bootstrap

type BindingContext struct {
	Type     string
	ID       string
	Snapshot map[string]any
	Secret   map[string]any
}

type BindingRequest struct {
	Slot       string `json:"slot"`
	Type       string `json:"type"`        // "client" | "channel" | "cert"
	ResourceID string `json:"resource_id"` // ID of the resource in its owning service
}

type BindingResolver interface {
	Resolve(ctx context.Context, req ResolveRequest) ([]BindingSnapshot, error)
}

type BindingSlot struct {
	Name     string   `json:"name"`
	Type     string   `json:"type"`
	Required bool     `json:"required"`
	Fields   []string `json:"fields,omitempty"`
}

type BindingSnapshot struct {
	ConfigID       string         `json:"config_id"`
	Slot           string         `json:"slot"`
	Type           string         `json:"type"`
	ResourceID     string         `json:"resource_id"`
	Snapshot       map[string]any `json:"snapshot,omitempty"`
	SecretSnapshot map[string]any `json:"secret_snapshot,omitempty"` // encrypted at rest
	UpdatedAt      time.Time      `json:"updated_at,omitempty"`
}

type BindingStore interface {
	// Save upserts all given snapshots for the config.
	Save(ctx context.Context, configID string, bindings []BindingSnapshot) error

	// Retrieve returns all snapshots for the given config.
	Retrieve(ctx context.Context, configID string) ([]BindingSnapshot, error)

	// Delete removes the snapshot for a specific slot of a config.
	Delete(ctx context.Context, configID, slot string) error
}

type Config struct {
	ID            string         `json:"id"`
	DomainID      string         `json:"domain_id,omitempty"`
	Name          string         `json:"name,omitempty"`
	ClientCert    string         `json:"client_cert,omitempty"`
	ClientKey     string         `json:"client_key,omitempty"`
	CACert        string         `json:"ca_cert,omitempty"`
	ExternalID    string         `json:"external_id"`
	ExternalKey   string         `json:"external_key"`
	Content       string         `json:"content,omitempty"`
	Status        Status         `json:"status"`
	ProfileID     string         `json:"profile_id,omitempty"`
	RenderContext map[string]any `json:"render_context,omitempty"`
}

type ConfigReader interface {
	ReadConfig(Config, bool) (any, error)
}

type ConfigRepository interface {
	// Save persists the Config. Successful operation is indicated by non-nil
	// error response.
	Save(ctx context.Context, cfg Config) (string, error)

	// RetrieveByID retrieves the Config having the provided identifier, that is owned
	// by the specified user.
	RetrieveByID(ctx context.Context, domainID, id string) (Config, error)

	// RetrieveAll retrieves a subset of Configs that belong to the given domain,
	// with given filter parameters.
	RetrieveAll(ctx context.Context, domainID string, filter Filter, offset, limit uint64) ConfigsPage

	// RetrieveByExternalID returns Config for given external ID.
	RetrieveByExternalID(ctx context.Context, externalID string) (Config, error)

	// Update updates an existing Config. A non-nil error is returned
	// to indicate operation failure.
	Update(ctx context.Context, cfg Config) error

	// AssignProfile sets the profile reference for the given Config.
	AssignProfile(ctx context.Context, domainID, id, profileID string) error

	// UpdateCerts updates and returns an existing Config certificate and domainID.
	// A non-nil error is returned to indicate operation failure.
	UpdateCert(ctx context.Context, domainID, id, clientCert, clientKey, caCert string) (Config, error)

	// Remove removes the Config having the provided identifier, that is owned
	// by the specified user.
	Remove(ctx context.Context, domainID, id string) error

	// ChangeStatus changes the Status of the Config owned by the specific user.
	ChangeStatus(ctx context.Context, domainID, id string, status Status) error
}

type ConfigsPage struct {
	Total   uint64   `json:"total"`
	Offset  uint64   `json:"offset"`
	Limit   uint64   `json:"limit"`
	Configs []Config `json:"configs"`
}

type ContentFormat string

type DeviceContext struct {
	ID         string
	ExternalID string
	DomainID   string
}

type Filter struct {
	FullMatch    map[string]string
	PartialMatch map[string]string
}

type Hasher interface {
	// Hash generates the hashed string from plain-text.
	Hash(string) (string, error)

	// Compare compares plain-text version to the hashed one. An error should
	// indicate failed comparison.
	Compare(string, string) error
}

type Profile struct {
	ID              string         `json:"id"`
	DomainID        string         `json:"domain_id,omitempty"`
	Name            string         `json:"name"`
	Description     string         `json:"description,omitempty"`
	ContentFormat   ContentFormat  `json:"content_format"`
	ContentTemplate string         `json:"content_template,omitempty"`
	Defaults        map[string]any `json:"defaults,omitempty"`
	BindingSlots    []BindingSlot  `json:"binding_slots,omitempty"`
	Version         int            `json:"version,omitempty"`
	CreatedAt       time.Time      `json:"created_at,omitempty"`
	UpdatedAt       time.Time      `json:"updated_at,omitempty"`
}

type ProfileRepository interface {
	// Save persists a new Profile and returns it with server-assigned fields set.
	Save(ctx context.Context, p Profile) (Profile, error)

	// RetrieveByID returns the Profile with the given ID inside the given domain.
	RetrieveByID(ctx context.Context, domainID, id string) (Profile, error)

	// RetrieveAll returns a page of Profiles belonging to the given domain, optionally filtered by name.
	RetrieveAll(ctx context.Context, domainID string, offset, limit uint64, name string) (ProfilesPage, error)

	// Update updates editable fields of the given Profile and returns the updated Profile.
	Update(ctx context.Context, p Profile) (Profile, error)

	// Delete removes the Profile with the given ID from the given domain.
	Delete(ctx context.Context, domainID, id string) error
}

type ProfilesPage struct {
	Total    uint64    `json:"total"`
	Offset   uint64    `json:"offset"`
	Limit    uint64    `json:"limit"`
	Profiles []Profile `json:"profiles"`
}

type RenderContext struct {
	Device   DeviceContext
	Vars     map[string]any
	Bindings map[string]BindingContext
}

type Renderer interface {
	Render(profile Profile, enrollment Config, bindings []BindingSnapshot) ([]byte, error)
}

type ResolveRequest struct {
	Enrollment Config
	Token      string
	Requested  []BindingRequest
}

type Service interface {
	// Add adds new Client Config to the user identified by the provided token.
	Add(ctx context.Context, session smqauthn.Session, token string, cfg Config) (Config, error)

	// View returns Client Config with given ID belonging to the user identified by the given token.
	View(ctx context.Context, session smqauthn.Session, id string) (Config, error)

	// Update updates editable fields of the provided Config.
	Update(ctx context.Context, session smqauthn.Session, cfg Config) error

	// UpdateCert updates an existing Config certificate and token.
	// A non-nil error is returned to indicate operation failure.
	UpdateCert(ctx context.Context, session smqauthn.Session, id, clientCert, clientKey, caCert string) (Config, error)

	// List returns subset of Configs with given search params that belong to the
	// user identified by the given token.
	List(ctx context.Context, session smqauthn.Session, filter Filter, offset, limit uint64) (ConfigsPage, error)

	// Remove removes Config with specified token that belongs to the user identified by the given token.
	Remove(ctx context.Context, session smqauthn.Session, id string) error

	// Bootstrap returns Config to the Client with provided external ID using external key.
	Bootstrap(ctx context.Context, externalKey, externalID string, secure bool) (Config, error)

	// EnableConfig enables the Config so its device can successfully bootstrap.
	EnableConfig(ctx context.Context, session smqauthn.Session, id string) (Config, error)

	// DisableConfig disables the Config, preventing its device from bootstrapping.
	DisableConfig(ctx context.Context, session smqauthn.Session, id string) (Config, error)

	// CreateProfile persists a new device Profile.
	CreateProfile(ctx context.Context, session smqauthn.Session, p Profile) (Profile, error)

	// ViewProfile returns the Profile with the given ID.
	ViewProfile(ctx context.Context, session smqauthn.Session, profileID string) (Profile, error)

	// UpdateProfile updates editable fields of the given Profile and returns the updated Profile.
	UpdateProfile(ctx context.Context, session smqauthn.Session, p Profile) (Profile, error)

	// ListProfiles returns a page of Profiles belonging to the domain.
	ListProfiles(ctx context.Context, session smqauthn.Session, offset, limit uint64, name string) (ProfilesPage, error)

	// DeleteProfile removes the Profile with the given ID.
	DeleteProfile(ctx context.Context, session smqauthn.Session, profileID string) error

	// AssignProfile sets the ProfileID on an existing enrollment (Config).
	AssignProfile(ctx context.Context, session smqauthn.Session, configID, profileID string) error

	// BindResources resolves the requested bindings through their owning services,
	// stores snapshots, and marks the enrollment renderable when all required slots
	// are satisfied.
	BindResources(ctx context.Context, session smqauthn.Session, token, configID string, bindings []BindingRequest) error

	// ListBindings returns all stored binding snapshots for an enrollment.
	ListBindings(ctx context.Context, session smqauthn.Session, configID string) ([]BindingSnapshot, error)

	// RefreshBindings re-resolves all existing bindings for an enrollment and
	// updates the stored snapshots.
	RefreshBindings(ctx context.Context, session smqauthn.Session, token, configID string) error
}

type Status uint8