broker

type Broker struct {
	// contains filtered or unexported fields
}

type ErrApprovalDenied struct {
	ApprovalID uuid.UUID
	Reason     string
}

type ErrApprovalPending struct {
	ApprovalID uuid.UUID
}

type FakeGitHubMinter struct {

	// Token/Expiry returned by MintInstallationToken (Expiry defaults to +1h).
	Token  string
	Expiry time.Time
	// Err, if set, is returned (to exercise the failure-audit path).
	Err error

	// Captured inputs from the last call.
	LastRepos       []string
	LastPermissions map[string]string
	LastTTL         time.Duration
	Calls           int

	// RefRulesetConfined/Detail/Err drive VerifyRefRuleset. The zero value
	// answers "not confined", which is the honest default for a fake with no
	// GitHub behind it — a test that wants the WARDYN_GITHUB_REQUIRE_REF_RULESET
	// gate to PASS has to say so.
	RefRulesetConfined bool
	RefRulesetDetail   string
	RefRulesetErr      error
	// LastVerifiedRepos records every repo VerifyRefRuleset was asked about.
	LastVerifiedRepos []string

	// Revoked counts Revoke calls and RevokedTokens records what was handed
	// back, so a test can assert BOTH that every discarded token was revoked
	// (Revoked == Calls-1 on a lost race) and that the RETURNED one was not.
	Revoked       int
	RevokedTokens []string
	// RevokeErr, if set, is returned by Revoke — the best-effort contract says
	// a failed revoke must not change the caller's own error.
	RevokeErr error
	// contains filtered or unexported fields
}

type GitHubMinter interface {
	MintInstallationToken(ctx context.Context, repos []string, permissions map[string]string, ttl time.Duration) (token string, expiresAt time.Time, err error)
	// VerifyRefRuleset reports whether GitHub itself confines this App's writes
	// on repo ("owner/name") to refNamespaceGlob, plus an operator-readable
	// detail. A non-nil error means UNKNOWN (network, rate limit, permission
	// refused, a bypass mode that could not be read) and must never be rendered
	// as "unconfined". It is on the
	// interface rather than an optional type assertion because
	// WARDYN_GITHUB_REQUIRE_REF_RULESET turns the answer into a mint gate: an
	// implementation that silently answered "confined" would open the gate it
	// was supposed to close. The compiler must ask.
	VerifyRefRuleset(ctx context.Context, repo string) (confined bool, detail string, err error)
	// Revoke hands a minted installation token back to GitHub
	// (Apps.RevokeInstallationToken — the call VerifyRefRuleset in ruleset.go already makes
	// for its probe token). It exists for the mint() arms that mint a REAL token
	// and then DISCARD it: the lost single-use race, a failed minted_jti write,
	// a failed audit insert, a failed commit. Such a token is live for GitHub's
	// full ~1h with NO credential.mint jti behind it, so mintedCredentialsSQL
	// cannot see it and RevokeRun cannot reach it — this call is the only door
	// back. Best effort at every call site: a failed revoke must never change
	// the error the caller is already getting. It is on the interface rather
	// than an optional type assertion for the same reason VerifyRefRuleset is —
	// a minter that silently did nothing would leave the discard doors leaking
	// exactly as they leaked before, and the compiler must ask.
	Revoke(ctx context.Context, token string) error
}

type GitHubMinterConfig struct {
	// AppIDSecret is the secretstore name holding the numeric App ID (ASCII).
	AppIDSecret string
	// PrivateKeySecret is the secretstore name holding the PEM private key.
	PrivateKeySecret string
}

type Minted struct {
	Kind       types.GrantKind `json:"kind"`
	JTI        string          `json:"jti"`
	ExpiresAt  time.Time       `json:"expires_at"`
	GrantID    uuid.UUID       `json:"grant_id"`
	ApprovalID uuid.UUID       `json:"approval_id,omitempty"`
	// Token is the bearer credential for github_token, the stored PAT VALUE for
	// git_pat, or the stored PRIVATE KEY material for ssh_key. Empty for api_key
	// (whose value never leaves the broker).
	Token string `json:"token,omitempty"`
	// Username is the git username to pair with Token for git_pat (ADO=pat,
	// GitLab=oauth2, or an explicit override) or ssh_key (default "git"). Empty for
	// github_token (the helper uses x-access-token) and api_key.
	Username string `json:"username,omitempty"`
	// KnownHosts is the OpenSSH known_hosts material for an ssh_key grant whose
	// scope named a known_hosts_secret_ref. Empty otherwise (ssh_key runs fall back
	// to the image-baked /etc/ssh/ssh_known_hosts for github.com / ADO). Nominally
	// public host-key data, not a secret — but mask-registered by mint() anyway
	// (W12-B-2), as defense in depth: storedSecretGrantPairing (internal/api)
	// now pins a MEMBER's known_hosts_secret_ref to exactly the operator's own
	// ceiling pairing, but an unclamped (operator-authored) grant could still
	// name an unexpected secret here, and this was the one mint output never
	// mask-registered at all.
	KnownHosts string `json:"known_hosts,omitempty"`
	// Injection is the proxy-side rule for api_key. Nil for github_token/git_pat.
	Injection *egress.InjectionRule `json:"injection,omitempty"`
	// Metadata carries kind-specific, non-secret context (e.g. github_token
	// branch namespace, repos, clamped permissions).
	Metadata map[string]string `json:"metadata,omitempty"`
}

type MintedCredential struct {
	JTI  string
	Kind string
}

type PgxStore struct {
	Pool *pgxpool.Pool
}

type Querier interface {
	QueryRow(ctx context.Context, sql string, args ...any) Row
	// Exec runs a statement and returns the number of rows affected. Rows
	// affected is load-bearing for the single-use guard: a 0-row conditional
	// `UPDATE approvals SET minted_jti ... WHERE minted_jti=”` means another
	// mint won the race, so the caller fails closed. pgx's CommandTag is the
	// source; the fake mirrors its rows-affected semantics.
	Exec(ctx context.Context, sql string, args ...any) (int64, error)
}

type Row interface {
	Scan(dest ...any) error
}

type Tx interface {
	Querier
	Commit(ctx context.Context) error
	Rollback(ctx context.Context) error
}

type TxBeginner interface {
	// BeginReadCommitted starts a transaction pinned to READ COMMITTED. It is
	// the ONLY transaction start on this seam — there is deliberately no bare
	// Begin for a new call site to reach for, because every transaction the
	// broker opens either writes an audit row itself (mint) or holds grant /
	// approval rows a mint tx will join.
	BeginReadCommitted(ctx context.Context) (Tx, error)
	MintedCredentials(ctx context.Context, runID uuid.UUID) ([]MintedCredential, error)
}