provision

type Actor struct {
	CredentialID string
	Name         string
}

type AdminContext struct {
	Actor  string
	Reason string
	// Via is cli or ui; OSUser the shell user for a CLI change.
	Via    string
	OSUser string
}

type Config struct {
	// MatchClaim says which claim a provisioned user is matched against.
	MatchClaim MatchClaim
	// OffboardAfter is how long a user stays suspended before the full
	// offboarding runs. Zero never runs it: only a DELETE does.
	OffboardAfter time.Duration
}

type Directory struct {
	// contains filtered or unexported fields
}

type DirectoryOption func(*Directory)

type DirectoryStats struct {
	Version     int64 `json:"version"`
	Users       int   `json:"users"`
	Active      int   `json:"active"`
	Inactive    int   `json:"inactive"`
	Groups      int   `json:"groups"`
	Memberships int   `json:"memberships"`
	// Unmatchable users carry no value for the match claim, and so are no
	// hub identity at all; Ambiguous users share their value with another.
	Unmatchable int `json:"unmatchable"`
	Ambiguous   int `json:"ambiguous"`
}

type Hub interface {
	// Collaborators returns what an offboarding reaches in this hub process
	// — its live sessions, leases, tasks, project registry, secret store and
	// Claude homes — for the control plane db. DB, Identity, Target, Reason,
	// Actor and Via are the caller's to set.
	Collaborators(db *statedb.DB) offboard.Options
	// Severed is told, after a change committed, what it ended or restored
	// behind the hub's caches, so the hub — and its other members — stop
	// honouring it now rather than at their next refresh.
	Severed(Severance)
	// DirectoryChanged is told after every committed directory change.
	DirectoryChanged()
}

type MatchClaim string

type Minted struct {
	Row       statedb.SCIMCredentialRow
	Plaintext string
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type Result struct {
	// Status is the HTTP status.
	Status int
	// Resource is the representation returned, nil for 204.
	Resource map[string]any
	// Location is the resource's URL, for a 201.
	Location string
	// Version is the resource's version, for the ETag header; 0 for none.
	Version int64
}

type Service struct {
	DB        *statedb.DB
	Config    Config
	Directory *Directory
	Hub       Hub
	// Now is the clock; nil is time.Now.
	Now func() time.Time
	// contains filtered or unexported fields
}

type Severance struct {
	Actor string
	// RoleBindings: deny bindings were written or lifted.
	RoleBindings bool
	// Tokens are API tokens and glasses links revoked in the transaction.
	Tokens []string
	// Sessions are session rows deleted in the transaction — only on a hub
	// with no running authenticator, which otherwise ends them itself.
	Sessions []string
	// GrantsSuspended and GrantsResumed are grants over the person's
	// personal secrets.
	GrantsSuspended []string
	GrantsResumed   []string
	// Offboard is the report of a full offboarding, when one ran.
	Offboard *offboard.Report
}

type Verified struct {
	Actor Actor
	// Previous reports that the secret presented is the one a rotation
	// replaced, still inside its grace period.
	Previous bool
}

type Verifier struct {
	DB  *statedb.DB
	Now func() time.Time
	// contains filtered or unexported fields
}