membership

type Callbacks struct {
	// Save triggers a debounced snapshot write.
	Save func()
	// Audit records an audit log entry.
	Audit func(action string, attrs ...any)
	// RecordWALNetworkCreate records a network-create WAL entry.
	RecordWALNetworkCreate func(netID uint16, name, joinRule, token, adminToken string, enterprise bool, creatorNodeID uint32, createdAt string)
	// RecordWALNetworkJoin records a network-join WAL entry.
	RecordWALNetworkJoin func(nodeID uint32, netID uint16)
	// RecordWALNetworkLeave records a network-leave WAL entry.
	RecordWALNetworkLeave func(nodeID uint32, netID uint16)
	// RecordWALNetworkDelete records a network-delete WAL entry.
	RecordWALNetworkDelete func(netID uint16)
	// InvalidateListNodesCache drops the per-network list_nodes cache.
	InvalidateListNodesCache func(netID uint16)
	// PublishMembershipChanged publishes a membership.changed bus event.
	PublishMembershipChanged func(netID uint16)
	// ApplyRBACPreAssignment checks and applies any pre-assigned roles.
	// Caller must hold the global write lock.
	ApplyRBACPreAssignment func(netID uint16, nodeID uint32)
	// RequireAdminToken validates the admin_token field in a message.
	RequireAdminToken func(msg map[string]interface{}) error
	// RequireNetworkRole checks RBAC role for network operations.
	RequireNetworkRole func(msg map[string]interface{}, netID uint16, roles ...Role) error
	// RequireEnterprise checks that the given network has the Enterprise flag.
	RequireEnterprise func(netID uint16) error
	// VerifyNodeSignature verifies an Ed25519 signature for a node write.
	// Takes pubKey and adminToken (already copied under RLock by caller).
	VerifyNodeSignature func(pubKey []byte, adminToken string, msg map[string]interface{}, challenge string) error
	// AdminToken returns the current admin token (caller must not hold write lock).
	AdminToken func() string
	// NodeExists returns true if nodeID is registered. Caller must hold mu.RLock
	// or mu.Lock before calling.
	NodeExists func(nodeID uint32) bool
	// GetNodeForRead returns node fields needed before write lock.
	// Returns (pubKey, ok). Caller must hold mu.RLock.
	GetNodePubKey func(nodeID uint32) (pubKey []byte, ok bool)
	// GetNode returns a node's key fields. Caller must hold mu (read or write).
	GetNode func(nodeID uint32) (pubKey []byte, networks []uint16, externalID string, ok bool)
	// NodeNetworks returns a copy of node.Networks. Caller must hold mu.
	NodeNetworks func(nodeID uint32) ([]uint16, bool)
	// AppendNodeNetwork appends netID to the node's Networks slice under its shard lock.
	// Caller must hold mu.Lock.
	AppendNodeNetwork func(nodeID uint32, netID uint16)
	// RemoveNodeNetwork removes netID from the node's Networks slice under its shard lock.
	// Caller must hold mu.Lock. Returns false if the node was not in the network.
	RemoveNodeNetwork func(nodeID uint32, netID uint16) bool
	// IncInvitesSent increments the invites_sent_total counter.
	IncInvitesSent func()
	// IncInvitesAccepted increments the invites_accepted_total counter.
	IncInvitesAccepted func()
	// IncInvitesRejected increments the invites_rejected_total counter.
	IncInvitesRejected func()
	// IncRbacOps increments the rbac_operations_total{op=label} counter.
	IncRbacOps func(op string)
}

type NetworkInfo struct {
	ID           uint16
	Name         string
	JoinRule     string
	Token        string // for token-gated networks
	Members      []uint32
	MemberRoles  map[uint32]Role     // per-member RBAC roles
	MemberTags   map[uint32][]string // admin-assigned per-member tags (e.g. "service")
	AdminToken   string              // per-network admin token (optional)
	Policy       NetworkPolicy       // network policy (membership limits, port restrictions)
	Rules        *wire.NetworkRules  // managed network rules (nil = normal network)
	ExprPolicy   json.RawMessage     // programmable policy engine document (nil = none)
	Enterprise   bool                // enterprise network (gates Phase 2-5 features)
	Created      time.Time
	RequestCount atomic.Int64 // per-network request counter (dashboard stats)
}

type NetworkInvite struct {
	NetworkID uint16    `json:"network_id"`
	InviterID uint32    `json:"inviter_id"`
	Timestamp time.Time `json:"timestamp"`
}

type NetworkPolicy struct {
	MaxMembers   int      `json:"max_members"`
	AllowedPorts []uint16 `json:"allowed_ports"`
	Description  string   `json:"description"`
}

type Role string

type Store struct {
	// contains filtered or unexported fields
}