approvalnotify

type Client struct {
	// contains filtered or unexported fields
}

type Engine struct {
	// contains filtered or unexported fields
}

type Notice struct {
	Event string    `json:"event"`
	At    time.Time `json:"at"`

	// The grant request, for request.* events.
	RequestID   string `json:"request_id,omitempty"`
	RequestedBy string `json:"requested_by,omitempty"`
	SecretName  string `json:"secret_name,omitempty"`
	SecretKind  string `json:"secret_kind,omitempty"`
	Subject     string `json:"subject,omitempty"`
	DecidedBy   string `json:"decided_by,omitempty"`

	// The API token, for token.waiting.
	TokenID   string   `json:"token_id,omitempty"`
	TokenName string   `json:"token_name,omitempty"`
	Roles     []string `json:"roles,omitempty"`
	CreatedBy string   `json:"created_by,omitempty"`

	// Deadline is when the request lapses undecided, or the token expires;
	// zero for a token that never expires.
	Deadline time.Time `json:"deadline,omitempty"`
}

type Options struct {
	// OpenDB opens the control plane's database; the engine closes it.
	OpenDB func() (*statedb.DB, error)
	// Settings reads the configuration in force, per pass.
	Settings func() (Settings, error)
	// Snapshot reads the requests and the waiting tokens.
	Snapshot func(ctx context.Context) (Snapshot, error)
	// LookupEnv reads a webhook's url_env; nil means os.LookupEnv.
	LookupEnv func(name string) (string, bool)
	// Record counts one delivery outcome (hubmetrics).
	Record func(sink, event, outcome string)
	// Now is the clock; nil means time.Now.
	Now func() time.Time
	// Poll is how often a pass runs; zero means DefaultPoll.
	Poll time.Duration
	// Nudge wakes the loop for a pass now.
	Nudge <-chan struct{}
	// OnRecorded is told, once per pass, of the notices that pass recorded
	// for the first time: how the hub announces a lapse, a waiting token or
	// a change made outside its handlers to its dashboards.
	OnRecorded func([]Notice)
	// Logf reports what the operator should know.
	Logf func(format string, args ...any)
}

type SendError struct {
	Status    int
	Permanent bool
	Err       error
}

type Settings struct {
	// Webhooks are the destinations in force, already validated.
	Webhooks []config.NotificationWebhook
	// Link is the dashboard address a message points at; empty for none.
	Link string
}

type Snapshot struct {
	// Requests is every access request; RequestsKnown is false when they
	// could not be read (no secret broker on this hub), so the scan and the
	// staleness check know an absence means nothing.
	Requests      []secretbroker.AccessRequest
	RequestsKnown bool

	// Waiting is the tokens a role policy this hub enforces suspends until
	// approved — empty, and TokensKnown true, on a hub enforcing none.
	Waiting     []TokenInfo
	TokensKnown bool
}

type TokenInfo struct {
	ID        string
	Name      string
	Roles     []string
	CreatedBy string
	CreatedAt time.Time
	ExpiresAt time.Time
}