platformadmin

type Admin struct {
	ID            string
	Email         string
	PasswordHash  string
	Role          string
	EmailVerified bool
	CreatedAt     time.Time
	UpdatedAt     time.Time
}

type Config struct {
	// JWTSecret signs platform tokens — the SAME engine secret, one signing key.
	JWTSecret string
	// MFAKey encrypts the TOTP secret at rest (falls back to JWTSecret).
	MFAKey string
	// MFAIssuer is the authenticator-app label (default "Appximo Platform").
	MFAIssuer string
	// SuperAdminRole is the role stamped on platform admins (default
	// platform_super_admin). It is a platform marker, not a tenant RBAC role.
	SuperAdminRole string
	// MinPasswordLength for a new admin (default 12 — a privileged credential).
	MinPasswordLength int

	// RoleExists reports whether a role name is declared in the (boot) schema RBAC.
	// Used to validate a role before assigning it to a tenant user (so the admin API
	// returns a clear error instead of creating a user who can never be authorized).
	// nil ⇒ no validation (any role accepted).
	RoleExists func(role string) bool
	// TenantAdminRole reports whether a tenant RBAC role is "admin-grade" — broad
	// enough that a holder may view their OWN tenant's observability. nil ⇒ no tenant
	// user is treated as an observability admin (only the platform super-admin sees
	// observability). Implemented over the boot RBAC policy (inherits RBAC).
	TenantAdminRole func(role string) bool

	// ServedResources is the set of resource names the engine serves LIVE — the REST
	// routes, GraphQL types and RBAC policy are all compiled from the BOOT --schema
	// (codegen.BuildRouter / gqlhandler.BuildHandler / rbac.RBACMiddleware), globally
	// and at boot. A resource deployed to a tenant but ABSENT here gets its tables
	// provisioned by the migration, but its API is unavailable (403 from RBAC deny-by-
	// default, or 404 when a wildcard role passes RBAC but no route exists) until the
	// engine restarts with a schema that includes it. Exposed
	// read-only at GET /admin/served-resources so the editor can honestly warn before
	// a new-resource deploy. Empty ⇒ the route reports an empty set.
	ServedResources []string

	// FlowHandlerFn, when non-nil, supplies the app's LIVE data-plane router for
	// the flow-test runner (FLOWTEST-S1) — flows execute against the real chain
	// (tenant → JWT → RBAC → generated routes), in-process. It is a function
	// because the router is (re)built at boot and on every hot-swap; nil while
	// the engine is still booting ⇒ the run endpoints answer 503.
	FlowHandlerFn func() http.Handler

	// ServedResourcesFn, when non-nil, supplies the LIVE served-resource list and
	// takes precedence over the static ServedResources slice. It exists for the
	// in-process fleet hot-swap (MT-STRUCT-S4): after a per-app hot-swap the served
	// surface changes WITHOUT a process restart, so the editor's post-deploy verify
	// must read the current surface's resources, not the boot list. Single-engine
	// leaves it nil (a deploy re-execs, so the boot slice is authoritative).
	ServedResourcesFn func() []string

	// ActivationFn, when non-nil, reports HOW a schema deploy activates on this
	// engine: "hot_swap" (in-process fleet, MT-STRUCT-S4/S5 — only this app is
	// recompiled and swapped, no downtime) or "restart" (single-engine graceful
	// re-exec, ~6 s). Surfaced in GET /admin/served-resources so the editor's
	// deploy UI describes the real activation instead of always saying "restart".
	// nil ⇒ "restart" (the historical behavior).
	ActivationFn func() string

	// PersistBootSchema validates a schema and ATOMICALLY persists it as the new
	// BOOT schema (the file the engine loads at start), backing up the previous
	// one for rollback (UI-F4-S2). An invalid schema must be reported wrapped in
	// ErrSchemaRejected (→ 422) with NOTHING written. nil ⇒ the engine cannot
	// self-restart (POST /admin/engine/schema answers 503).
	PersistBootSchema func(raw json.RawMessage) error
	// TriggerRestart initiates the engine's graceful self-restart (drain via
	// readyz→503 + http.Server.Shutdown, then relaunch with the persisted
	// schema). Called only AFTER PersistBootSchema succeeded — never with an
	// invalid schema.
	TriggerRestart func()
}

type ObsHandler interface {
	ServeTenantData(w http.ResponseWriter, r *http.Request)
}

type PlatformAuthResult struct {
	Admin       PublicAdmin `json:"admin,omitempty"`
	Token       string      `json:"token,omitempty"`
	MFARequired bool        `json:"mfa_required,omitempty"`
	MFAToken    string      `json:"mfa_token,omitempty"`
}

type PlatformClaims struct {
	AdminID string `json:"aid"`
	Role    string `json:"prole"`
	Scope   string `json:"scope"`
	jwt.RegisteredClaims
}

type PublicAdmin struct {
	ID        string    `json:"id"`
	Email     string    `json:"email"`
	Role      string    `json:"role"`
	CreatedAt time.Time `json:"created_at"`
}

type PublicTenantUser struct {
	ID            string    `json:"id"`
	Email         string    `json:"email"`
	Role          string    `json:"role"`
	EmailVerified bool      `json:"email_verified"`
	Suspended     bool      `json:"suspended"`
	CreatedAt     time.Time `json:"created_at"`
}

type ResourceField struct {
	Name string `json:"name"`
	Type string `json:"type"`
}

type ResourceHandler interface {
	ServeResources(w http.ResponseWriter, r *http.Request)
	ServeResourcesSnapshot(w http.ResponseWriter, r *http.Request)
}

type ResourceInfo struct {
	Name   string          `json:"name"`
	Fields []ResourceField `json:"fields"`
}

type Service struct {
	// contains filtered or unexported fields
}

type Store struct {
	// contains filtered or unexported fields
}

type TenantDetail struct {
	TenantInfo
}

type TenantInfo struct {
	ID            string    `json:"id"`
	DisplayName   string    `json:"display_name"`
	Email         string    `json:"email"`
	Plan          string    `json:"plan"`
	Suspended     bool      `json:"suspended"`
	CreatedAt     time.Time `json:"created_at"`
	ResourceCount int       `json:"resource_count"`
	DataRows      int64     `json:"data_rows"`
	UserCount     int64     `json:"user_count"`
}