controlplane

type AuditEvent struct {
	ID        string    `json:"id"`
	At        time.Time `json:"at"`
	TenantID  string    `json:"tenantId"`
	Subject   string    `json:"subject"`
	SessionID string    `json:"sessionId"`
	Transport string    `json:"transport,omitempty"`
	Tool      string    `json:"tool,omitempty"`
	Action    string    `json:"action"`
	Outcome   string    `json:"outcome"`
	// Phase tags two-phase audit records:
	//   "intent"  — pre-handler write (mutation about to happen)
	//   "outcome" — post-handler write (success/failure of the mutation)
	//   ""        — single-shot record (legacy / no phase concept)
	// Older readers that don't recognise the field will see "" via the
	// JSON omitempty fallback and treat the record as legacy single-shot.
	Phase       string            `json:"phase,omitempty"`
	Reason      string            `json:"reason,omitempty"`
	ResourceIDs map[string]string `json:"resourceIds,omitempty"`
	Metadata    map[string]string `json:"metadata,omitempty"`
}

type CredentialRef struct {
	ID         string            `json:"id"`
	Backend    string            `json:"backend"`
	Reference  string            `json:"reference"`
	Workspace  string            `json:"workspaceId,omitempty"`
	BaseURL    string            `json:"baseUrl,omitempty"`
	Metadata   map[string]string `json:"metadata,omitempty"`
	ModifiedAt time.Time         `json:"modifiedAt,omitempty"`
}

type DevFileStore struct {
	// contains filtered or unexported fields
}

type Opener func(dsn string, opts ...Option) (Store, error)

type Option func(*DevFileStore)

type SessionRecord struct {
	ID              string    `json:"id"`
	TenantID        string    `json:"tenantId"`
	Subject         string    `json:"subject"`
	Transport       string    `json:"transport"`
	ProtocolVersion string    `json:"protocolVersion,omitempty"`
	ClientName      string    `json:"clientName,omitempty"`
	ClientVersion   string    `json:"clientVersion,omitempty"`
	CreatedAt       time.Time `json:"createdAt"`
	ExpiresAt       time.Time `json:"expiresAt"`
	LastSeenAt      time.Time `json:"lastSeenAt"`
	WorkspaceID     string    `json:"workspaceId,omitempty"`
	ClockifyBaseURL string    `json:"clockifyBaseUrl,omitempty"`
}

type State struct {
	Tenants            map[string]TenantRecord              `json:"tenants"`
	CredentialRefs     map[string]CredentialRef             `json:"credential_refs"`
	Sessions           map[string]SessionRecord             `json:"sessions"`
	AuditEvents        []AuditEvent                         `json:"audit_events"`
	ConfirmationNonces map[string]confirmation.ReplayRecord `json:"confirmation_nonces,omitempty"`
}

type Store interface {
	Tenant(id string) (TenantRecord, bool)
	PutTenant(record TenantRecord) error
	CredentialRef(id string) (CredentialRef, bool)
	PutCredentialRef(record CredentialRef) error
	Session(id string) (SessionRecord, bool)
	PutSession(record SessionRecord) error
	DeleteSession(id string) error
	AppendAuditEvent(event AuditEvent) error
	// AppendAuditEventBatch persists a slice of audit events. Semantics
	// are identical to a sequence of AppendAuditEvent calls: same
	// external_id synthesis, same ON CONFLICT-do-nothing dedupe, same
	// per-event error contract. Implementations should consolidate the
	// transport (one round trip on Postgres via pgx.SendBatch) but must
	// not collapse multiple events into a single row. ADR 0022 captures
	// the runtime-layer wrapper that decides which audit events take
	// this path; from the Store's point of view this is just "insert
	// many." An empty slice is a no-op and returns nil.
	AppendAuditEventBatch(events []AuditEvent) error
	// RetainAudit drops audit events older than maxAge and returns the
	// number removed. Called periodically by the retention reaper
	// (B2); maxAge <= 0 is a no-op. Implementations must respect ctx
	// cancellation and must not leave the store in an inconsistent
	// state on partial failure.
	RetainAudit(ctx context.Context, maxAge time.Duration) (int, error)
	// Close releases backend-owned resources (pgxpool, file handles).
	// DevFileStore has nothing to release and returns nil.
	Close() error
}

type TenantRecord struct {
	ID              string            `json:"id"`
	CredentialRefID string            `json:"credentialRefId"`
	WorkspaceID     string            `json:"workspaceId,omitempty"`
	BaseURL         string            `json:"baseUrl,omitempty"`
	Timezone        string            `json:"timezone,omitempty"`
	PolicyMode      string            `json:"policyMode,omitempty"`
	DenyTools       []string          `json:"denyTools,omitempty"`
	DenyGroups      []string          `json:"denyGroups,omitempty"`
	AllowGroups     []string          `json:"allowGroups,omitempty"`
	Metadata        map[string]string `json:"metadata,omitempty"`
}