e2e

type Adoption struct {
	// Allowed is the consent itself. False means empty -> set is refused
	// exactly as it was before adoption existed.
	Allowed bool
	// By is written verbatim into the record as e2e_escrow_adopted_by.
	By string
}

type EscrowKey struct {
	// KID is the first 8 bytes of SHA-256(SPKI) in hex — the short name
	// that appears in every escrow slot and in the boot banner.
	KID string
	// SPKI is the DER public key, base64, exactly as the browser imports it.
	SPKI string
	Bits int
	// contains filtered or unexported fields
}

type Installation struct {
	// E2EEscrowKID is the escrow key id, or "" when escrow is disabled.
	E2EEscrowKID string `json:"e2e_escrow_kid"`
	// E2EEscrowSPKI is the escrow public key, kept so the mirror file is
	// self-contained. It is public material; nothing here is a secret.
	E2EEscrowSPKI string `json:"e2e_escrow_spki,omitempty"`
	E2EEscrowAlg  string `json:"e2e_escrow_alg,omitempty"`
	// PinnedAt / PinnedBy describe the FIRST BOOT and are never rewritten,
	// not even by an adoption. "When was this installation created?" and
	// "when did it gain a second key?" are two questions, and answering the
	// second by overwriting the first would destroy the only record of the
	// installation's own age.
	PinnedAt string `json:"pinned_at,omitempty"`
	PinnedBy string `json:"pinned_by,omitempty"`
	// E2EEscrowAdoptedAt is set only when escrow was turned on AFTER the
	// first boot. Its presence is the whole answer to "was this first-boot
	// or adoption?", and its value is the boundary: folders created before
	// this instant carry no escrow slot and never will.
	E2EEscrowAdoptedAt string `json:"e2e_escrow_adopted_at,omitempty"`
	// E2EEscrowAdoptedBy records HOW consent was given (AdoptedByEnv today).
	E2EEscrowAdoptedBy string `json:"e2e_escrow_adopted_by,omitempty"`
	// E2EEscrowAdoptionNote is written alongside them so the mirror file
	// explains itself to a reader who has never seen this documentation.
	E2EEscrowAdoptionNote string `json:"e2e_escrow_adoption_note,omitempty"`
	// JustAdopted is true only on the boot that PERFORMED the adoption, so
	// that boot can say so once and loudly. It describes this process, not
	// the installation, so it is never written to the record — comparing
	// E2EEscrowAdoptedAt against the boot clock would have been close
	// enough almost always and wrong for a restart inside the same second.
	JustAdopted bool `json:"-"`
}

type InstallationMismatchError struct {
	Setting  string
	Pinned   string
	Supplied string
	DataDir  string
	// Adoptable is true for the one transition that CAN be performed —
	// escrow off -> escrow on — when the operator has not yet said they
	// mean it. The message then explains adoption and its permanent limit
	// instead of only listing the two ways to back out.
	Adoptable bool
}

type NodeByPathLookup interface {
	GetNodeByPath(ctx context.Context, storageID int64, pathHash string) (*model.Node, error)
}

type SettingsStore interface {
	GetSetting(ctx context.Context, key string) (string, error)
	UpsertSetting(ctx context.Context, key, value string) error
}

type TransferGuardError struct {
	Source string
	Dest   string
	Reason error
}