identity

type BlueprintAuditExport = wire.BlueprintAuditExport

type BlueprintIdentityProvider = wire.BlueprintIdentityProvider

type BlueprintPolicy = wire.BlueprintPolicy

type BlueprintRole = wire.BlueprintRole

type BlueprintWebhooks = wire.BlueprintWebhooks

type Callbacks struct {
	// Save triggers a debounced snapshot write.
	Save func()

	// Audit records an audit-log entry.
	Audit func(action string, attrs ...any)

	// IncKeyRotations increments the key-rotation counter.
	IncKeyRotations func()

	// IncIDPVerifications increments the IDP-verification counter.
	IncIDPVerifications func()

	// RecordWAL writes a key-rotation WAL entry.
	RecordWAL WALRecorder

	// OnKeyRotated is the callback that updates pubKeyIdx in the parent Server.
	OnKeyRotated KeyRotationCallback

	// Bus is the event bus used to publish "key.rotated" events.
	Bus events.Bus
}

type JWKSCache struct {
	Keys      []JwksKey
	URL       string
	FetchedAt time.Time
	TTL       time.Duration
	// contains filtered or unexported fields
}

type JwksKey struct {
	Kty string `json:"kty"`
	Kid string `json:"kid"`
	Alg string `json:"alg"`
	K   string `json:"k,omitempty"`
	N   string `json:"n,omitempty"`
	E   string `json:"e,omitempty"`
}

type JwtAud []string

type JwtClaims struct {
	Issuer    string `json:"iss"`
	Subject   string `json:"sub"`
	Audience  JwtAud `json:"aud"`
	Expiry    int64  `json:"exp"`
	IssuedAt  int64  `json:"iat"`
	NotBefore int64  `json:"nbf"`
}

type JwtHeader struct {
	Alg string `json:"alg"`
	Typ string `json:"typ"`
	Kid string `json:"kid"`
}

type KeyInfo struct {
	CreatedAt   time.Time `json:"created_at"`
	RotatedAt   time.Time `json:"rotated_at,omitempty"`
	RotateCount int       `json:"rotate_count"`
	ExpiresAt   time.Time `json:"expires_at,omitempty"`
}

type KeyRotationCallback func(nodeID uint32, oldPubKey, newPubKey string)

type NetworkBlueprint = wire.NetworkBlueprint

type NodeView interface {
	// LookupNodeKey returns the current public key for a node.
	// ok is false if the node does not exist.
	LookupNodeKey(id uint32) (pubKey []byte, ok bool)

	// LookupNodeFull returns full identity-related fields for a node.
	// ok is false if the node does not exist.
	LookupNodeFull(id uint32) (pubKey []byte, keyMeta KeyInfo, networks []uint16, externalID, owner string, ok bool)

	// UpdateNodeKey atomically swaps the node's public key if it still matches
	// expectedPubKey (stale-check for concurrent-rotation detection).
	// Returns the old public key (base64-encoded) and nil on success.
	// Returns ErrKeyRotatedConcurrently if the key was rotated concurrently.
	// Returns protocol.ErrNodeNotFound if the node was deregistered.
	UpdateNodeKey(id uint32, expectedPubKey, newPubKey []byte, rotatedAt time.Time) (oldPubKeyB64 string, err error)

	// UpdateNodeKeyExpiry sets/clears the key expiry for a node.
	// Returns the old expiry value. ok is false if the node does not exist.
	UpdateNodeKeyExpiry(id uint32, expiresAt time.Time) (oldExpiry time.Time, ok bool)

	// UpdateNodeExternalID sets the external identity string on a node.
	// Returns the old external ID. ok is false if the node does not exist.
	UpdateNodeExternalID(id uint32, externalID string) (oldID string, ok bool)

	// NodeIsEnterprise returns true if the node belongs to at least one
	// enterprise-flagged network.
	NodeIsEnterprise(id uint32) bool

	// AdminToken returns the global admin token.
	AdminToken() string

	// CheckAdminToken returns nil if the message carries a valid admin token.
	CheckAdminToken(msg map[string]interface{}) error

	// VerifyHeartbeatSignature verifies a heartbeat-style Ed25519 signature.
	VerifyHeartbeatSignature(pubKey []byte, adminToken string, msg map[string]interface{}, challenge string) error

	// Now returns the current time (may be overridden in tests).
	Now() time.Time
}

type ProvisionCallbacks struct {
	// FindOrCreateNetwork looks up a network by name; if not found it creates
	// one using the supplied blueprint fields. Returns (networkID, created, err).
	FindOrCreateNetwork func(name string, enterprise bool, joinRule, joinToken, networkAdminToken, adminToken string) (uint16, bool, error)

	// EnableEnterprise sets the Enterprise flag on network netID if not already set.
	EnableEnterprise func(netID uint16)

	// ApplyNetworkPolicy sets the structural policy on a network.
	ApplyNetworkPolicy func(netID uint16, pol *BlueprintPolicy) error

	// ApplyExprPolicy sets the programmable (expr) policy on a network.
	ApplyExprPolicy func(netID uint16, data json.RawMessage) error

	// SetAuditWebhookURL configures the server's audit webhook URL.
	SetAuditWebhookURL func(url string)

	// StoreRBACPreAssignments saves pre-assignments for future node joins.
	StoreRBACPreAssignments func(netID uint16, roles []BlueprintRole)

	// ConfigureAuditExport sets up the audit exporter.
	ConfigureAuditExport func(cfg *BlueprintAuditExport)

	// IncProvisionsTotal increments the provisions counter.
	IncProvisionsTotal func()
}

type ProvisionResult struct {
	NetworkID uint16   `json:"network_id"`
	Name      string   `json:"name"`
	Created   bool     `json:"created"` // true if network was created (vs updated)
	Actions   []string `json:"actions"` // human-readable list of actions taken
}

type RBACPreAssignCallbacks struct {
	// GetRoles returns the pre-assigned roles for netID and the node's
	// ExternalID. found is false if there are no pre-assignments or the
	// node doesn't exist.
	GetRoles func(netID uint16, nodeID uint32) (roles []BlueprintRole, externalID string, found bool)

	// CommitRole sets the member's role in the network.
	CommitRole func(netID uint16, nodeID uint32, role string)

	// IncCounter increments the RBAC pre-assignment metric counter.
	IncCounter func()
}

type Store struct {
	// contains filtered or unexported fields
}

type WALRecorder func(nodeID uint32, newPubKeyB64, rotatedAt string)