appstore

type Answer struct {
	Result       string     `json:"result"`
	App          string     `json:"app"`
	Licensee     string     `json:"licensee,omitempty"`
	Seats        *int       `json:"seats,omitempty"`
	SeatsUsed    *int       `json:"seats_used,omitempty"`
	ValidUntil   *time.Time `json:"valid_until,omitempty"`
	UpdatesUntil *time.Time `json:"updates_until,omitempty"`
	InstanceID   string     `json:"instance_id"`
	CheckedAt    time.Time  `json:"checked_at"`
	NextCheckBy  time.Time  `json:"next_check_by"`
	GraceUntil   time.Time  `json:"grace_until"`
}

type AppView struct {
	Status       string     `json:"status"`
	ValidUntil   *time.Time `json:"valid_until,omitempty"`
	UpdatesUntil *time.Time `json:"updates_until,omitempty"`
}

type Catalog struct {
	Store     string       `json:"store"`
	Serial    int64        `json:"serial"`
	FetchedAt time.Time    `json:"fetched_at"`
	Stale     bool         `json:"stale"`
	Apps      []CatalogApp `json:"apps"`
	// contains filtered or unexported fields
}

type CatalogApp struct {
	Name              string            `json:"name"`
	Kind              string            `json:"kind"`
	Label             map[string]string `json:"label"`
	Summary           map[string]string `json:"summary,omitempty"`
	Publisher         string            `json:"publisher"`
	PublisherVerified bool              `json:"publisher_verified,omitempty"`
	PublisherOfficial bool              `json:"publisher_official,omitempty"`
	Categories        []string          `json:"categories"`
	Repo              string            `json:"repo"`
	Version           string            `json:"version"`
	PublishedAt       string            `json:"published_at,omitempty"`
	FilexRange        string            `json:"filex_range"`
	Permissions       []string          `json:"permissions"`
	Icon              string            `json:"icon,omitempty"`
	// A storage plugin (Kind == KindStorage, #215): the platforms the store
	// pinned a build for, and its plugin validator's run.
	Platforms   []string     `json:"platforms,omitempty"`
	Conformance *Conformance `json:"conformance,omitempty"`
	// The pins of that version, frozen with a request made from it (never
	// sent to the browser). Builds: a storage plugin's, platform → sha256.
	ManifestSHA256 string            `json:"-"`
	WasmSHA256     string            `json:"-"`
	UISHA256       string            `json:"-"`
	Builds         map[string]string `json:"-"`
}

type Client struct {
	HTTP  *http.Client
	Guard *netguard.Policy
	// UserAgent names this filex.
	UserAgent string
}

type Conformance struct {
	Platform     string   `json:"platform"`
	Filex        string   `json:"filex"`
	Verified     bool     `json:"verified"`
	Passed       int      `json:"passed"`
	Failed       int      `json:"failed"`
	Skipped      int      `json:"skipped"`
	Driver       string   `json:"driver,omitempty"`
	Capabilities []string `json:"capabilities"`
}

type ConnectionView struct {
	Store           string    `json:"store"`
	Connected       bool      `json:"connected"`
	InstanceID      string    `json:"instance_id,omitempty"`
	KeyFingerprint  string    `json:"key_fingerprint,omitempty"`
	ConnectedAt     time.Time `json:"connected_at,omitempty"`
	ConnectedByName string    `json:"connected_by_name,omitempty"`
}

type Envelope struct {
	Payload   json.RawMessage `json:"payload"`
	KeyID     string          `json:"key_id"`
	Signature string          `json:"signature"`
}

type Error struct {
	Code    string         `json:"error"`
	Message string         `json:"message"`
	Detail  map[string]any `json:"detail,omitempty"`
}

type Holder interface {
	SetLicenseHold(app, reason string)
}

type Intent struct {
	Store          string    `json:"store"`
	TokenID        string    `json:"token_id"`
	App            string    `json:"app"`
	Kind           string    `json:"kind"`
	Version        string    `json:"version"`
	Repo           string    `json:"repo"`
	Ref            string    `json:"ref"`
	Commit         string    `json:"commit"`
	ManifestSHA256 string    `json:"manifest_sha256"`
	WasmSHA256     string    `json:"wasm_sha256,omitempty"`
	UISHA256       string    `json:"ui_sha256,omitempty"`
	Permissions    []string  `json:"permissions"`
	FilexRange     string    `json:"filex_range"`
	Paid           bool      `json:"paid"`
	LicenseKey     string    `json:"license_key,omitempty"`
	ExpiresAt      time.Time `json:"expires_at"`
	// FilexOrigin is the filex the link was made for (the store signs it):
	// another filex refuses the link (CodeWrongInstance). That stops a link
	// opened by mistake on the wrong filex, and a link sent to an
	// administrator of another filex to get an app installed there. It is
	// no protection against the administrator of the filex receiving it:
	// without FILEX_PUBLIC_URL the filex's own origin is the request's Host
	// (and X-Forwarded-Proto), which that person controls.
	FilexOrigin string `json:"filex_origin"`

	// A storage plugin's link (Kind == KindStorage, #215): the release's feed
	// the store reviewed (its sha256 is ManifestSHA256), every build by
	// platform with the store's artifact signature over the build (its name,
	// version, platform and sha256 - plugin.VerifyBuild), and what
	// the store's plugin validator measured. Absent for an app.
	FeedURL     string                 `json:"feed_url,omitempty"`
	Binaries    map[string]IntentBuild `json:"binaries,omitempty"`
	Conformance *Conformance           `json:"conformance,omitempty"`
}

type IntentBuild struct {
	URL    string `json:"url"`
	SHA256 string `json:"sha256"`
	Size   int64  `json:"size,omitempty"`
	// Sig is the store's artifact key's signature over the build's text -
	// the link's app and version, this platform, SHA256 (plugin.BuildClaim):
	// what FILEX_PLUGIN_TRUSTED_KEYS checks when it lists that key.
	Sig string `json:"sig"`
}

type Key struct {
	ID      string `json:"id"`
	Use     string `json:"use"`
	Ed25519 string `json:"ed25519"`
	Status  string `json:"status,omitempty"`
}

type KeySet struct {
	Keys []Key `json:"keys"`
}

type KeyView struct {
	ID          string `json:"id"`
	Use         string `json:"use"`
	Status      string `json:"status,omitempty"`
	Fingerprint string `json:"fingerprint"`
}

type License struct {
	// App is the row's id: the app's name, or "storage:<name>" for a storage
	// plugin (LicenseID).
	App string `json:"app"`
	// StoreApp is what the store calls the entry when it is not App (a
	// storage plugin's name, without the prefix): what a check names.
	StoreApp  string `json:"store_app,omitempty"`
	Store     string `json:"store"`
	KeySealed string `json:"key_sealed,omitempty"`
	KeyPrefix string `json:"key_prefix,omitempty"`
	// Last is the store's last signed answer (any result); LastValid the
	// last one that said valid. Kept whole: the signature travels with them.
	Last      *Envelope `json:"last,omitempty"`
	LastValid *Envelope `json:"last_valid,omitempty"`
	// LastAttemptAt / LastError: the last check, when it did not end in a
	// signed answer (the store unreachable, a bad answer). Cleared by one
	// that did.
	LastAttemptAt time.Time `json:"last_attempt_at,omitempty"`
	LastSuccessAt time.Time `json:"last_success_at,omitempty"`
	LastError     string    `json:"last_error,omitempty"`
	LastErrorCode string    `json:"last_error_code,omitempty"`
	// Status is the last status decided, for telling a change (audit).
	Status    string    `json:"status,omitempty"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type LicenseRequest struct {
	Key          string `json:"key"`
	App          string `json:"app"`
	InstanceID   string `json:"instance_id"`
	FilexVersion string `json:"filex_version,omitempty"`
}

type Mismatch struct {
	Field  string `json:"field"`
	Link   string `json:"link"`
	Source string `json:"source"`
}

type Options struct {
	Store  StateStore
	Client *Client
	// Box seals license keys (the installation's FILEX_SECRET_KEY). Without a
	// key a license cannot be kept, and a paid app is refused at install.
	Box *secretbox.Box
	// Loopback admits a store on this machine over plain http
	// (FILEX_PLUGIN_LOOPBACK_SOURCES): development and tests.
	Loopback bool
	// ConfigStores (FILEX_APP_STORE_URLS) are stores the operator trusts by
	// configuration; ConfigKeys (FILEX_APP_STORE_KEYS) the keys they sign
	// with. A configured store is never put to an administrator: its keys are
	// these, and a key that is not among them is refused.
	ConfigStores []string
	ConfigKeys   []string
	// ConfigStoresSet: FILEX_APP_STORE_URLS was given a value, also one that
	// names no store - the allow list is in force either way.
	ConfigStoresSet bool
	FilexVersion    string
	Holder          Holder
	Log             *slog.Logger
	// Now is the wall clock and Mono the time elapsed since start on a
	// monotonic clock - for tests; zero values are the real clocks.
	Now  func() time.Time
	Mono func() time.Duration
}

type Pending struct {
	Handle  string
	Origin  string
	Token   string
	Intent  *Intent
	UserID  int64
	Created time.Time
	// RequestID is the plugin request (pluginreq) the link was asked for by
	// an approval in the embedded store (RequestFor); 0 for a magic link.
	RequestID int64
	// LegacySignature: the storage plugin's build was taken with a
	// signature in the old sha256-only form (plugin.VerifyBuild; accepted
	// with a warning while plugin.LegacySignatureWindow runs). Finish says so
	// in the audit row.
	LegacySignature bool
}

type RequestedIntent struct {
	Store     string    `json:"store"`
	Token     string    `json:"token"`
	TokenID   string    `json:"token_id"`
	App       string    `json:"app"`
	Version   string    `json:"version"`
	ExpiresAt time.Time `json:"expires_at"`
}

type Service struct {
	// contains filtered or unexported fields
}

type Source struct {
	ManifestBytes []byte
	Name          string
	Version       string
	Kind          string
	// DeclaredPermissions is the manifest's own `permissions` list (not the
	// ones filex derives from its interface).
	DeclaredPermissions []string
	WasmSHA256          string // the manifest's wasm.sha256 (the module filex fetched hashes to it)
	UISHA256            string // the manifest's ui.bundle.sha256
}

type StateStore interface {
	GetAppStoreState(ctx context.Context, key string) (string, bool, error)
	PutAppStoreState(ctx context.Context, key, value string) error
	DeleteAppStoreState(ctx context.Context, key string) (bool, error)
	ListAppStoreState(ctx context.Context, prefix string) (map[string]string, error)
	InsertAuditEntry(ctx context.Context, e *model.AuditEntry) error
}

type Trust struct {
	Origin         string    `json:"origin"`
	Keys           []Key     `json:"keys"`
	Source         string    `json:"source"`
	ApprovedBy     *int64    `json:"approved_by,omitempty"`
	ApprovedByName string    `json:"approved_by_name,omitempty"`
	ApprovedAt     time.Time `json:"approved_at"`
	// UpdatedAt: when the key list last narrowed by itself (a key retired or
	// gone at the store) or a status moved (next → active).
	UpdatedAt time.Time `json:"updated_at,omitempty"`
}

type TrustView struct {
	Origin         string    `json:"origin"`
	Source         string    `json:"source"`
	Keys           []KeyView `json:"keys"`
	ApprovedByName string    `json:"approved_by_name,omitempty"`
	ApprovedAt     time.Time `json:"approved_at,omitempty"`
}

type Undo struct {
	// contains filtered or unexported fields
}

type View struct {
	// App is the license's id (LicenseID): an app's name, or
	// "storage:<name>"; Name is the entry's own name and Kind "storage" for a
	// storage plugin ("" for an app), so a screen never reads the id.
	App           string     `json:"app"`
	Name          string     `json:"name,omitempty"`
	Kind          string     `json:"kind,omitempty"`
	Required      bool       `json:"required"`
	Status        string     `json:"status"`
	Held          bool       `json:"held"`
	Store         string     `json:"store,omitempty"`
	KeyPrefix     string     `json:"key_prefix,omitempty"`
	Licensee      string     `json:"licensee,omitempty"`
	Seats         *int       `json:"seats,omitempty"`
	SeatsUsed     *int       `json:"seats_used,omitempty"`
	ValidUntil    *time.Time `json:"valid_until,omitempty"`
	UpdatesUntil  *time.Time `json:"updates_until,omitempty"`
	CheckedAt     *time.Time `json:"checked_at,omitempty"`
	NextCheckBy   *time.Time `json:"next_check_by,omitempty"`
	GraceUntil    *time.Time `json:"grace_until,omitempty"`
	LastAttemptAt *time.Time `json:"last_attempt_at,omitempty"`
	LastErrorCode string     `json:"last_error_code,omitempty"`
	LastError     string     `json:"last_error,omitempty"`
	// StoreTrusted: false when the store that issued the license is no
	// longer trusted here (it cannot be asked any more).
	StoreTrusted bool `json:"store_trusted"`
}

type ViewSettings struct {
	Enabled bool `json:"enabled"`
	// Stores are the trusted stores it shows, in this order; a store no
	// longer trusted is left out when it is read.
	Stores   []string `json:"stores"`
	Audience string   `json:"audience"`
	// Roles (AudienceRoles) are built-in role names; Groups (AudienceGroups)
	// group ids. A person sees the screen when they hold one of the roles or
	// are in one of the groups.
	Roles         []string  `json:"roles"`
	Groups        []int64   `json:"groups"`
	UpdatedAt     time.Time `json:"updated_at,omitempty"`
	UpdatedByName string    `json:"updated_by_name,omitempty"`
}