pluginapi

type AbortPolicy string

type AccountListRequest struct {
	Snapshot RequestSnapshot
	Runtime  RuntimeContext
	Username string
}

type AccountListResult struct {
	Status   *StatusMessage
	Accounts []string
	Facts    []PolicyFact
}

type ArgsView interface {
	Get(path string) (any, bool)
	GetPath(path []string) (any, bool)
	Sub(path string) ArgsView
	SubPath(path []string) ArgsView
	Decode(target any) error
	IsZero() bool
}

type AttributeCategory string

type AttributeDefinition struct {
	Details     map[string]DetailDefinition
	ID          string
	Description string
	Stage       PolicyStage
	Operations  []PolicyOperation
	// ProducerTypes names compatible policy check types, such as "plugin.environment",
	// that may emit this attribute when such a check is active in the compiled policy.
	ProducerTypes []string
	// ProducerCheck names one compiled policy check that must be active before this
	// attribute may be consumed. It is a host-owned policy check name, not a plugin
	// component ID such as "module.component".
	ProducerCheck string
	Category      AttributeCategory
	Type          AttributeType
}

type AttributePatch struct {
	Set    map[string][]string
	Delete []string
}

type AttributeType string

type Backend interface {
	Name() string
	VerifyPassword(context.Context, BackendAuthRequest) (BackendResult, error)
	ListAccounts(context.Context, AccountListRequest) (AccountListResult, error)
}

type BackendAuthRequest struct {
	Snapshot    RequestSnapshot
	Runtime     RuntimeContext
	Credentials CredentialProvider
	Username    string
}

type BackendIdentityResult struct {
	UniqueUserIDField       string
	DisplayNameField        string
	TOTPSecretField         string
	TOTPRecoveryField       string
	Groups                  []string
	GroupDistinguishedNames []string
}

type BackendResult struct {
	Status        *StatusMessage
	Attributes    map[string][]string
	Facts         []PolicyFact
	Identity      BackendIdentityResult
	Account       string
	AccountField  string
	BackendServer *BackendServerRef
	Authenticated bool
	UserFound     bool
}

type BackendResultPatch struct {
	SelectedBackend *BackendServerRef
	Attributes      AttributePatch
	Authenticated   *bool
	UserFound       *bool
	Account         string
	AccountField    string
}

type BackendServerCandidate struct {
	Name      string
	Protocol  string
	Authority string
	Address   string
	Port      int
	HAProxyV2 bool
	Alive     bool
}

type BackendServerRef struct {
	Name      string
	Protocol  string
	Authority string
	Address   string
	Port      string
}

type BackendServers interface {
	List(context.Context) []BackendServerCandidate
}

type BuildInfo struct {
	BuildTags []string
	GoVersion string
	GitCommit string
	BuildTime string
}

type Cache interface {
	Set(context.Context, string, any, time.Duration)
	Get(context.Context, string) (any, bool)
	Delete(context.Context, string) bool
	Exists(context.Context, string) bool
	Push(context.Context, string, any) int
	PopAll(context.Context, string) []any
	Clear(context.Context)
}

type Capability string

type ConfigView interface {
	Get(path string) (any, bool)
	GetPath(path []string) (any, bool)
	Sub(path string) ConfigView
	SubPath(path []string) ConfigView
	Decode(target any) error
	IsZero() bool
}

type ConnectionTarget struct {
	Labels      map[string]string
	Name        string
	Address     string
	Description string
	Direction   ConnectionTargetDirection
}

type ConnectionTargetDirection string

type ConnectionTargets interface {
	Register(context.Context, ConnectionTarget) error
	Count(context.Context, string) (int, bool)
}

type Counter interface {
	Add(context.Context, float64, ...LabelValue)
}

type CredentialProvider interface {
	Password(context.Context) (Secret, bool)
}

type DebugModuleDefinition struct {
	Name        string
	Description string
}

type DetailDefinition struct {
	Type        AttributeType
	Sensitivity DetailSensitivity
	Purpose     string
	MaxLength   int
}

type DetailSensitivity string

type DeterministicHelpers interface {
	AccountTag(string) string
	CountryName(string) string
	ScopedIP(string, string) string
	IsRoutableIP(string) bool
}

type EnvironmentRequest struct {
	Snapshot    RequestSnapshot
	Runtime     RuntimeContext
	Credentials CredentialProvider
}

type EnvironmentResult struct {
	Status       *StatusMessage
	Logs         []LogField
	Facts        []PolicyFact
	RuntimeDelta RuntimeDelta
	Triggered    bool
	Abort        bool
}

type EnvironmentSource interface {
	Descriptor() SourceDescriptor
	Evaluate(context.Context, EnvironmentRequest) (EnvironmentResult, error)
}

type Feature string

type Gauge interface {
	Set(context.Context, float64, ...LabelValue)
	Add(context.Context, float64, ...LabelValue)
}

type HTTPClient interface {
	Do(context.Context, HTTPRequest) (HTTPResponse, error)
}

type HTTPRequest struct {
	Headers          map[string][]string
	Body             []byte
	Method           string
	URL              string
	Service          string
	Timeout          time.Duration
	MaxResponseBytes int64
}

type HTTPResponse struct {
	Headers    map[string][]string
	Body       []byte
	StatusCode int
}

type Histogram interface {
	Observe(context.Context, float64, ...LabelValue)
}

type Hook interface {
	Descriptor() HookDescriptor
	Serve(context.Context, HookRequest) (HookResponse, error)
}

type HookAuth string

type HookDescriptor struct {
	RequiredScopes []string
	Timeout        time.Duration
	Name           string
	Method         string
	Path           string
	Alias          string
	Scope          HookScope
	Auth           HookAuth
	MaxBodyBytes   int64
}

type HookRequest struct {
	Snapshot RequestSnapshot
	Headers  map[string][]string
	Query    map[string][]string
	Body     []byte
	Path     string
	Method   string
}

type HookResponse struct {
	Headers    map[string][]string
	Body       []byte
	StatusCode int
}

type HookScope string

type Host interface {
	ServiceContext() context.Context
	Logger(scope string) Logger
	Tracer(scope string) Tracer
	CompatibilityTracer(scope string) (Tracer, error)
	Metrics(scope string) Metrics
	HTTP(scope string) HTTPClient
	Mail(scope string) Mailer
	ConnectionTargets(scope string) ConnectionTargets
	BackendServers() BackendServers
	Redis() Redis
	Cache(scope string) (Cache, error)
	Helpers() DeterministicHelpers
	LDAP() LDAP
	Config() ConfigView
	Go(ctx context.Context, name string, fn func(context.Context) error)
}

type IDPInfo struct {
	RequestedScopes         []string
	UserGroups              []string
	AllowedClientScopes     []string
	AllowedClientGrantTypes []string
	GrantType               string
	ClientID                string
	ClientName              string
	RedirectURI             string
	MFAMethod               string
	MFACompleted            bool
}

type InitContext struct {
	Host   Host
	Config ConfigView
}

type InitTask interface {
	Name() string
	Start(context.Context, InitContext) error
	Stop(context.Context) error
}

type LDAP interface {
	Search(context.Context, LDAPSearchRequest) (LDAPSearchResult, error)
	Modify(context.Context, LDAPModifyRequest) error
	Endpoints(context.Context, string) ([]LDAPEndpoint, error)
}

type LDAPEndpoint struct {
	PoolName string
	Scheme   string
	Host     string
	Port     int
}

type LDAPEntry struct {
	Attributes map[string][]string
	DN         string
}

type LDAPModifyOperation string

type LDAPModifyRequest struct {
	Attributes map[string][]string
	PoolName   string
	DN         string
	Operation  LDAPModifyOperation
}

type LDAPScope string

type LDAPSearchRequest struct {
	Attributes []string
	PoolName   string
	BaseDN     string
	Filter     string
	Scope      LDAPScope
}

type LDAPSearchResult struct {
	Attributes map[string][]string
	Entries    []LDAPEntry
}

type LabelValue struct {
	Name  string
	Value string
}

type LogField struct {
	Key   string
	Value any
}

type Logger interface {
	Debug(context.Context, string, ...LogField)
	Info(context.Context, string, ...LogField)
	Warn(context.Context, string, ...LogField)
	Error(context.Context, string, ...LogField)
}

type MailMessage struct {
	To       []string
	Server   string
	HeloName string
	Username string
	Password string
	From     string
	Subject  string
	Body     string
	Port     int
	TLS      bool
	StartTLS bool
	LMTP     bool
}

type Mailer interface {
	Send(context.Context, MailMessage) error
}

type Metadata struct {
	Build        BuildInfo
	Name         string
	Version      string
	APIVersion   string
	Description  string
	DocsURL      string
	Features     []Feature
	Capabilities []Capability
}

type MetricDefinition struct {
	Buckets []float64
	Labels  []string
	Name    string
	Help    string
	Type    MetricType
	// Compatibility requests an operator-allowlisted exact legacy collector in addition to the native metric.
	Compatibility bool
}

type MetricType string

type Metrics interface {
	Counter(MetricDefinition) (Counter, error)
	Gauge(MetricDefinition) (Gauge, error)
	Histogram(MetricDefinition) (Histogram, error)
	Summary(MetricDefinition) (Summary, error)
}

type ObligationRequest struct {
	Snapshot RequestSnapshot
	Runtime  RuntimeContext
	Args     ArgsView
	Facts    []PolicyFact
}

type ObligationResult struct {
	Status       *StatusMessage
	Logs         []LogField
	Facts        []PolicyFact
	Response     ResponseMutation
	RuntimeDelta RuntimeDelta
	Applied      bool
	Temporary    bool
}

type ObligationTarget interface {
	Name() string
	Execute(context.Context, ObligationRequest) (ObligationResult, error)
}

type Plugin interface {
	Metadata() Metadata
	Register(Registrar) error
}

type PolicyDecision string

type PolicyFact struct {
	Attribute string
	Value     any
}

type PolicyOperation string

type PolicyStage string

type PostActionEnqueueResult struct {
	Status       *StatusMessage
	Logs         []LogField
	RuntimeDelta RuntimeDelta
	QueuedID     string
	Enqueued     bool
	Temporary    bool
}

type PostActionRequest struct {
	Snapshot     RequestSnapshot
	Runtime      RuntimeContext
	Credentials  CredentialProvider
	PasswordHash string
	Args         ArgsView
	Facts        []PolicyFact
}

type PostActionTarget interface {
	Name() string
	Enqueue(context.Context, PostActionRequest) (PostActionEnqueueResult, error)
}

type PublicMFAStateBackend interface {
	PublicMFAState(context.Context, PublicMFAStateRequest) (PublicMFAStateResult, error)
}

type PublicMFAStateRequest struct {
	Snapshot        RequestSnapshot
	Runtime         RuntimeContext
	Username        string
	IncludeWebAuthn bool
}

type PublicMFAStateResult struct {
	Status              *StatusMessage
	BackendServer       *BackendServerRef
	WebAuthnCredentials []WebAuthnCredential
	RecoveryCodeCount   int
	HasTOTP             bool
	HasWebAuthn         bool
}

type RecoveryCodeBackend interface {
	GenerateRecoveryCodes(context.Context, RecoveryCodeGenerateRequest) (RecoveryCodeGenerateResult, error)
	UseRecoveryCode(context.Context, RecoveryCodeUseRequest) (RecoveryCodeUseResult, error)
	DeleteRecoveryCodes(context.Context, RecoveryCodeDeleteRequest) error
}

type RecoveryCodeDeleteRequest struct {
	Snapshot       RequestSnapshot
	Runtime        RuntimeContext
	IdempotencyKey string
	Username       string
}

type RecoveryCodeGenerateRequest struct {
	Snapshot       RequestSnapshot
	Runtime        RuntimeContext
	IdempotencyKey string
	Username       string
	Count          uint32
}

type RecoveryCodeGenerateResult struct {
	Status        *StatusMessage
	BackendServer *BackendServerRef
	Codes         []string
}

type RecoveryCodeUseRequest struct {
	Snapshot       RequestSnapshot
	Runtime        RuntimeContext
	IdempotencyKey string
	Username       string
	Code           string
}

type RecoveryCodeUseResult struct {
	Status        *StatusMessage
	BackendServer *BackendServerRef
	Valid         bool
	Remaining     int
}

type Redis interface {
	Read() redis.Cmdable
	Write() redis.Cmdable
	ReadPipeline() redis.Pipeliner
	WritePipeline() redis.Pipeliner
	Keys() RedisKeyBuilder
	Scripts() RedisScriptRegistry
}

type RedisKeyBuilder interface {
	Key(string) string
	Keys(...string) []string
	SameSlot([]string, string) []string
}

type RedisScriptRegistry interface {
	Upload(context.Context, string, string) (string, error)
	Run(context.Context, string, []string, ...any) (any, error)
}

type Registrar interface {
	Config() ConfigView
	RequireCapability(Capability) error
	RegisterInitTask(InitTask) error
	RegisterEnvironmentSource(EnvironmentSource) error
	RegisterSubjectSource(SubjectSource) error
	RegisterBackend(Backend) error
	RegisterObligationTarget(ObligationTarget) error
	RegisterPostActionTarget(PostActionTarget) error
	RegisterHook(Hook) error
	RegisterPolicyAttribute(AttributeDefinition) error
	RegisterDebugModule(DebugModuleDefinition) error
}

type ReloadablePlugin interface {
	Reconfigure(context.Context, ConfigView) error
}

type RequestDiagnostics struct {
	StatusMessage     string
	BruteForceName    string
	EnvironmentName   string
	LatencyMillis     int64
	BruteForceCounter uint
	HTTPStatus        int
}

type RequestSnapshot struct {
	Headers           map[string][]string
	IDP               IDPInfo
	Session           string
	ExternalSessionID string
	Service           string
	Protocol          string
	Method            string
	Username          string
	Account           string
	AccountField      string
	UniqueUserID      string
	DisplayName       string
	ClientIP          string
	ClientPort        string
	ClientNet         string
	ClientHost        string
	ClientID          string
	UserAgent         string
	LocalIP           string
	LocalPort         string
	OIDCCID           string
	SAMLEntityID      string
	AuthLoginAttempt  uint
	TLS               TLSInfo
	Diagnostics       RequestDiagnostics
	Runtime           RuntimeFlags
	HealthCheck       bool
}

type ResponseHeaderMutation struct {
	Set    map[string][]string
	Delete []string
}

type ResponseMutation struct {
	Headers      ResponseHeaderMutation
	StatusHeader bool
}

type RuntimeContext interface {
	Get(string) (any, bool)
	Snapshot() map[string]any
}

type RuntimeDelta struct {
	Set    map[string]any
	Delete []string
}

type RuntimeFlags struct {
	Debug                    bool
	LocalRequest             bool
	NoAuth                   bool
	UserFound                bool
	Authenticated            bool
	Authorized               bool
	Repeating                bool
	RWP                      bool
	EnvironmentRejected      bool
	EnvironmentStageExpected bool
	SubjectStageExpected     bool
}

type RuntimePlugin interface {
	Start(context.Context, Host) error
	Stop(context.Context) error
}

type Secret interface {
	WithBytes(func([]byte) error) error
	IsZero() bool
}

type SourceDescriptor struct {
	Timeout     time.Duration
	Name        string
	Requires    []string
	After       []string
	Priority    int
	AbortPolicy AbortPolicy
}

type Span interface {
	AddEvent(string, ...TraceAttribute)
	SetAttributes(...TraceAttribute)
	RecordError(error)
	SetStatus(SpanStatus, string)
	End()
}

type SpanKind uint8

type SpanStartOptions struct {
	Attributes []TraceAttribute
	Kind       SpanKind
}

type SpanStatus uint8

type StatusMessage struct {
	Code        string
	MessageKey  string
	DefaultText string
	Temporary   bool
}

type SubjectRequest struct {
	Snapshot      RequestSnapshot
	Runtime       RuntimeContext
	BackendResult BackendResult
	Credentials   CredentialProvider
}

type SubjectResult struct {
	Status             *StatusMessage
	SelectedBackend    *BackendServerRef
	BackendResultPatch *BackendResultPatch
	Logs               []LogField
	Facts              []PolicyFact
	BackendAttributes  AttributePatch
	Response           ResponseMutation
	RuntimeDelta       RuntimeDelta
	Rejected           bool
}

type SubjectSource interface {
	Descriptor() SourceDescriptor
	Evaluate(context.Context, SubjectRequest) (SubjectResult, error)
}

type Summary interface {
	Observe(context.Context, float64, ...LabelValue)
}

type TLSInfo struct {
	Legacy         TLSLegacyInfo
	ServerName     string
	CipherSuite    string
	PeerCommonName string
	PeerIssuer     string
	Version        string
	VerifiedChains int
	Enabled        bool
	Mutual         bool
}

type TLSLegacyInfo struct {
	State            string
	SessionID        string
	ClientVerify     string
	ClientDN         string
	ClientCommonName string
	Issuer           string
	ClientNotBefore  string
	ClientNotAfter   string
	SubjectDN        string
	IssuerDN         string
	ClientSubjectDN  string
	ClientIssuerDN   string
	Protocol         string
	CipherSuite      string
	Serial           string
	Fingerprint      string
}

type TOTPBackend interface {
	BeginTOTP(context.Context, TOTPBeginRequest) (TOTPBeginResult, error)
	FinishTOTP(context.Context, TOTPFinishRequest) (TOTPFinishResult, error)
	VerifyTOTP(context.Context, TOTPVerifyRequest) (TOTPVerifyResult, error)
	DeleteTOTP(context.Context, TOTPDeleteRequest) error
}

type TOTPBeginRequest struct {
	Snapshot       RequestSnapshot
	Runtime        RuntimeContext
	IdempotencyKey string
	Username       string
}

type TOTPBeginResult struct {
	Status                *StatusMessage
	BackendServer         *BackendServerRef
	ExpiresAt             time.Time
	PendingRegistrationID string
	OTPAuthURL            string
}

type TOTPDeleteRequest struct {
	Snapshot       RequestSnapshot
	Runtime        RuntimeContext
	IdempotencyKey string
	Username       string
}

type TOTPFinishRequest struct {
	Snapshot              RequestSnapshot
	Runtime               RuntimeContext
	IdempotencyKey        string
	Username              string
	PendingRegistrationID string
	Code                  string
}

type TOTPFinishResult struct {
	Status        *StatusMessage
	BackendServer *BackendServerRef
	Verified      bool
}

type TOTPVerifyRequest struct {
	Snapshot RequestSnapshot
	Runtime  RuntimeContext
	Username string
	Code     string
}

type TOTPVerifyResult struct {
	Status        *StatusMessage
	BackendServer *BackendServerRef
	Verified      bool
}

type TraceAttribute struct {
	Key   string
	Value any
}

type Tracer interface {
	Start(context.Context, string, ...TraceAttribute) (context.Context, Span)
	StartWithOptions(context.Context, string, SpanStartOptions) (context.Context, Span)
}

type WebAuthnBackend interface {
	ListWebAuthnCredentials(context.Context, WebAuthnListRequest) (WebAuthnListResult, error)
	SaveWebAuthnCredential(context.Context, WebAuthnSaveRequest) error
	UpdateWebAuthnCredential(context.Context, WebAuthnUpdateRequest) error
	DeleteWebAuthnCredential(context.Context, WebAuthnDeleteRequest) error
}

type WebAuthnCredential struct {
	LastUsed       time.Time
	ID             []byte
	PublicKey      []byte
	Transports     []string
	AAGUID         string
	Attestation    string
	Authenticator  string
	SignCount      uint32
	BackupState    bool
	BackupEligible bool
}

type WebAuthnDeleteRequest struct {
	Snapshot     RequestSnapshot
	Runtime      RuntimeContext
	Username     string
	CredentialID []byte
}

type WebAuthnListRequest struct {
	Snapshot RequestSnapshot
	Runtime  RuntimeContext
	Username string
}

type WebAuthnListResult struct {
	Status        *StatusMessage
	BackendServer *BackendServerRef
	Credentials   []WebAuthnCredential
}

type WebAuthnSaveRequest struct {
	Snapshot   RequestSnapshot
	Runtime    RuntimeContext
	Username   string
	Credential WebAuthnCredential
}

type WebAuthnUpdateRequest struct {
	Snapshot      RequestSnapshot
	Runtime       RuntimeContext
	Username      string
	OldCredential WebAuthnCredential
	NewCredential WebAuthnCredential
}