migration

type FilePreview struct {
	// Path is the absolute file path.
	Path string

	// Category identifies the type of file: "contact_points", "secure_data", or "auth".
	Category string

	// Keys lists the map keys whose values will be re-encrypted.
	// Empty for contact_points files (the entire blob is re-encoded as one unit).
	Keys []string

	// DecodedOK is true when OldEncoder successfully decoded every value in the file.
	DecodedOK bool

	// DecodeErr contains the first decode error message when DecodedOK is false.
	DecodeErr string
}

type Migrator struct {
	// OldEncoder decrypts values as they are currently stored on disk.
	// Use noop.NoOpEncoder{} when data is currently in plaintext.
	OldEncoder outbound.CipherEncoder

	// NewEncoder encrypts values for the new storage format.
	// Use noop.NoOpEncoder{} to revert all files to plaintext.
	NewEncoder outbound.CipherEncoder

	// GrafanaConf is the active context configuration, used for path resolution.
	GrafanaConf *config_domain.GrafanaConfig

	// Storage is the storage backend; contact point migration is skipped for non-local backends.
	Storage outbound.Storage

	// Resources Helper
	Resources ports.Resources
}

type RekeyOptions struct {
	// NoBackup disables the creation of backup copies before any file is modified.
	// Defaults to false (backups are created).
	NoBackup bool

	// BackupDir is the directory where backups are written.
	// If empty and NoBackup is false, a timestamped temp directory is created automatically.
	BackupDir string

	// IncludeGdgCredentials controls whether the per-context auth file
	// (holding the Grafana password/token) is also migrated.
	IncludeGdgCredentials bool

	// DryRun, when true, causes Rekey to scan files and populate RekeyReport.Previews
	// without writing any changes to disk. Backups are also skipped during a dry run.
	DryRun bool

	// AllowList restricts processing to the listed absolute file paths.
	// When empty, all discovered files are processed.
	AllowList []string
}

type RekeyReport struct {
	// BackupDir is the directory where backups were written (empty when NoBackup is true).
	BackupDir string

	// ContactPointsFiles lists the contact point file paths that were successfully migrated.
	ContactPointsFiles []string

	// SecureDataFiles lists the SecureData credential file paths that were successfully migrated.
	SecureDataFiles []string

	// GdgCredentialsMigrated reports whether the auth file was successfully migrated.
	GdgCredentialsMigrated bool

	// Errors collects non-fatal errors encountered during migration.
	// When an error is added the affected file is skipped; other files continue.
	Errors []error

	// Previews holds per-file scan results populated during a DryRun.
	Previews []FilePreview
}