infra

type EnvironmentConfig struct {
	// Type is the environment type: "kind", "ocp", or "quadlet"
	Type string

	// Namespace is the K8s namespace for flightctl services (K8s only)
	Namespace string

	// APIEndpoint is the FlightCtl API endpoint URL (e.g., "https://api.flightctl.example.com:3443")
	APIEndpoint string

	// KubeConfig is the path to kubeconfig file (K8s only, defaults to ~/.kube/config)
	KubeConfig string

	// KubeContext is the kubeconfig context to use (K8s only)
	KubeContext string

	// SSHHost is the remote host for Quadlet deployments (Quadlet only, for remote testing)
	SSHHost string

	// SSHUser is the SSH username for remote Quadlet deployments
	SSHUser string

	// SSHKeyPath is the path to SSH private key for remote Quadlet deployments
	SSHKeyPath string

	// UseSudo indicates whether to use sudo for systemctl/podman commands (Quadlet only)
	UseSudo bool

	// ConfigDir is the config directory for Quadlet deployments (defaults to /etc/flightctl)
	ConfigDir string
}

type InfraProvider interface {
	// GetConfigValue retrieves a configuration value by name and key.
	// For K8s: reads from ConfigMap
	// For Quadlet: reads from config files or environment variables
	GetConfigValue(name, key string) (string, error)

	// GetServiceConfig retrieves the full configuration content for a service.
	// For K8s: reads from ConfigMap data (e.g., config.yaml key)
	// For Quadlet: reads the config file from container or host
	GetServiceConfig(service ServiceName) (string, error)

	// GetSecretValue retrieves a secret value by name and key.
	// For K8s: reads from Secret (base64 decoded)
	// For Quadlet: reads from secret files or environment variables
	GetSecretValue(name, key string) (string, error)

	// GetServiceEndpoint returns the host and port for a named service.
	// For K8s: returns in-cluster DNS name and port (not directly accessible from test host)
	// For Quadlet: returns the configured host with the service's port
	GetServiceEndpoint(service ServiceName) (host string, port int, err error)

	// ExposeService makes an internal service accessible from the test host.
	// Use this for services not normally exposed externally (e.g., metrics endpoints).
	// For K8s: starts port-forwarding and returns localhost URL + cleanup function
	// For Quadlet: returns direct URL + no-op cleanup (internal services accessible on host)
	// The cleanup function must be called when done (e.g., defer cleanup()).
	ExposeService(service ServiceName, protocol string) (url string, cleanup func(), err error)

	// InvalidateExposeCache closes any cached port-forward for the service and removes it from the cache.
	// Call before retrying ExposeService so the next call creates a new port-forward (e.g. after Redis restart).
	InvalidateExposeCache(service ServiceName)

	// ExecInService executes a command in the context of a service.
	// For K8s: kubectl exec into the service's pod
	// For Quadlet: direct command execution or SSH
	ExecInService(service ServiceName, command []string) (string, error)

	// ExecInServiceWithStdin executes a command in the context of a service with stdin attached.
	// Used e.g. to pipe a backup file into psql during DB restore.
	// For K8s: kubectl exec -i into the service's pod
	// For Quadlet: podman exec -i (and stdin piped through SSH when remote)
	ExecInServiceWithStdin(service ServiceName, command []string, stdin io.Reader) (string, error)

	// GetEnvironmentType returns the type of environment ("kind", "ocp", "quadlet").
	GetEnvironmentType() string

	// GetAPILoginToken returns a token suitable for flightctl login --token.
	// For K8s/KIND: kubectl create token in main namespace; OCP: oc whoami -t.
	// For Quadlet: read from file or return error. Namespace is internal to the provider.
	GetAPILoginToken() (string, error)

	// SetServiceConfig writes back config for a service (e.g. config.yaml in ConfigMap).
	// For K8s: updates ConfigMap data[configKey]. For Quadlet: single config file per
	// service; configKey is ignored (callers may pass "" or "config.yaml").
	SetServiceConfig(service ServiceName, configKey, content string) error

	// GetInternalNamespace returns the namespace where internal services (worker, db, kv, etc.) run.
	// For K8s: e.g. flightctl-internal when using split namespaces; empty when all in one namespace.
	// For Quadlet: empty.
	GetInternalNamespace() string

	// GetExternalNamespace returns the namespace where external services (API, UI, etc.) run (release namespace).
	// For K8s: the namespace where flightctl-api is deployed; used e.g. for io.flightctl/instance label.
	// For Quadlet: empty.
	GetExternalNamespace() string

	// BuiltinDatabaseWorkloadAvailable reports whether backup/restore tests can pg_dump/psql via the
	// built-in DB workload: K8s checks for a flightctl-db pod (Helm db.type=builtin); external Helm DB
	// has no such pod. Quadlet reads db.type from service-config.yaml (deploy/podman/service-config.yaml);
	// db.type=external uses an external Postgres instance instead of the flightctl-db container.
	BuiltinDatabaseWorkloadAvailable() bool
}

type Permission struct {
	Resources []string
	Verbs     []string
	ApiGroup  string // K8s: CoreAPIGroup for core (e.g. secrets), "" defaults to flightctl.io; PAM ignores
}

type ProviderFactory struct {
	// contains filtered or unexported fields
}

type Providers struct {
	Infra     InfraProvider
	Lifecycle ServiceLifecycleProvider
	RBAC      RBACProvider
	Secrets   SecretsProvider
	TPM       TPMProvider
}

type RBACProvider interface {
	// CreateRole creates a role.
	// K8s: creates rbacv1.Role in namespace
	// PAM: creates group "<namespace>.<name>" if namespace provided, else "<name>"
	CreateRole(ctx context.Context, spec *RoleSpec) error

	// UpdateRole updates a role.
	// K8s: updates rbacv1.Role
	// PAM: no-op (groups don't have permissions)
	UpdateRole(ctx context.Context, spec *RoleSpec) error

	// DeleteRole deletes a role.
	// K8s: deletes rbacv1.Role
	// PAM: deletes group "<namespace>.<name>" or "<name>"
	DeleteRole(ctx context.Context, namespace, name string) error

	// CreateRoleBinding binds a user to a role.
	// K8s: creates rbacv1.RoleBinding
	// PAM: adds user to group via usermod -aG
	CreateRoleBinding(ctx context.Context, spec *RoleBindingSpec) error

	// DeleteRoleBinding removes a user from a role.
	// K8s: deletes rbacv1.RoleBinding
	// PAM: removes user from group via gpasswd -d
	DeleteRoleBinding(ctx context.Context, namespace, name string) error

	// CreateClusterRole creates a cluster-scoped role.
	// K8s: creates rbacv1.ClusterRole
	// PAM: creates group "<name>" (no namespace prefix)
	CreateClusterRole(ctx context.Context, spec *RoleSpec) error

	// UpdateClusterRole updates a cluster-scoped role.
	// K8s: updates rbacv1.ClusterRole
	// PAM: no-op (groups don't have permissions)
	UpdateClusterRole(ctx context.Context, spec *RoleSpec) error

	// DeleteClusterRole deletes a cluster-scoped role.
	// K8s: deletes rbacv1.ClusterRole
	// PAM: deletes group "<name>"
	DeleteClusterRole(ctx context.Context, name string) error

	// CreateClusterRoleBinding binds a user to a cluster role.
	// K8s: creates rbacv1.ClusterRoleBinding
	// PAM: adds user to group via usermod -aG
	CreateClusterRoleBinding(ctx context.Context, spec *RoleBindingSpec) error

	// DeleteClusterRoleBinding removes a user from a cluster role.
	// K8s: deletes rbacv1.ClusterRoleBinding
	// PAM: removes user from group via gpasswd -d
	DeleteClusterRoleBinding(ctx context.Context, name string) error

	// CreateOrganization creates an organization (K8s: namespace with release label; PAM: org-<name> group).
	CreateOrganization(ctx context.Context, name string) error

	// AddUserToOrg grants the user access to the organization (K8s: view RoleBinding in namespace; PAM: add user to org-<name> group).
	AddUserToOrg(ctx context.Context, orgName, userName string) error

	// DeleteOrganization deletes an organization (K8s: namespace; PAM: org-<name> group).
	DeleteOrganization(ctx context.Context, name string) error
}

type RoleBindingSpec struct {
	Name      string
	Namespace string // empty for cluster-scoped
	RoleName  string
	Subject   string // user name or service account name
	// SubjectKind: "User" (default) or "ServiceAccount"
	SubjectKind string
	// SubjectNamespace: required when SubjectKind is ServiceAccount (namespace of the SA)
	SubjectNamespace string
}

type RoleSpec struct {
	Name        string
	Namespace   string // empty for cluster-scoped
	Permissions []Permission
}

type SecretsProvider interface {
	// GetSecretData returns the value of a key in a secret.
	// Namespace and secretName identify the secret; key is the data key.
	// Returns decoded bytes (K8s API returns Secret.Data already decoded).
	GetSecretData(ctx context.Context, namespace, secretName, key string) ([]byte, error)

	// GetSecretDataForService returns the value of a key in a secret for the given service.
	// K8s: resolves service to namespace internally. Quadlet: returns ErrSecretsNotSupported.
	GetSecretDataForService(ctx context.Context, service ServiceName, secretName, key string) ([]byte, error)

	// CreateSecret creates a secret with the given namespace, name, and string data (key -> value).
	// K8s: creates a Secret with StringData; idempotent (no-op if already exists with same data or update as needed).
	// Quadlet: returns ErrSecretsNotSupported.
	CreateSecret(ctx context.Context, namespace, name string, stringData map[string]string) error
}

type ServiceLifecycleProvider interface {
	// IsRunning checks if a service is currently running.
	// For K8s: checks pod phase is Running
	// For Quadlet: checks systemctl is-active
	IsRunning(service ServiceName) (bool, error)

	// Start starts a stopped service.
	// For K8s: scales deployment to 1 replica
	// For Quadlet: systemctl start
	Start(service ServiceName) error

	// Stop stops a running service.
	// For K8s: scales deployment to 0 replicas
	// For Quadlet: systemctl stop
	Stop(service ServiceName) error

	// Restart restarts a service.
	// For K8s: deletes the pod to force restart
	// For Quadlet: systemctl restart
	Restart(service ServiceName) error

	// WaitForReady waits for a service to be ready and healthy.
	// For K8s: waits for pod Ready condition
	// For Quadlet: waits for systemctl is-active and optionally health checks
	WaitForReady(service ServiceName, timeout time.Duration) error

	// AreServicesHealthy checks if all flightctl services are healthy.
	// For K8s: checks all deployments have ready replicas
	// For Quadlet: checks all systemd services are active
	AreServicesHealthy() (bool, error)

	// SetDeploymentEnv sets an environment variable on a service's deployment
	// and waits for the rollout to complete.
	// For K8s: patches the deployment container spec and waits for rollout
	// For Quadlet: creates a Quadlet container drop-in override and restarts the service
	SetDeploymentEnv(service ServiceName, envName, envValue string) error

	// RemoveDeploymentEnv removes an environment variable from a service's
	// deployment and waits for the rollout to complete.
	// For K8s: removes the env var from the deployment container spec and waits for rollout
	// For Quadlet: removes the env var from the container drop-in override and restarts the service
	RemoveDeploymentEnv(service ServiceName, envName string) error
}

type ServiceName string

type TPMProvider interface {
	// InjectCerts configures TPM CA certificates for the API server.
	// certs is a map of filename -> PEM certificate data.
	// The implementation handles all environment-specific details:
	// - K8s: creates ConfigMap, updates API config with tpmCAPaths, adds volume mount, restarts deployment
	// - Quadlet: writes certs to config directory, updates config file, restarts service
	InjectCerts(ctx context.Context, certs map[string][]byte) error

	// CleanupCerts removes TPM CA certificates from the API server configuration.
	// - K8s: deletes ConfigMap, removes volume mount from deployment, restarts deployment
	// - Quadlet: removes cert files, updates config to remove tpmCAPaths, restarts service
	CleanupCerts(ctx context.Context) error
}

type TracingProvider struct {
	// contains filtered or unexported fields
}