger.Logger
}

type StackDomainsService interface {
	Create(ctx context.Context, spec *models.StackDomain) (*models.StackDomain, *errors.ServiceError)
	InternalCreateWithTx(ctx context.Context, spec *models.StackDomain) (*models.StackDomain, *errors.ServiceError)
	Get(ctx context.Context, id string) (*models.StackDomain, *errors.ServiceError)
	Delete(ctx context.Context, id string) *errors.ServiceError
	InternalDeleteWithTx(ctx context.Context, id string) *errors.ServiceError
	GetByFqdn(ctx context.Context, fqdn string) (*models.StackDomain, *errors.ServiceError)
	ListByFqdnPrefix(ctx context.Context, prefix string) ([]*models.StackDomain, *errors.ServiceError)
	PopulateAndSaveExposedPortDomainsForResourceWithTx(ctx context.Context, stack *models.Stack, resource *models.StackResource) *errors.ServiceError
	InternalDeleteDomainsForResourceWithTx(ctx context.Context, resourceID string) *errors.ServiceError
}

type StackDomainsServiceSpec struct {
	SessionFactory        db.SessionFactory
	Logger                logger.Logger
	PlatformBaseDomain    string
	CustomDomainsDisabled bool
}

type StackPreviewConfigService interface {
	Create(ctx context.Context, config *models.StackPreviewConfig) (*models.StackPreviewConfig, *errors.ServiceError)
	Get(ctx context.Context, id string) (*models.StackPreviewConfig, *errors.ServiceError)
	Update(ctx context.Context, id string, config *models.StackPreviewConfig) (*models.StackPreviewConfig, *errors.ServiceError)
	Delete(ctx context.Context, id string) *errors.ServiceError
	List(ctx context.Context, projectID string, params stores.ListParams) (*stores.PaginatedResult[*models.StackPreviewConfig], *errors.ServiceError)
}

type StackPreviewConfigServiceSpec struct {
	Store              stores.StackPreviewConfigStore
	PreviewStackStore  stores.PreviewStackStore
	CredentialResolver CredentialResolver
	Permissions        auth.PermissionService
}

type StackQueryService interface {
	GetStack(ctx context.Context, ID string) (*models.Stack, *errors.ServiceError)
	GetStackTopology(ctx context.Context, ID string) (*models.StackTopology, *errors.ServiceError)
	InternalGetStack(ctx context.Context, ID string) (*models.Stack, *errors.ServiceError)
	GetStacksByProjectID(ctx context.Context, projectID string) ([]*models.Stack, *errors.ServiceError)
	GetStacksByOrganisationID(ctx context.Context, organisationID string) ([]*models.Stack, *errors.ServiceError)
	ListStacksForCurrentUser(ctx context.Context, orgID string) ([]*models.Stack, *errors.ServiceError)
}

type StackReleaseService interface {
	CreateRelease(ctx context.Context, stackID string, cause models.ReleaseCause) (*models.StackRelease, *errors.ServiceError)
	RollbackRelease(ctx context.Context, stackID, fromReleaseID string) (*models.StackRelease, *errors.ServiceError)
	GetRelease(ctx context.Context, releaseID string) (*models.StackRelease, *errors.ServiceError)
	GetReleaseDetail(ctx context.Context, releaseID string) (*models.StackRelease, *models.ReleaseLiveStatus, *errors.ServiceError)
	ListReleases(ctx context.Context, stackID string, params stores.ListParams) (*stores.PaginatedResult[*models.StackRelease], *errors.ServiceError)
	ListReleaseEvents(ctx context.Context, stackID, releaseID string, afterSequence, limit int) (*ReleaseEventPage, *errors.ServiceError)
	StreamReleaseEvents(ctx context.Context, stackID, releaseID string, afterSequence int) (interfaces.ServerSideStreamable, *errors.ServiceError)
	CancelRelease(ctx context.Context, releaseID string) *errors.ServiceError

	// Internal methods are called by workers and controllers; no permission checks.
	InternalCreateRelease(ctx context.Context, stackID string, cause models.ReleaseCause) (*models.StackRelease, *errors.ServiceError)
	InternalGet(ctx context.Context, releaseID string) (*models.StackRelease, *errors.ServiceError)
	InternalGetReleaseRefs(ctx context.Context, stacks []*models.Stack) (map[string]models.StackReleaseRefs, *errors.ServiceError)
	InternalGetActiveByStackID(ctx context.Context, stackID string) (*models.StackRelease, *errors.ServiceError)
	InternalGetLatestByStackID(ctx context.Context, stackID string) (*models.StackRelease, *errors.ServiceError)
	InternalListActive(ctx context.Context) ([]*models.StackRelease, *errors.ServiceError)
	MarkInProgress(ctx context.Context, id string) (bool, *errors.ServiceError)
	SaveManifest(ctx context.Context, id string, m *models.ReleaseManifest, rev string, pins models.ReleasePins, rendererVersion string) (bool, *errors.ServiceError)
	MarkReleased(ctx context.Context, id string, outcome models.ReleaseOutcome) (bool, *errors.ServiceError)
	MarkCancelled(ctx context.Context, id string, reasons string) (bool, *errors.ServiceError)
	MarkSuperseded(ctx context.Context, id string, reason string) (bool, *errors.ServiceError)
	MarkFailed(ctx context.Context, id string, message string, outcome *models.ReleaseOutcome) (bool, *errors.ServiceError)
	SetConvergeClockStartedAt(ctx context.Context, id string, startedAt *time.Time) *errors.ServiceError
	MarkFailedWithValidationErrors(ctx context.Context, id, message string, verrs models.ReleaseValidationErrors) (bool, *errors.ServiceError)
	AppendImageDigests(ctx context.Context, id string, digests map[string]string) *errors.ServiceError

	BackgroundJobEnqueuerInjectable
}

type StackReleaseServiceSpec struct {
	Store              stores.StackReleaseStore
	StackService       StackService
	CredentialResolver CredentialResolver
	Permissions        auth.PermissionService
	ReferenceService   ReferenceService
	EventStore         stores.ReleaseEventStore
	EventRecorder      ReleaseEventRecorder
	// GitClients is optional; it defaults to real git clients.
	GitClients    sourceGitClientProvider
	ComputePolicy computequota.Policy
}

type StackResourceService interface {
	InjectClusterManager(clusterManager clustermanager.ClusterManager)
	Create(ctx context.Context, resource *models.StackResource) (*models.StackResource, *errors.ServiceError)
	GetByStackID(ctx context.Context, stackID string) ([]*models.StackResource, *errors.ServiceError)
	GetByID(ctx context.Context, ID string) (*models.StackResource, *errors.ServiceError)
	GetByStackIDAndResourceName(ctx context.Context, stackID, resourceName string) (*models.StackResource, *errors.ServiceError)
	InternalGetByStackIDAndResourceName(ctx context.Context, stackID, resourceName string) (*models.StackResource, *errors.ServiceError)
	Update(ctx context.Context, stackID, resourceName string, resource *models.StackResource) (*models.StackResource, *errors.ServiceError)
	Delete(ctx context.Context, stackID, resourceName string) *errors.ServiceError
	UpdateStatus(ctx context.Context, resourceID string, status *models.StackResourceStatus) *errors.ServiceError
	InternalCreateWithTx(ctx context.Context, stack *models.Stack, resource *models.StackResource) (*models.StackResource, *errors.ServiceError)
	InternalUpdateWithTx(ctx context.Context, stack *models.Stack, resourceID string, resource *models.StackResource) (*models.StackResource, *errors.ServiceError)
	InternalDeleteWithTx(ctx context.Context, resourceID string) *errors.ServiceError
	InternalSyncResourcesWithTx(ctx context.Context, stack *models.Stack, existingStack *models.Stack, desired []*models.StackResource) *errors.ServiceError
	Restart(ctx context.Context, stackID, resourceName string) (*models.StackResource, *errors.ServiceError)
}

type StackResourceServiceSpec struct {
	SessionFactory         db.SessionFactory
	StorageService         StackStorageService
	Logger                 logger.Logger
	Permissions            auth.PermissionService
	StackStore             stores.StackStore
	StackResourceStore     stores.StackResourceStore
	ClusterRegistryService ImageRegistryService
	StackDomainService     StackDomainsService
	ReferenceService       ReferenceService
	ResourceValidator      stackresourcevalidator.Validator
	ComputePolicy          computequota.Policy
}

type StackService interface {
	CreateStack(ctx context.Context, spec *models.Stack) (*models.Stack, *errors.ServiceError)
	UpdateStack(ctx context.Context, ID string, spec *models.Stack) (*models.Stack, *errors.ServiceError)
	ApplyStack(ctx context.Context, spec *models.Stack) (*models.Stack, bool, *errors.ServiceError)
	UpdateStackShell(ctx context.Context, ID string, spec *models.Stack) (*models.Stack, *errors.ServiceError)
	ListStackConnections(ctx context.Context, stackID string) (models.StackConnections, *errors.ServiceError)
	CreateStackConnection(ctx context.Context, stackID string, connection *models.StackConnection) (*models.StackConnection, *errors.ServiceError)
	CreateStackVolume(ctx context.Context, stackID string, volume *models.Volume) (*models.Volume, *errors.ServiceError)
	UpdateStackConnection(ctx context.Context, stackID, connectionID string, connection *models.StackConnection) (*models.StackConnection, *errors.ServiceError)
	DeleteStackConnection(ctx context.Context, stackID, connectionID string) *errors.ServiceError
	UpdateStatus(ctx context.Context, ID string, status *models.StackStatus) *errors.ServiceError
	DeleteStack(ctx context.Context, ID string) (*models.Stack, *errors.ServiceError)
	InternalCreateStack(ctx context.Context, spec *models.Stack) (*models.Stack, *errors.ServiceError)
	InternalUpdateStack(ctx context.Context, ID string, spec *models.Stack) (*models.Stack, *errors.ServiceError)
	InternalDeleteStack(ctx context.Context, stack *models.Stack) (*models.Stack, *errors.ServiceError)
	UpdateStackCrRevision(ctx context.Context, ID string, revision string) *errors.ServiceError
	InternalList(ctx context.Context, query string, args ...any) ([]*models.Stack, *errors.ServiceError)
	InternalDeleteFromDB(ctx context.Context, ID string) *errors.ServiceError
	SetReleaseService(rs releaseServiceForStack)
	ClusterResourceServiceInjectable
	BackgroundJobEnqueuerInjectable
	StackQueryService
}

type StackServiceSpec struct {
	SessionFactory        db.SessionFactory
	VolumeService         VolumeService
	ClusterService        ClusterService
	OrganisationService   OrganisationService
	StackResourceService  StackResourceService
	NamespaceService      NamespaceService
	SecretService         SecretService
	PostgresAddonService  PostgresAddonService
	ProjectService        ProjectService
	Permissions           auth.PermissionService
	Logger                logger.Logger
	ReferenceService      ReferenceService
	CredentialResolver    CredentialResolver
	GitIntegrationService GitIntegrationService
	PlatformBaseDomain    string
	ComputePolicy         computequota.Policy
}

type StackStorageService interface {
	Get(ctx context.Context, ID string, userID string) (*models.StackStorage, *errors.ServiceError)
	GetByID(ctx context.Context, ID string) (*models.StackStorage, *errors.ServiceError)
	GetbyWorkspaceName(ctx context.Context, workspaceName string, userID string) (*models.StackStorage, *errors.ServiceError)
	InternalGet(ctx context.Context, ID string) (*models.StackStorage, *errors.ServiceError)
	ListByOrganisationID(ctx context.Context, organisationID string) ([]*models.StackStorage, *errors.ServiceError)
	ListByUserID(ctx context.Context, userID string) ([]*models.StackStorage, *errors.ServiceError)
	Create(ctx context.Context, spec *models.StackStorage, userID string) (*models.StackStorage, *errors.ServiceError)
	Update(ctx context.Context, ID string, userID string, spec *models.StackStorage) (*models.StackStorage, *errors.ServiceError)
	UpdateStatus(ctx context.Context, ID string, status *models.StackStorageStatus) *errors.ServiceError
	InjectClusterResourceService(clusterResourceService clusterresource.StackStorageClusterResourceService)
	ListVolumes(ctx context.Context, workspaceStorageID string, userID string) ([]*models.Volume, *errors.ServiceError)
	Delete(ctx context.Context, ID string, userID string) *errors.ServiceError
	MarkAsSynced(ctx context.Context, userID string, storageID string, volumeID string) *errors.ServiceError
}

type UserService interface {
	Get(ctx context.Context, ID string) (*models.User, *errors.ServiceError)
	GetUserFromContext(ctx context.Context) (*models.User, []*models.ProjectMembership, *errors.ServiceError)
	ListByOrgID(ctx context.Context, orgID string, params stores.ListParams) (*stores.PaginatedResult[*models.User], *errors.ServiceError)
	InternalGet(ctx context.Context, ID string) (*models.User, *errors.ServiceError)
	InternalGetByEmail(ctx context.Context, email string) (*models.User, *errors.ServiceError)
	InternalCreate(ctx context.Context, user *models.User) (*models.User, *errors.ServiceError)
	InternalCreateOAuthUser(ctx context.Context, email, name, githubID, avatarURL string) (*models.User, error)
	InternalCreateInvitedUser(ctx context.Context, user *models.User, invite *models.OrgInvite) (*models.User, *errors.ServiceError)
	InternalCreateInvitedOAuthUser(ctx context.Context, email, name, githubID, avatarURL string, invite *models.OrgInvite) (*models.User, error)
	Login(ctx context.Context, loginRequest *openapi.LoginRequest) (*openapi.LoginResponse, *errors.ServiceError)
}

type UserServiceSpec struct {
	SessionFactory              db.SessionFactory
	Logger                      logger.Logger
	JwtSecretKey                string
	ResourceAccessPolicyManager resourceaccess.ResourceAccessPolicyManager
	JWTClaimsBuilder            jwtClaimsBuilder
	OrganisationService         OrganisationService
	Permissions                 auth.PermissionService
	ProjectService              ProjectService
	RefreshTokenStore           stores.RefreshTokenStore
	AtomicExecutor              stores.AtomicExecutor
}

type VolumeService interface {
	Get(ctx context.Context, ID string) (*models.Volume, *errors.ServiceError)
	InternalGet(ctx context.Context, ID string) (*models.Volume, *errors.ServiceError)
	GetByVolumeNameAndNamespace(ctx context.Context, volumeName, namespace string) (*models.Volume, *errors.ServiceError)
	InternalList(ctx context.Context, ids []string) ([]*models.Volume, *errors.ServiceError)
	InternalListNotReady(ctx context.Context) ([]*models.Volume, *errors.ServiceError)
	CreateWithTx(ctx context.Context, spec *models.Volume) (*models.Volume, *errors.ServiceError)
	CreateInDbWithTx(ctx context.Context, spec *models.Volume) (*models.Volume, *errors.ServiceError)
	CreateInCluster(ctx context.Context, spec *models.Volume) *errors.ServiceError
	ListByUserID(ctx context.Context, projectID, userID string) ([]*models.Volume, *errors.ServiceError)
	UpdateStatus(ctx context.Context, ID string, status *models.VolumeStatus) *errors.ServiceError
	UpdateGitRepoSourceRevision(ctx context.Context, ID string, revision models.GitRepoRevision) (*models.Volume, *errors.ServiceError)
	UpdateRemoteSourceRevision(ctx context.Context, ID string, revision models.RemoteDirSource) (*models.Volume, *errors.ServiceError)
	InjectClusterResourceService(volumeClusterService clusterresource.VolumeClusterResourceService)
	Delete(ctx context.Context, ID string) *errors.ServiceError
	InternalDeleteFromDB(ctx context.Context, ID string) *errors.ServiceError
	InternalDeleteVolumesUsedByStackFromDB(ctx context.Context, stackID string) *errors.ServiceError
	DeleteWithTx(ctx context.Context, ID string) *errors.ServiceError
	ListVolumesUsedByStack(ctx context.Context, stackID string) ([]*models.Volume, *errors.ServiceError)
	InternalCreateWithTx(ctx context.Context, stack *models.Stack, volume *models.Volume) (*models.Volume, *errors.ServiceError)
	InternalSyncVolumesWithTx(ctx context.Context, stack *models.Stack, existingStack *models.Stack, desired []*models.Volume) *errors.ServiceError
}

type VolumeServiceSpec struct {
	SessionFactory   db.SessionFactory
	ReferenceService ReferenceService
	Logger           logger.Logger
	Permissions      auth.PermissionService
	ComputePolicy    computequota.Policy
}