ui

type ChatMessage struct {
	Role      string    `json:"role"` // "user" or "assistant"
	Content   string    `json:"content"`
	Timestamp time.Time `json:"timestamp"`
	Action    string    `json:"action,omitempty"` // resolved cloop command, if any
}

type ExecutorRevocationAnnouncement struct {
	ExecutorID string
	// Op is ExecutorOpCordon, ExecutorOpDrain or ExecutorOpRevoke.
	Op     string
	Reason string
	Actor  string
}

type ExecutorRevocationMemberReport struct {
	Member   string `json:"member"`
	Hostname string `json:"hostname,omitempty"`
	// Refused says why the member did nothing: the store does not record the
	// change the announcement claims.
	Refused string `json:"refused,omitempty"`
	// HoldsSession reports that the device's session is on this member.
	HoldsSession bool `json:"holds_session,omitempty"`
	// Acted reports that this member took the device's leases back: it holds
	// the session, or no live member does and it leads adoption.
	Acted bool `json:"acted,omitempty"`
	// Disconnected reports, for a revoked agent, that this member dropped the
	// session it held.
	Disconnected bool `json:"disconnected,omitempty"`
	// Leases is what each lease came to on this member.
	Leases []LeaseTakeBack `json:"leases,omitempty"`
}

type ExecutorRevocationReport struct {
	// Device is the edge agent whose session serves the executor: the
	// executor itself, or the device a virtual executor runs through. Empty
	// for an executor on the hub itself, whose change takes nothing back and
	// is not announced.
	Device string
	// Recorded are the leases recorded as issued to it, recorded revoked
	// before the announcement.
	Recorded []string
	// Answered are the members' answers; Silent the members alive when it was
	// announced that did not answer within the wait.
	Answered []ExecutorRevocationMemberReport
	Silent   []string
	// Exclusive names a hub holding the control plane alone, which reads no
	// bus; ExclusiveDetail says what it does instead.
	Exclusive       string
	ExclusiveDetail string
	// NoHub: no hub serves this control plane, and the recorded revocations
	// wait for the next to start.
	NoHub bool
	// Leases is what the store records of each recorded lease afterwards.
	Leases []LeaseRevocationState
}

type ForwarderBindingInput struct {
	ForwarderID     string
	Project         string
	VirtualExecutor string
	Interface       forwardedInterface
	TTL             time.Duration
	Note            string
	Actor           string
	RequestID       string
}

type GrantRevocationAnnouncement struct {
	GrantID      string
	Actor        string
	Superseded   bool
	SupersededBy string
}

type GrantRevocationMemberReport struct {
	Member   string
	Hostname string
	// Leases is how many leases gave the grant back there, KeptLeases how many
	// a supersession left standing on the successor.
	Leases     int
	KeptLeases int
	// State is the weakest holder state across them.
	State remote.RevokeState
	// Holders summarises each holder's outcome, one line each.
	Holders []string
}

type GrantRevocationReport struct {
	// Answered are the members that took the grant back from what they hold,
	// with what each did.
	Answered []GrantRevocationMemberReport
	// Silent are the members alive when it was announced that did not answer
	// within the wait.
	Silent []string
	// Exclusive names a hub holding the control plane alone, which reads no
	// bus; Detail says when it finds the revocation anyway.
	Exclusive       string
	ExclusiveDetail string
	// NoHub: no hub serves this control plane, so no workload holds a lease
	// from it.
	NoHub bool
}

type KMSPoll struct {
	Status kms.Status
	Err    string
	At     time.Time
}

type LeaseRevocationState struct {
	LeaseID string
	// Pending: not yet taken back from every holder; Detail says what it
	// waits for.
	Pending    bool
	Detail     string
	EnforcedBy string
}

type LeaseTakeBack struct {
	LeaseID string             `json:"lease_id"`
	State   remote.RevokeState `json:"state"`
	Detail  string             `json:"detail,omitempty"`
}

type Server struct {
	WorkDir  string
	Port     int
	Projects []string // extra project directories for multi-project dashboard

	// RPS and Burst control the per-IP token-bucket rate limiter.
	// Zero values use 20 req/s and burst 50.
	RPS   float64
	Burst int

	// MaxWebSocketConns caps the total number of concurrent WebSocket
	// connections accepted across every remote IP. Zero substitutes
	// config.WebSocketConnsDefault (256). Each accepted upgrade spawns
	// at least three goroutines (handler, drain, ping ticker) plus a
	// hubClient registry entry; without a cap a flood of upgrades can
	// exhaust scheduler resources and the per-project broadcast budget.
	MaxWebSocketConns int

	// MaxWebSocketConnsPerIP caps the number of concurrent WebSocket
	// connections any single remote IP may hold. Zero substitutes
	// config.WebSocketConnsPerIPDefault (8). Reaching the cap causes
	// new upgrades from that IP to be rejected with HTTP 429 and a
	// Retry-After header before websocket.Accept hijacks the response.
	MaxWebSocketConnsPerIP int

	// MaxRequestBodyBytes caps any incoming POST/PUT/PATCH request body
	// the server will accept. Zero substitutes maxJSONBodyBytes (10 MiB).
	// Oversize requests are rejected with HTTP 413 (Request Entity Too
	// Large). Set via config.UIConfig.MaxRequestBodyBytes; bounded by
	// config.MaxRequestBodyBytesLower / Upper. Task 20102.
	MaxRequestBodyBytes int64

	// AllowedWSOrigins lists extra Origin hosts (host or host:port) that may
	// open a WebSocket, in addition to the always-allowed loopback origins
	// and same-origin requests. Needed only when the dashboard sits behind a
	// reverse proxy that rewrites Host so same-origin detection can't see the
	// public hostname. Populated from config.UIConfig.AllowedWSOrigins.
	AllowedWSOrigins []string

	// AllowedOrigins is the deployment-wide origin allowlist: it applies to
	// the dashboard socket AND to the executor-agent endpoint. Populated from
	// config.UIConfig.AllowedOrigins.
	//
	// It is separate from AllowedWSOrigins because the two have different
	// blast radii. An entry here can open an agent connection; an entry in
	// AllowedWSOrigins cannot. Merging them would silently promote every
	// dashboard-scoped origin to the agent endpoint.
	AllowedOrigins []string

	// ExternalURL is what this deployment calls itself, e.g.
	// https://cloop.example.com. Its origin is one of the hub's own for the
	// dashboard, the executor-agent endpoint and the forgery guard, and its
	// host one an open hub answers to (Task 20394). Populated from
	// config.UIConfig.ExternalURL.
	ExternalURL string

	// TrustedProxies is ui.trusted_proxies: the peers whose
	// X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-For are believed,
	// loopback always among them (Task 20394). The zero value is loopback
	// only — a proxy on this machine — which is what the hub trusted before
	// the setting existed, minus the X-Forwarded-Proto it used to take from
	// anyone once ui.external_url was https.
	TrustedProxies sameorigin.Proxies

	// AllowedHosts is ui.allowed_hosts: host names a hub with no sign-in
	// answers to besides localhost, IP addresses, ui.external_url's host and
	// the cluster's advertise hosts. Any other Host is refused (hostGuard).
	AllowedHosts []string

	// ListenHost is the address Run binds, without the port: --listen, else
	// ui.listen. Empty takes the default for this hub's authentication —
	// every interface with OIDC or a Token, 127.0.0.1 without either — and
	// an address beyond loopback on a hub with neither is refused unless
	// AllowUnauthenticatedNetwork is set (Task 20393; pkg/exposure). Run
	// decides before it starts anything, so a refused start leaves nothing
	// running.
	ListenHost string
	// AllowUnauthenticatedNetwork is ui.allow_unauthenticated_network: a hub
	// with no browser credential may bind the address ListenHost names even
	// beyond loopback, and warns at every start that it does.
	AllowUnauthenticatedNetwork bool

	// TLSCertFile / TLSKeyFile enable native HTTPS. Both must be set or
	// neither; Run refuses to start on a half-configuration rather than
	// silently falling back to plaintext. TLSMinVersion is "1.2" (default)
	// or "1.3". Populated from config.UIConfig.TLS or --tls-cert/--tls-key.
	TLSCertFile   string
	TLSKeyFile    string
	TLSMinVersion string

	// SelfExe is the cloop binary this server hands to an executor when a
	// handler needs to run a subcommand (`init`, `run`, `reset`, `do`,
	// `listen`, `suggest`). Empty means os.Executable(), which is correct in
	// production and wrong under `go test`: there os.Executable() is the
	// compiled test binary, so a handler that spawns it re-runs the package's
	// own test suite as a child process with CLI-looking argv. That child
	// passes and is never reported, so the only visible symptom was pkg/ui
	// taking ten minutes — long enough to trip the default per-package test
	// timeout and fail CI. Tests point this at a stub.
	SelfExe string

	// Lease fences this process as the sole control plane for its state.db
	// (Task 20214). Set by `cloop ui` before the server is constructed, so
	// nothing in New — which already reconciles executors and sweeps orphaned
	// sessions — can run against a control plane another hub owns.
	//
	// nil means unfenced, which is what every in-process test wants: each one
	// gets its own temp directory, so there is nothing to fence against, and
	// requiring a lease would make the lifecycle harder to drive without
	// testing anything. Run starts the heartbeat, watches for the lease being
	// lost, and Shutdown releases it; every one of those is nil-safe.
	Lease *hublease.Lease

	// ReadyCheck overrides the readiness check used by /readyz. nil
	// means use defaultReadyCheck (stat state.db, open it, run SELECT 1
	// bounded by ctx). Tests use this field to simulate degraded states
	// like "closed db handle" or "state store not initialized".
	ReadyCheck func(ctx context.Context) error

	// RequireIdP makes a failed identity-provider preflight fatal at startup
	// instead of a warning (ui.oidc.require_idp / --require-idp, Task 20247).
	// Only consulted by PreflightIdP; readiness reports a degraded identity
	// path either way.
	RequireIdP bool

	// Log is the structured logger used for lifecycle / error messages
	// emitted by the UI server itself (panics in HTTP middleware, client
	// JavaScript errors POSTed to /api/client-error, watcher failures).
	// Nil means the package picks a sensible default at first use (text
	// output to stdout, project bound).
	Log logger.Logger

	// OIDC is the optional OpenID Connect authenticator (Task 20152). Nil
	// (the default) means OIDC is disabled and the dashboard behaves
	// exactly as before: token auth if Token is set, otherwise open. Set
	// from ui.oidc.* in .cloop/config.yaml by cmd/ui_cmd.go; when active it
	// gates every route behind an IdP session and scopes the multi-project
	// registry per user (see pkg/ui/oidc.go).
	OIDC *oidcauth.Authenticator

	// Authz resolves OIDC claims to roles and permissions (Task 20164).
	// Nil means "no role mappings configured": every session identity then
	// falls back to the resolver's deny-by-default, which is why
	// authzActive() also requires OIDC to be enabled. With OIDC disabled
	// this field is ignored entirely and every request is granted
	// everything, preserving single-tenant local behavior.
	Authz *authz.Resolver

	// Cluster is this hub's membership of a control plane served by several
	// `cloop ui` processes (Task 20354). Nil means standalone: this process
	// leads, owns everything and publishes nothing, which is also what every
	// test that builds a Server as a struct literal gets. Set by `cloop ui`
	// before New, through NewInCluster, because bootstrap already needs to
	// know whether peers are serving — a startup sweep that assumed it was
	// alone would reap their workloads. See cluster.go.
	Cluster *hubcluster.Node
	// contains filtered or unexported fields
}