adminauth

type Action struct {
	// ID is the Cedar action id, `MDM::Action::"<ID>"`.
	ID string
	// Help is operator-facing prose naming the consequence, shown by
	// `dmctl policy actions`. Zentral writes the same for its secret-reveal
	// actions, and it is the difference between an operator granting an
	// action knowingly and granting it by name.
	Help string
	// Resource is the entity type this action acts on, EntitySystem when the
	// action is deployment-wide.
	Resource  types.EntityType
	Group     string
	Groups    []string
	Context   map[string]ContextAttribute
	Sensitive bool
	RootOnly  bool
}

type ContextAttribute struct {
	Type     string
	Required bool
}

type Decision struct {
	Allowed bool
	// Policy is the document and statement that decided, empty when nothing
	// matched and the default deny applied.
	Policy   string
	Policies []string
	Version  int64
	// Errors are per-policy evaluation errors. A policy that errors neither
	// permits nor forbids, so these are surfaced rather than swallowed.
	Errors []string
}

type Manager struct {
	// contains filtered or unexported fields
}

type Option func(*Manager)

type Page struct {
	Cursor string
	Limit  int
}

type Policy struct {
	// Name identifies the document for editing and for audit lines.
	Name string
	// Source is the Cedar text, stored and served exactly as written so an
	// operator sees back what they wrote.
	Source string
	// Description is operator prose, never interpreted.
	Description string
	// Active defaults to true when omitted. False retains a policy without evaluating it.
	Active    *bool `json:",omitempty"`
	CreatedAt time.Time
	UpdatedAt time.Time
}

type PolicySet struct {
	// contains filtered or unexported fields
}

type Principal struct {
	Name  string
	Roles []string
	// Root may administer principals and policies. It confers no other
	// authority: a root principal still needs a policy to enqueue a command.
	Root      bool
	CreatedAt time.Time
	UpdatedAt time.Time
	// TokenID names the current credential in audit lines, empty once
	// revoked. It is a fragment of the token, never enough to use.
	TokenID string
	// TokenAt is when the current token was minted (zero when revoked).
	TokenAt time.Time
	// ExpiresAt is when the current token stops being accepted; zero means no expiry.
	ExpiresAt time.Time
}

type PrincipalChange struct {
	// Op is update, rotate, revoke or delete.
	Op              string
	Roles           []string
	Root            bool
	Digest, TokenID string
	ExpiresAt       time.Time
}

type Registry struct {
	// contains filtered or unexported fields
}

type Result[T any] struct {
	Items      []T
	NextCursor string
}

type Role struct {
	Name        string
	Description string
	CreatedAt   time.Time
	UpdatedAt   time.Time
}

type Store interface {
	// PutRole upserts a validated role while preserving creation time and advancing the
	// authorization version.
	PutRole(context.Context, Role, time.Time) (Role, error)
	// Role returns a managed role by name, or ErrNotFound when absent.
	Role(context.Context, string) (Role, error)
	// Roles returns managed roles in name order using the requested cursor and limit.
	Roles(context.Context, Page) (Result[Role], error)
	// DeleteRole removes an unreferenced role, returning ErrConflict while principals or
	// policies still refer to it.
	DeleteRole(context.Context, string) error
	// BootstrapPrincipal atomically creates the first active root credential and permanently
	// closes bootstrap; an initialized or nonempty store returns ErrConflict.
	BootstrapPrincipal(context.Context, Principal, string, time.Time) (Principal, error)
	// Initialized reports whether principal initialization has permanently consumed
	// the bootstrap opportunity, independently of current credential expiry.
	Initialized(context.Context) (bool, error)
	// ApplyPrincipal serializes mutations across instances and refuses removal,
	// revocation, expiry or demotion of the last active root credential. Older
	// low-level write methods below are intended for import/storage tooling;
	// authenticated administration must use this method.
	ApplyPrincipal(ctx context.Context, name string, change PrincipalChange, now time.Time) (Principal, error)
	// CreatePrincipal adds a principal with its first token digest. An
	// existing name is ErrConflict.
	CreatePrincipal(ctx context.Context, p Principal, digest string, now time.Time) (Principal, error)
	// Principal returns one principal by name.
	Principal(ctx context.Context, name string) (Principal, error)
	// PrincipalByDigest returns the principal whose current token digest
	// matches. This is the authentication path and must be one indexed lookup.
	PrincipalByDigest(ctx context.Context, digest string) (Principal, error)
	// Principals pages principals by name.
	Principals(ctx context.Context, p Page) (Result[Principal], error)
	// UpdatePrincipal replaces the roles and root flag of a principal.
	UpdatePrincipal(ctx context.Context, name string, roles []string, root bool, now time.Time) (Principal, error)
	// SetToken replaces the current token digest, invalidating the previous
	// one immediately.
	SetToken(ctx context.Context, name, digest, tokenID string, expires, now time.Time) (Principal, error)
	// RevokeToken clears the current token, leaving the principal in place.
	RevokeToken(ctx context.Context, name string, now time.Time) error
	// DeletePrincipal removes a principal entirely.
	DeletePrincipal(ctx context.Context, name string) error
	// CountRoot returns how many principals carry Root, for the anti-lockout
	// invariant.
	CountRoot(ctx context.Context) (int, error)

	// PutPolicy stores or replaces a policy document.
	PutPolicy(ctx context.Context, p Policy, now time.Time) (Policy, error)
	// GetPolicy returns one policy document by name.
	GetPolicy(ctx context.Context, name string) (Policy, error)
	// Policies returns every stored policy, ordered by name. The whole set is
	// compiled together, so this is not paged.
	Policies(ctx context.Context) ([]Policy, error)
	// DeletePolicy removes a policy document.
	DeletePolicy(ctx context.Context, name string) error
	// PolicyVersion changes whenever any policy changes, so a cached
	// compilation can tell it is stale without recompiling.
	PolicyVersion(ctx context.Context) (int64, error)
}

type Token string