domain

type ComplianceViolation struct {
	Type        string
	Description string
}

type GitHubClient interface {
	// CheckPRCompliance verifies if a merged PR met branch protection
	// requirements.
	CheckPRCompliance(ctx context.Context, owner, repo string, prNumber int) (*PRComplianceResult, error)

	// GetOrCreateTeam fetches an existing team by slug or creates it if
	// missing.
	GetOrCreateTeam(ctx context.Context, teamName, privacy string) (*github.Team, error)

	// SyncTeamMembers adds and removes members to match desired state.
	SyncTeamMembers(ctx context.Context, teamSlug string, desiredMembers []string, safetyThreshold float64) (*TeamSyncResult, error)

	// GetTeamMembers returns GitHub usernames of all team members.
	GetTeamMembers(ctx context.Context, teamSlug string) ([]string, error)

	// ListOrgMembers returns all organization members excluding external
	// collaborators.
	ListOrgMembers(ctx context.Context) ([]string, error)

	// IsExternalCollaborator checks if a user is an outside collaborator
	// rather than an organization member.
	IsExternalCollaborator(ctx context.Context, username string) (bool, error)

	// GetAppSlug fetches the GitHub App slug identifier.
	GetAppSlug(ctx context.Context) (string, error)

	// GetOrg returns the GitHub organization name.
	GetOrg() string
}

type GroupInfo struct {
	ID                      string
	Name                    string
	Members                 []string
	SkippedNoGitHubUsername []string
}

type GroupMembersResult struct {
	Members                 []string
	SkippedNoGitHubUsername []string
}

type Notifier interface {
	// NotifyPRBypass sends a notification when branch protection is
	// bypassed.
	NotifyPRBypass(ctx context.Context, result *PRComplianceResult, repoFullName string) error

	// NotifyOktaSync sends a notification with Okta sync results.
	NotifyOktaSync(ctx context.Context, reports []*SyncReport, githubOrg string) error

	// NotifyOrphanedUsers sends a notification about organization members
	// not in any synced teams.
	NotifyOrphanedUsers(ctx context.Context, report *OrphanedUsersReport) error
}

type OktaClient interface {
	// GetGroupsByPattern fetches all Okta groups matching a regex pattern.
	GetGroupsByPattern(ctx context.Context, pattern string) ([]*GroupInfo, error)

	// GetGroupInfo fetches details for a single Okta group by name.
	GetGroupInfo(ctx context.Context, groupName string) (*GroupInfo, error)
}

type OrphanedUsersReport struct {
	OrphanedUsers []string
}

type PRComplianceResult struct {
	PR               *github.PullRequest
	BaseBranch       string
	Protection       *github.Protection
	BranchRules      *github.BranchRules
	Violations       []ComplianceViolation
	UserHasBypass    bool
	UserBypassReason string
}

type SyncReport struct {
	Rule                       string
	OktaGroup                  string
	GitHubTeam                 string
	MembersAdded               []string
	MembersRemoved             []string
	MembersSkippedExternal     []string
	MembersSkippedNoGHUsername []string
	Errors                     []string
}

type SyncResult struct {
	Reports       []*SyncReport
	OrphanedUsers *OrphanedUsersReport
}

type SyncRule struct {
	Name                string `json:"name"`
	Enabled             *bool  `json:"enabled,omitempty"`
	OktaGroupPattern    string `json:"okta_group_pattern,omitempty"`
	OktaGroupName       string `json:"okta_group_name,omitempty"`
	GitHubTeamPrefix    string `json:"github_team_prefix,omitempty"`
	GitHubTeamName      string `json:"github_team_name,omitempty"`
	StripPrefix         string `json:"strip_prefix,omitempty"`
	SyncMembers         *bool  `json:"sync_members,omitempty"`
	CreateTeamIfMissing bool   `json:"create_team_if_missing"`
	TeamPrivacy         string `json:"team_privacy,omitempty"`
}

type TeamSyncResult struct {
	TeamName               string
	MembersAdded           []string
	MembersRemoved         []string
	MembersSkippedExternal []string
	Errors                 []string
}