models

type AgentProfile struct {
	NebulaConfigPath string `json:"nebula_config_path"`
	NebulaCAPath     string `json:"nebula_ca_path"`
	NebulaCertPath   string `json:"nebula_cert_path"`
	NebulaKeyPath    string `json:"nebula_key_path"`
	ConfigAckV1      bool   `json:"config_ack_v1"`
}

type AuditEntry struct {
	ID        string    `json:"id"`
	Timestamp time.Time `json:"timestamp"`
	Actor     string    `json:"actor"`
	Action    string    `json:"action"`
	Resource  string    `json:"resource"`
	Details   string    `json:"details,omitempty"`
}

type CA struct {
	ID                   string    `json:"id"`
	Name                 string    `json:"name"`
	OwnerOperatorID      string    `json:"owner_operator_id"`
	CertPEM              string    `json:"cert_pem"`
	Fingerprint          string    `json:"fingerprint"`
	NotBefore            time.Time `json:"not_before"`
	NotAfter             time.Time `json:"not_after"`
	Status               CAStatus  `json:"status"`
	PredecessorID        *string   `json:"predecessor_id,omitempty"`
	EncryptedKeyDEK      []byte    `json:"-"`
	NonceDEK             []byte    `json:"-"`
	EncryptedKeyMaterial []byte    `json:"-"`
	NonceKey             []byte    `json:"-"`
	CreatedAt            time.Time `json:"created_at"`
	UpdatedAt            time.Time `json:"updated_at"`
}

type CAStatus string

type CertificateIdentity struct {
	Name      string
	NebulaIPs []string
	Groups    []string
}

type CertificateInfo struct {
	ID          string    `json:"id"`
	HostID      string    `json:"host_id"`
	Fingerprint string    `json:"fingerprint"`
	PEM         string    `json:"pem"`
	NotBefore   time.Time `json:"not_before"`
	NotAfter    time.Time `json:"not_after"`
	IsCurrent   bool      `json:"is_current"`
	CreatedAt   time.Time `json:"created_at"`
}

type EnrollmentToken struct {
	ID        string     `json:"id"`
	HostID    string     `json:"host_id"`
	TokenHash string     `json:"-"` // versioned keyed verifier; raw value is never persisted
	Used      bool       `json:"used"`
	ExpiresAt time.Time  `json:"expires_at"`
	UsedAt    *time.Time `json:"used_at,omitempty"`
	CreatedAt time.Time  `json:"created_at"`
}

type Host struct {
	ID                  string        `json:"id"`
	NetworkID           string        `json:"network_id"`
	CAID                string        `json:"ca_id,omitempty"`
	Name                string        `json:"name"`
	NebulaIPs           []string      `json:"nebula_ips"`
	Groups              []string      `json:"groups"`
	Role                HostRole      `json:"role"`
	IsLighthouse        bool          `json:"is_lighthouse"`
	IsRelay             bool          `json:"is_relay"`
	PublicIP            string        `json:"public_ip,omitempty"`
	ListenPort          int           `json:"listen_port,omitempty"`
	Status              HostStatus    `json:"status"`
	CertFingerprint     string        `json:"cert_fingerprint,omitempty"`
	PrevCertFingerprint string        `json:"prev_cert_fingerprint,omitempty"`
	CertExpiresAt       *time.Time    `json:"cert_expires_at,omitempty"`
	CertRotatedAt       *time.Time    `json:"cert_rotated_at,omitempty"`
	PendingRekey        bool          `json:"pending_rekey,omitempty"`
	SigningPubPEM       string        `json:"signing_pub_pem,omitempty"`
	LastSeenAt          *time.Time    `json:"last_seen_at,omitempty"`
	Advanced            *HostAdvanced `json:"advanced,omitempty"`
	Kind                HostKind      `json:"kind"`
	Variant             HostVariant   `json:"variant,omitempty"`
	CreatedAt           time.Time     `json:"created_at"`
	UpdatedAt           time.Time     `json:"updated_at"`
}

type HostAdvanced struct {
	Punchy          *bool              `json:"punchy,omitempty" yaml:"punchy,omitempty"`
	ListenHost      string             `json:"listen_host,omitempty" yaml:"listen_host,omitempty"`
	MTU             int                `json:"mtu,omitempty" yaml:"mtu,omitempty"`
	TunDevice       string             `json:"tun_device,omitempty" yaml:"tun_device,omitempty"`
	UnsafeRoutes    []UnsafeRoute      `json:"unsafe_routes,omitempty" yaml:"unsafe_routes,omitempty"`
	FirewallInbound []HostFirewallRule `json:"firewall_inbound,omitempty" yaml:"firewall_inbound,omitempty"`
}

type HostAgentProfile struct {
	HostID               string    `json:"host_id"`
	MeshImportID         string    `json:"mesh_import_id"`
	NebulaConfigPath     string    `json:"nebula_config_path"`
	NebulaCAPath         string    `json:"nebula_ca_path"`
	NebulaCertPath       string    `json:"nebula_cert_path"`
	NebulaKeyPath        string    `json:"nebula_key_path"`
	ConfigAckV1          bool      `json:"config_ack_v1"`
	PendingConfigVersion int       `json:"pending_config_version"`
	CreatedAt            time.Time `json:"created_at"`
	UpdatedAt            time.Time `json:"updated_at"`
}

type HostFirewallRule struct {
	Port  string `json:"port" yaml:"port"`   // "any", a port, or a range "a-b"
	Proto string `json:"proto" yaml:"proto"` // any | tcp | udp | icmp
	Group string `json:"group" yaml:"group"`
	// Cidr restricts the rule to peers whose Nebula address falls inside the
	// prefix: a CIDR, or "any" for any address of any family.
	Cidr string `json:"cidr,omitempty" yaml:"cidr,omitempty"`
	// LocalCidr restricts the rule to traffic whose local address falls
	// inside the prefix: a CIDR, or "any". Needed to reach addresses served
	// via unsafe_routes, which Nebula excludes by default.
	LocalCidr string `json:"local_cidr,omitempty" yaml:"local_cidr,omitempty"`
}

type HostKind string

type HostRole string

type HostStatus string

type HostVariant string

type MeshImport struct {
	ID                           string           `json:"id"`
	NetworkID                    string           `json:"network_id"`
	CAID                         string           `json:"ca_id"`
	OwnerOperatorID              string           `json:"owner_operator_id"`
	CAFingerprint                string           `json:"ca_fingerprint"`
	Status                       MeshImportStatus `json:"status"`
	ExpectedHosts                *int             `json:"expected_hosts,omitempty"`
	Revision                     int64            `json:"revision"`
	TokenHash                    string           `json:"-"`
	TokenExpiresAt               time.Time        `json:"token_expires_at"`
	CapturedNetworkConfigVersion int              `json:"captured_network_config_version"`
	TerminalReason               string           `json:"terminal_reason,omitempty"`
	CreatedAt                    time.Time        `json:"created_at"`
	UpdatedAt                    time.Time        `json:"updated_at"`
	FinalizedAt                  *time.Time       `json:"finalized_at,omitempty"`
	CanceledAt                   *time.Time       `json:"canceled_at,omitempty"`
}

type MeshImportChallenge struct {
	ID                     string     `json:"id"`
	MeshImportID           string     `json:"mesh_import_id"`
	TokenHash              string     `json:"-"`
	CertificateFingerprint string     `json:"certificate_fingerprint"`
	AgentSigningPubPEM     string     `json:"agent_signing_pub_pem"`
	PayloadHash            string     `json:"payload_hash"`
	ServerNonce            string     `json:"server_nonce"`
	ExpiresAt              time.Time  `json:"expires_at"`
	ConsumedAt             *time.Time `json:"consumed_at,omitempty"`
	CreatedAt              time.Time  `json:"created_at"`
}

type MeshImportRegistration struct {
	ChallengeID          string
	CertificateNotBefore time.Time
	CertificateNotAfter  time.Time
	Host                 *Host
	Snapshot             *MeshImportSnapshot
	Profile              *HostAgentProfile
}

type MeshImportRegistrationResult struct {
	Host     *Host
	Snapshot *MeshImportSnapshot
	Created  bool
}

type MeshImportSnapshot struct {
	ID                     string    `json:"id"`
	MeshImportID           string    `json:"mesh_import_id"`
	HostID                 string    `json:"host_id"`
	CertificateFingerprint string    `json:"certificate_fingerprint"`
	CertificatePEM         string    `json:"certificate_pem"`
	AgentSigningPubPEM     string    `json:"agent_signing_pub_pem"`
	PayloadHash            string    `json:"payload_hash"`
	SnapshotJSON           string    `json:"snapshot_json"`
	CreatedAt              time.Time `json:"created_at"`
	UpdatedAt              time.Time `json:"updated_at"`
}

type MeshImportStatus string

type MeshImportTombstone struct {
	CertificateFingerprint string    `json:"certificate_fingerprint"`
	FormerHostID           string    `json:"former_host_id"`
	MeshImportID           string    `json:"mesh_import_id"`
	AgentSigningPubPEM     string    `json:"agent_signing_pub_pem"`
	TerminalReason         string    `json:"terminal_reason"`
	CreatedAt              time.Time `json:"created_at"`
	UpdatedAt              time.Time `json:"updated_at"`
}

type Network struct {
	ID        string    `json:"id"`
	Name      string    `json:"name"`
	CIDRs     []string  `json:"cidrs"`
	CAID      string    `json:"ca_id,omitempty"`
	CreatedAt time.Time `json:"created_at"`
}

type Operator struct {
	ID           string               `json:"id"`
	Username     string               `json:"username"`
	DisplayName  string               `json:"display_name"`
	PasswordHash string               `json:"-"`
	AuthProvider OperatorAuthProvider `json:"auth_provider"`
	Status       OperatorStatus       `json:"status"`
	Role         string               `json:"role"`
	TOTPSecret   string               `json:"-"`
	TOTPEnabled  bool                 `json:"totp_enabled"`
	OIDCIssuer   string               `json:"oidc_issuer,omitempty"`
	OIDCSubject  string               `json:"oidc_subject,omitempty"`
	CreatedAt    time.Time            `json:"created_at"`
	UpdatedAt    time.Time            `json:"updated_at"`
	LastLoginAt  *time.Time           `json:"last_login_at,omitempty"`

	// FailedLoginAttempts counts consecutive failed password logins; it
	// resets to 0 on a successful login or when an expired lock is cleared
	// (#263). LockedUntil, when non-nil and in the future, blocks login
	// regardless of credentials.
	FailedLoginAttempts int        `json:"-"`
	LockedUntil         *time.Time `json:"-"`
}

type OperatorAPIKey struct {
	ID         string     `json:"id"`
	OperatorID string     `json:"operator_id"`
	Name       string     `json:"name"`
	KeyHash    string     `json:"-"`
	CreatedAt  time.Time  `json:"created_at"`
	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
	RevokedAt  *time.Time `json:"revoked_at,omitempty"`
}

type OperatorAuthProvider string

type OperatorSession struct {
	// Token is the raw session token carried in the operator's cookie. It is
	// transient: the Store persists only a keyed verifier, never the raw value.
	Token      string
	OperatorID string
	State      SessionState
	ExpiresAt  time.Time
	CreatedAt  time.Time
}

type OperatorStatus string

type SessionState string

type UnsafeRoute struct {
	Route string `json:"route" yaml:"route"` // CIDR
	Via   string `json:"via" yaml:"via"`     // Nebula IP of the gateway host
}

type WebhookSubscription struct {
	ID              string   `json:"id"`
	OwnerOperatorID string   `json:"owner_operator_id"`
	URL             string   `json:"url"`
	Events          []string `json:"events"` // empty = all events
	Active          bool     `json:"active"`
	AllowPrivate    bool     `json:"allow_private"`

	// Envelope-encrypted HMAC secret. All nil => unsigned deliveries.
	EncryptedSecretDEK []byte `json:"-"`
	NonceDEK           []byte `json:"-"`
	EncryptedSecret    []byte `json:"-"`
	NonceSecret        []byte `json:"-"`

	// HasSecret is a computed, response-only flag (the secret itself is never
	// returned). It is not persisted as a column.
	HasSecret bool `json:"has_secret"`

	// Per-subscription delivery observability.
	LastDeliveryAt      *time.Time `json:"last_delivery_at,omitempty"`
	LastStatus          string     `json:"last_status,omitempty"`
	LastError           string     `json:"last_error,omitempty"`
	ConsecutiveFailures int        `json:"consecutive_failures"`

	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}