models

type AuditLog struct {
	ID        uint      `json:"id" gorm:"primaryKey"`
	Timestamp time.Time `json:"timestamp" gorm:"autoCreateTime;index"`
	ActorType string    `json:"actor_type" gorm:"not null"`   // "user", "service", "system"
	ActorID   string    `json:"actor_id"`                     // user ID, service token name, or "kernel"
	Action    string    `json:"action" gorm:"not null;index"` // "auth.login", "auth.register", "plugin.install", etc.
	Resource  string    `json:"resource"`                     // What was acted on: "plugin:discord-bot", "user:5", etc.
	Detail    string    `json:"detail"`                       // JSON blob with extra context
	IP        string    `json:"ip"`                           // Client IP
	Success   bool      `json:"success" gorm:"default:true"`
}

type BindMount struct {
	Host      string `json:"host" yaml:"host"`
	Container string `json:"container" yaml:"container"`
	ReadOnly  bool   `json:"read_only,omitempty" yaml:"read_only,omitempty"`
}

type Config struct {
	ID        uint      `json:"id" gorm:"primaryKey"`
	OwnerID   string    `json:"owner_id" gorm:"column:owner_id;not null;index;uniqueIndex:idx_owner_key"`
	Key       string    `json:"key" gorm:"not null;uniqueIndex:idx_owner_key"`
	Value     string    `json:"value" gorm:"not null"`
	IsSecret  bool      `json:"is_secret" gorm:"default:false"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type ConfigSchemaField struct {
	Type        string       `json:"type"`                   // "string", "select", "number", "boolean", "text"
	Label       string       `json:"label"`                  // Human-readable label
	Required    bool         `json:"required,omitempty"`     // Whether the field must be set
	Secret      bool         `json:"secret,omitempty"`       // Whether to mask the value in UI
	ReadOnly    bool         `json:"readonly,omitempty"`     // Display-only; cannot be changed by the user
	Virtual     bool         `json:"virtual,omitempty"`      // Pass-through only; value is never persisted
	Default     string       `json:"default,omitempty"`      // Default value
	Options     []string     `json:"options,omitempty"`      // For "select" type
	Dynamic     bool         `json:"dynamic,omitempty"`      // Fetch options at runtime from plugin
	HelpText    string       `json:"help_text,omitempty"`    // Tooltip/description
	VisibleWhen *VisibleWhen `json:"visible_when,omitempty"` // Show only when another field matches a value
	OAuthMethod string       `json:"oauth_method,omitempty"` // OAuth flow variant: "device_code" or "redirect_code"
	Order       int          `json:"order,omitempty"`        // Display order (lower = first)
}

type ContainerSpec struct {
	Name          string            `json:"name" yaml:"name"`
	Image         string            `json:"image" yaml:"image"`
	Role          string            `json:"role" yaml:"role"`
	Ports         []ExtraPortSpec   `json:"ports,omitempty" yaml:"ports,omitempty"`
	DockerLabels  map[string]string `json:"docker_labels,omitempty" yaml:"docker_labels,omitempty"`
	DevImage      string            `json:"dev_image,omitempty" yaml:"dev_image,omitempty"`
	DevBindMounts []BindMount       `json:"dev_bind_mounts,omitempty" yaml:"dev_bind_mounts,omitempty"`
}

type DiskMount struct {
	SourcePath string `json:"source_path"` // storage-disk internal path, e.g. "/data/storage-root/workspace/ws-abc"
	Target     string `json:"target"`      // mount path inside the container
	ReadOnly   bool   `json:"read_only,omitempty"`
}

type EventSubscription struct {
	ID           uint   `gorm:"primaryKey"`
	PluginID     string `gorm:"uniqueIndex:idx_sub_plugin_event;not null"`
	EventType    string `gorm:"uniqueIndex:idx_sub_plugin_event;not null"`
	CallbackPath string `gorm:"not null"`
	CreatedAt    time.Time
}

type ExtraPortSpec struct {
	Name     string `json:"name,omitempty"`
	Internal int    `json:"internal"`
	External int    `json:"external,omitempty"`
}

type JSONRawString json.RawMessage

type JSONStringList []string

type ManagedContainer struct {
	ID           string    `json:"id" gorm:"primaryKey"`
	PluginID     string    `json:"plugin_id" gorm:"not null;index"`
	Name         string    `json:"name" gorm:"not null"`
	Image        string    `json:"image" gorm:"not null"`
	ContainerID  string    `json:"-"`
	Status       string    `json:"status" gorm:"not null;default:'stopped'"`
	Port         int       `json:"port" gorm:"not null"`
	Subdomain    string    `json:"subdomain" gorm:"uniqueIndex"`
	DiskMounts   string    `json:"-" gorm:"type:text"` // JSON array of DiskMount
	Env          string    `json:"-" gorm:"type:text"`
	Cmd          string    `json:"-" gorm:"type:text"` // JSON array of command args
	DockerUser   string    `json:"-" gorm:"column:docker_user"`
	PluginSource string    `json:"plugin_source,omitempty" gorm:"column:plugin_source"`
	CreatedAt    time.Time `json:"created_at"`
	UpdatedAt    time.Time `json:"updated_at"`
}

type Plugin struct {
	ID          string `json:"id" gorm:"primaryKey"`
	Name        string `json:"name" gorm:"not null"`
	Version     string `json:"version" gorm:"not null"`
	Image       string `json:"image"`
	ContainerID string `json:"-"`
	// ContainerIDs is a JSON map of container_name → docker container ID for
	// multi-container plugins. The api role container's ID is also mirrored
	// into ContainerID for backward compat.
	ContainerIDs JSONRawString `json:"-" gorm:"type:json"`
	// DevMode toggles use of dev_image / dev_bind_mounts for each container spec.
	DevMode bool `json:"dev_mode" gorm:"default:false"`
	// Containers is an explicit JSON array of ContainerSpec for multi-container
	// plugins (a "pod" of containers). When non-empty it takes precedence over
	// the legacy top-level Image / DockerLabels / ExtraPorts fields. When empty,
	// GetEffectiveContainers() synthesizes a single-container spec from those
	// legacy fields so old single-container plugins keep working unchanged.
	Containers   JSONRawString  `json:"containers,omitempty" gorm:"type:json"`
	Status       string         `json:"status" gorm:"not null;default:'stopped'"`
	Host         string         `json:"host"`
	GRPCPort     int            `json:"grpc_port"`
	HTTPPort     int            `json:"http_port"`
	EventPort    int            `json:"event_port,omitempty"` // deprecated: events now go to HTTPPort via /events route
	Capabilities JSONStringList `json:"capabilities" gorm:"type:json"`
	Dependencies JSONStringList `json:"dependencies,omitempty" gorm:"type:json"` // required capability strings
	Marketplace  string         `json:"marketplace" gorm:"default:'local'"`
	Enabled      bool           `json:"enabled" gorm:"default:false"`
	System       bool           `json:"system" gorm:"default:false"` // system plugins are auto-installed and cannot be uninstalled
	LastSeen     time.Time      `json:"last_seen"`
	CreatedAt    time.Time      `json:"created_at"`
	UpdatedAt    time.Time      `json:"updated_at"`

	// Candidate fields — a dev or new-build container running alongside the primary.
	CandidateContainerID string    `json:"-"`
	CandidateImage       string    `json:"candidate_image,omitempty"`
	CandidateVersion     string    `json:"candidate_version,omitempty"`
	CandidateHost        string    `json:"candidate_host,omitempty"`
	CandidatePort        int       `json:"candidate_port,omitempty"`
	CandidateEventPort   int       `json:"-"`
	CandidateHealthy     bool      `json:"candidate_healthy,omitempty"`
	CandidateDeployedAt  time.Time `json:"candidate_deployed_at,omitempty"`
	CandidateLastSeen    time.Time `json:"-"`

	// Previous fields — stored on promote so rollback can restore.
	PreviousImage   string `json:"-"`
	PreviousVersion string `json:"-"`

	// WorkspaceSchema defines how to launch a workspace environment.
	// Only present on plugins with the workspace:environment capability.
	// Stored as JSON; see WorkspaceSchemaData for the typed structure.
	WorkspaceSchema JSONRawString `json:"workspace_schema,omitempty" gorm:"type:json"`

	// SharedDisks is a JSON array of shared disk mounts requested by the plugin.
	// Each entry has a disk name and target mount path. The kernel auto-creates
	// the disk directory and bind-mounts it into the plugin container.
	SharedDisks JSONRawString `json:"shared_disks,omitempty" gorm:"type:json"`

	// DockerLabels is a JSON map of label key/value pairs the plugin wants
	// applied to its container. Values may reference ${ENV_VAR} which will be
	// substituted from the kernel's process env at container-create time.
	DockerLabels JSONRawString `json:"docker_labels,omitempty" gorm:"type:json"`

	// ExtraPorts is a JSON array of additional ports the plugin wants opened
	// on its container, beyond the kernel-managed REST API port. The kernel
	// publishes them on the host but does not route or health-check them.
	ExtraPorts JSONRawString `json:"extra_ports,omitempty" gorm:"type:json"`

	// RequestedScopes is a JSON array of authorization scopes the plugin needs.
	RequestedScopes JSONStringList `json:"requested_scopes,omitempty" gorm:"type:json"`

	// ConfigSchema is a JSON string mapping env var names to ConfigSchemaField objects.
	// Example:
	//   {
	//     "OPENAI_API_KEY": {"type":"string","label":"API Key","required":true,"secret":true},
	//     "OPENAI_MODEL":   {"type":"select","label":"Model","default":"gpt-4o","options":["gpt-4o","gpt-4o-mini"]}
	//   }
	// The kernel uses this schema to (a) present config UI and (b) inject default values
	// as env vars when starting the plugin container.
	ConfigSchema JSONRawString `json:"config_schema" gorm:"type:json"`
}

type ServiceToken struct {
	ID           uint      `json:"id" gorm:"primaryKey"`
	Name         string    `json:"name" gorm:"not null;uniqueIndex"`
	TokenHash    string    `json:"-" gorm:"not null"` // SHA256 hash of the token (for revocation lookup)
	Capabilities string    `json:"capabilities"`      // JSON array
	IssuedBy     uint      `json:"issued_by"`         // User ID of admin who created it
	ExpiresAt    time.Time `json:"expires_at"`
	Revoked      bool      `json:"revoked" gorm:"default:false"`
	CreatedAt    time.Time `json:"created_at"`
}

type SharedDiskEntry struct {
	Name   string `json:"name"`
	Type   string `json:"type"` // "shared" or "workspace"
	Target string `json:"target"`
}

type User struct {
	ID           uint      `gorm:"primaryKey;autoIncrement" json:"id"`
	Email        string    `gorm:"uniqueIndex;not null" json:"email"`
	PasswordHash string    `gorm:"not null" json:"-"`
	DisplayName  string    `json:"display_name"`
	Role         string    `gorm:"default:user" json:"role"`
	CreatedAt    time.Time `json:"created_at"`
	UpdatedAt    time.Time `json:"updated_at"`
}

type VisibleWhen struct {
	Field string `json:"field"`
	Value string `json:"value"`
}

type WorkspaceSchemaData struct {
	DisplayName string            `json:"display_name" yaml:"display_name"`
	Description string            `json:"description" yaml:"description"`
	Image       string            `json:"image" yaml:"image"`
	Port        int               `json:"port" yaml:"port"`
	Cmd         []string          `json:"cmd,omitempty" yaml:"cmd,omitempty"`
	EnvDefaults map[string]string `json:"env_defaults,omitempty" yaml:"env_defaults,omitempty"`
	DockerUser  string            `json:"docker_user,omitempty" yaml:"docker_user,omitempty"`
}