perimeter

type Answer struct {
	AsOf       time.Time `json:"asOf"`
	ValidUntil time.Time `json:"validUntil"`
	// Complete is false when any input was unreadable or any entry is
	// indeterminate.
	Complete bool    `json:"complete"`
	Entries  []Entry `json:"entries"`
	// HiddenSubjects is left zero by this package; a host that removes rows
	// the asker may not see under contact visibility counts them here.
	HiddenSubjects int      `json:"hiddenSubjects"`
	Limitations    []string `json:"limitations"`
}

type Blocker struct {
	Code   string `json:"code"`
	Phase  string `json:"phase,omitempty"`
	Source *Ref   `json:"source,omitempty"`
}

type Connection struct {
	// Ref is the resolved, Space-bound connection identity.
	Ref dataaccess.ConnectionRef
	// Protection is the stored protection record. Nil means unreadable.
	Protection *dataaccess.ConnectionProtection
	// Exact is the sealed exact-read configuration (standing baseline and
	// mandatory denies). Required for posture exact-v1.
	Exact *dataaccess.ExactReadSnapshot
	// Grants are every stored grant on this connection in any state, with
	// ExpiresAt already clamped to the effective policy maximum. A subject
	// with any grant whose fingerprint differs from Ref's is unresolvable, as
	// in the backend resolver, and gets indeterminate answers.
	Grants []StoredGrant
	// Inventory lists the known objects, for "what can S access" listings.
	Inventory []dataaccess.ObjectRef
	// AllowSelfApproval is the stored policy switch that lets a grant's own
	// beneficiary decide it. When false, a grant whose Decision.By equals its
	// Subject confers nothing.
	AllowSelfApproval bool
	// Incomplete names inputs of this connection that failed to load.
	Incomplete []string
}

type Decision string

type Enforcement string

type Entry struct {
	// Subject is nil for a group row.
	Subject    *dataaccess.Subject   `json:"subject,omitempty"`
	Group      string                `json:"group,omitempty"`
	Resource   Resource              `json:"resource"`
	Permission dataaccess.Permission `json:"permission,omitempty"`
	Decision   Decision              `json:"decision"`
	// Sources are the allows that admitted the read. Only allows carry them.
	Sources      []Source      `json:"sources,omitempty"`
	Restrictions []Restriction `json:"restrictions,omitempty"`
	Blockers     []Blocker     `json:"blockers,omitempty"`
	// Candidates are, on a detailed deny, the inputs that would have allowed
	// the read but did not admit it.
	Candidates []Source `json:"candidates,omitempty"`
	// Enforcement is empty when the connection is unknown.
	Enforcement Enforcement `json:"enforcement,omitempty"`
	// AllowedUntil is the admitted lease end on the AsOf clock, for allows.
	AllowedUntil *time.Time `json:"allowedUntil,omitempty"`
}

type ExplainOptions struct {
	// Detail returns the policy-level blockers and candidate sources of a
	// deny. They disclose mandatory policy and whether a name exists: set it
	// only for a caller holding access.inspect over the resource. Without it a
	// deny carries only READ_DENIED.
	Detail bool
}

type Filter struct {
	Connections []string
	Environment string
	Permissions []dataaccess.Permission
	// IncludeDenied lists every inventory object with full blocker detail.
	// Without it, a self-view lists only allowed objects and objects named in
	// the subject's own grants, with deny detail reduced to READ_DENIED, and
	// folds every other unknown into one row per connection with no table
	// name. Denied and hidden names are not wire data for an ordinary caller:
	// set it only for a caller holding access.inspect over the scope.
	IncludeDenied bool
}

type Ref struct {
	Kind string `json:"kind"`
	ID   string `json:"id"`
}

type Resource struct {
	Connection string `json:"connection"`
	Namespace  string `json:"namespace,omitempty"`
	Name       string `json:"name,omitempty"`
}

type Restriction struct {
	Kind   string `json:"kind"`
	ID     string `json:"id"`
	Effect string `json:"effect"`
}

type Snapshot struct {
	// AsOf is control-plane time. Expiry is measured against it, never the
	// local clock.
	AsOf time.Time
	// Connections are the project's protected connections.
	Connections []Connection
	// Members are the verified human project members. Nil means membership
	// could not be read; every subject answer is then indeterminate.
	Members []dataaccess.Subject
	// Incomplete names inputs that failed to load. Any entry makes every
	// read answer indeterminate.
	Incomplete []string
}

type Source struct {
	Kind      string     `json:"kind"`
	ID        string     `json:"id"`
	Target    string     `json:"target,omitempty"`
	ExpiresAt *time.Time `json:"expiresAt,omitempty"`
}

type StoredGrant struct {
	dataaccess.Grant
	Fingerprint dataaccess.Fingerprint
}