api

type DirectoryView interface {
	// GetNode returns a snapshot of the node and true if present.
	GetNode(nodeID uint32) (*NodeInfo, bool)

	// NodeCount returns the total number of registered nodes.
	NodeCount() int

	// List returns a snapshot slice of every node. The returned slice
	// is owned by the caller; mutations do not affect the store.
	List() []*NodeInfo

	// Online returns the count of nodes whose LastSeen is at or after
	// threshold (i.e., considered live).
	Online(threshold time.Time) int

	// TaskExecutorCount returns the number of nodes advertising task
	// execution capability.
	TaskExecutorCount() int

	// LookupByPubKey returns the nodeID owning the given base64-encoded
	// Ed25519 public key. The bool is false on miss.
	LookupByPubKey(pubKeyB64 string) (uint32, bool)

	// LookupByHostname returns the nodeID with the given unique
	// hostname. The bool is false on miss.
	LookupByHostname(name string) (uint32, bool)
}

type IdentityView interface {
	// Configured reports whether an external IDP integration is set
	// up (mirrors today's "idpConfig != nil" check on Server).
	Configured() bool

	// GetKeyInfo returns the lifecycle metadata for nodeID's current
	// key and true if present.
	GetKeyInfo(nodeID uint32) (*KeyInfo, bool)
}

type KeyInfo struct {
	CreatedAt   time.Time `json:"created_at"`
	RotatedAt   time.Time `json:"rotated_at,omitempty"` // zero if never rotated
	RotateCount int       `json:"rotate_count"`
	ExpiresAt   time.Time `json:"expires_at,omitempty"` // zero = no expiry
}

type MembershipView interface {
	// GetNetwork returns a snapshot of the network and true if present.
	GetNetwork(networkID uint16) (*NetworkInfo, bool)

	// Count returns the total number of networks.
	Count() int

	// Networks returns a snapshot slice of every network.
	Networks() []*NetworkInfo

	// Members returns the node IDs that belong to networkID. Returns
	// nil if the network does not exist.
	Members(networkID uint16) []uint32

	// NetworksFor returns the network IDs nodeID is a member of.
	NetworksFor(nodeID uint32) []uint16

	// MemberRole returns the member's role in the network. The error
	// is non-nil when the network or membership does not exist.
	MemberRole(networkID uint16, nodeID uint32) (Role, error)

	// MemberTags returns the admin-assigned tags for the member.
	// Returns nil when no tags are set or the membership is absent.
	MemberTags(networkID uint16, nodeID uint32) []string

	// PendingInvites returns the count of pending network invites in
	// the node's inbox.
	PendingInvites(nodeID uint32) int
}

type NetworkInfo struct {
	ID          uint16
	Name        string
	JoinRule    string
	Token       string // for token-gated networks
	Members     []uint32
	MemberRoles map[uint32]Role     // per-member RBAC roles
	MemberTags  map[uint32][]string // admin-assigned per-member tags
	AdminToken  string              // per-network admin token (optional)
	Policy      NetworkPolicy       // network policy (limits, port restrictions)
	Rules       json.RawMessage     // managed network rules document (nil = none)
	ExprPolicy  json.RawMessage     // programmable policy engine document (nil = none)
	Enterprise  bool                // enterprise network (gates phase 2-5 features)
	Created     time.Time
}

type NetworkInvite struct {
	NetworkID uint16    `json:"network_id"`
	InviterID uint32    `json:"inviter_id"`
	Timestamp time.Time `json:"timestamp"`
}

type NetworkPolicy struct {
	MaxMembers   int      `json:"max_members"`   // 0 = unlimited
	AllowedPorts []uint16 `json:"allowed_ports"` // empty = all ports allowed
	Description  string   `json:"description"`   // human-readable description
}

type NodeInfo struct {
	ID         uint32
	Owner      string // email or identifier (for key rotation)
	PublicKey  []byte
	RealAddr   string
	Networks   []uint16
	LastSeen   time.Time
	Public     bool   // if true, endpoint is visible in lookup/list_nodes
	Hostname   string // unique hostname for discovery (empty = none)
	Tags       []string
	TaskExec   bool     // node advertises task execution capability
	LANAddrs   []string // LAN addresses for same-network peer detection
	KeyMeta    KeyInfo  // key lifecycle metadata
	ExternalID string   // verified external identity (e.g., OIDC sub)
	Version    string   // binary version reported by daemon
	RelayOnly  bool     // peers must reach this node via beacon relay only
}

type PolicyView interface {
	// Get returns the policy for networkID and true if set.
	Get(networkID uint16) (*NetworkPolicy, bool)

	// GetExpr returns the marshaled expression-policy document for
	// networkID, or (nil, false) when none is set. The bytes are
	// owned by the caller and may be retained or mutated freely.
	GetExpr(networkID uint16) ([]byte, bool)
}

type Role string

type TrustView interface {
	// Count returns the total number of trust pairs currently stored.
	Count() int

	// IsTrusted reports whether nodes a and b have an established
	// trust pair. The relation is symmetric: IsTrusted(a, b) ==
	// IsTrusted(b, a).
	IsTrusted(a, b uint32) bool
}