auth

type APIKeyDef struct {
	Key        string            `yaml:"key"`        // the bearer token value
	Name       string            `yaml:"name"`       // human label
	Role       string            `yaml:"role"`       // role name reference
	Attributes map[string]string `yaml:"attributes"` // optional ABAC attributes
}

type AccessControlPolicy struct {
	Name    string       `yaml:"name" json:"name"`
	Version int          `yaml:"version" json:"version"`
	Rules   []PolicyRule `yaml:"rules" json:"rules"`
	Enabled bool         `yaml:"enabled" json:"enabled"`
}

type AccessPolicy struct {
	Table      string                  // table name this policy applies to
	Role       string                  // role name this policy applies to
	Columns    map[string]ColumnPolicy // column name -> policy
	MaskValues map[string]CellMaskFunc // column name -> custom mask function (optional)
	RowFilter  string                  // SQL predicate appended to WHERE clause (e.g. "region = 'us'")
}

type Action string

type Attributes map[string]any

type AuditLogger struct {
	// contains filtered or unexported fields
}

type Authenticator struct {
	// contains filtered or unexported fields
}

type Authorizer struct {
	// contains filtered or unexported fields
}

type CellMaskFunc func(val any) any

type ColumnDecision struct {
	Column   string `json:"column"`
	Allowed  bool   `json:"allowed"`
	MaskFunc string `json:"mask_func,omitempty"`
	MaskExpr string `json:"mask_expr,omitempty"`
}

type ColumnPolicy int

type Condition struct {
	Attribute string `yaml:"attribute" json:"attribute"`
	Op        string `yaml:"op" json:"op"` // eq, neq, in, not_in, gt, lt, gte, lte, contains, exists
	Value     any    `yaml:"value" json:"value"`
}

type Config struct {
	Enabled bool         `yaml:"enabled"`
	APIKeys []APIKeyDef  `yaml:"api_keys"`
	JWT     JWTConfig    `yaml:"jwt"`
	MTLS    MTLSConfig   `yaml:"mtls"`
	Roles   []RoleConfig `yaml:"roles"`
}

type Decision struct {
	Allowed     bool
	Effect      Effect
	MatchedRule string
	Obligations []Obligation
	Reason      string
}

type Effect int

type Environment struct {
	Time     time.Time
	SourceIP string
	Protocol string // "http", "pgwire", "grpc"
	Custom   Attributes
}

type Identity struct {
	Name       string     // human-readable label (e.g. "grafana-prod", "alice@example.com")
	Role       string     // resolved role name
	Method     string     // how they authenticated: "apikey", "jwt", "mtls"
	Tables     []string   // allowed tables from role (["*"] = all)
	Perms      []string   // allowed permissions from role
	Attributes Attributes // extended attributes for ABAC (from JWT claims, mTLS cert, config)
}

type IdentitySnapshot struct {
	Name       string            `json:"name,omitempty"`
	Role       string            `json:"role,omitempty"`
	Method     string            `json:"method,omitempty"`
	Attributes map[string]string `json:"attributes,omitempty"`
}

type JWTConfig struct {
	Enabled       bool   `yaml:"enabled"`
	Secret        string `yaml:"secret"`          // HMAC-SHA256 secret
	PublicKeyFile string `yaml:"public_key_file"` // PEM file path for RSA verification
	RoleClaim     string `yaml:"role_claim"`      // JWT claim containing role (default: "role")
	Issuer        string `yaml:"issuer"`          // expected issuer (optional)
}

type JWTVerifier struct {
	// contains filtered or unexported fields
}

type MTLSConfig struct {
	Enabled     bool              `yaml:"enabled"`
	CAFile      string            `yaml:"ca_file"`      // CA certificate PEM file for verifying client certs
	RoleMap     map[string]string `yaml:"role_map"`     // CN or SAN -> role mapping
	DefaultRole string            `yaml:"default_role"` // role for valid certs not in role_map
}

type MTLSVerifier struct {
	// contains filtered or unexported fields
}

type Obligation struct {
	Type     string `yaml:"type" json:"type"`           // mask_column, deny_column, row_filter, query_limit
	Target   string `yaml:"target" json:"target"`       // column name, table name
	Value    string `yaml:"value" json:"value"`         // SQL predicate, mask expression
	MaskFunc string `yaml:"mask_func" json:"mask_func"` // redact, hash, nullify, partial
}

type PolicyConfig struct {
	Table     string            `yaml:"table"`
	Role      string            `yaml:"role"`
	Columns   map[string]string `yaml:"columns"`    // column name -> "allow", "mask", "deny"
	RowFilter string            `yaml:"row_filter"` // SQL WHERE predicate
}

type PolicyEvaluator struct {
	// contains filtered or unexported fields
}

type PolicyRule struct {
	ID          string       `yaml:"id" json:"id"`
	Description string       `yaml:"description" json:"description"`
	Effect      Effect       `yaml:"-" json:"-"`
	EffectStr   string       `yaml:"effect" json:"effect"`     // "allow" or "deny" for serialization
	Priority    int          `yaml:"priority" json:"priority"` // lower = higher priority
	Subjects    []Condition  `yaml:"subjects" json:"subjects"`
	Resources   []Condition  `yaml:"resources" json:"resources"`
	Actions     []Action     `yaml:"actions" json:"actions"`
	Environment []Condition  `yaml:"environment" json:"environment"`
	Obligations []Obligation `yaml:"obligations" json:"obligations"`
}

type PolicySet struct {
	// contains filtered or unexported fields
}

type Provider struct {
	// contains filtered or unexported fields
}

type RateLimitConfig struct {
	RequestsPerSecond float64       // max requests per second per identity
	Burst             int           // max burst size (token bucket capacity)
	CleanupInterval   time.Duration // how often to evict idle entries (default 5m)
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type Resource struct {
	Type       string     // "table", "column", "function"
	Name       string     // e.g. "events", "users.ssn"
	Attributes Attributes // e.g. {"classification": "SECRET", "owner": "alice"}
}

type RoleConfig struct {
	Name   string   `yaml:"name"`   // e.g. "admin", "reader", "analyst"
	Tables []string `yaml:"tables"` // table names or "*" for all
	Allow  []string `yaml:"allow"`  // permissions: "read", "write", "admin"
}

type RoleDef struct {
	Name   string
	Tables []string
	Perms  []string
}

type RowFilters map[string]string

type SerializedDecision struct {
	Allowed        bool                      `json:"allowed"`
	TableDecisions map[string]*TableDecision `json:"table_decisions,omitempty"`
	MaxScanBytes   int64                     `json:"max_scan_bytes,omitempty"`
	MaxScanRows    int64                     `json:"max_scan_rows,omitempty"`
}

type Subject struct {
	Identity   *Identity
	Attributes Attributes // merged from JWT claims, mTLS cert fields, config, API key def
}

type TableDecision struct {
	Allowed   bool             `json:"allowed"`
	Columns   []ColumnDecision `json:"columns,omitempty"`
	RowFilter string           `json:"row_filter,omitempty"`
	Reason    string           `json:"reason,omitempty"`
	RuleID    string           `json:"rule_id,omitempty"`
}

type TableDecisions map[string]*TableDecision