cache

type Config struct {
	// Location is the base path for local cache
	Location string

	// RemoteConfig holds remote cache specific configuration
	RemoteConfig RemoteConfig
}

type LocalCache interface {
	// Location returns the absolute filesystem path for a package build artifact
	Location(pkg Package) (path string, exists bool)
}

type ObjectStorage interface {
	// HasObject checks if an object exists
	HasObject(ctx context.Context, key string) (bool, error)

	// GetObject downloads an object to a local file
	GetObject(ctx context.Context, key string, dest string) (int64, error)

	// UploadObject uploads a local file to remote storage
	UploadObject(ctx context.Context, key string, src string) error

	// ListObjects lists objects with the given prefix
	ListObjects(ctx context.Context, prefix string) ([]string, error)
}

type Package interface {
	// Version returns a unique identifier for the package
	Version() (string, error)
	// FullName returns the full name of the package
	FullName() string
}

type RemoteCache interface {
	// ExistingPackages returns existing cached build artifacts in the remote cache
	ExistingPackages(ctx context.Context, pkgs []Package) (map[Package]struct{}, error)

	// Download makes a best-effort attempt at downloading previously cached build artifacts
	// A cache miss does not constitute an error
	Download(ctx context.Context, dst LocalCache, pkgs []Package) error

	// Upload makes a best effort to upload the build artifacts to a remote cache
	Upload(ctx context.Context, src LocalCache, pkgs []Package) error
}

type RemoteConfig struct {
	// BucketName for object storage
	BucketName string

	// Region for services that require it (e.g. S3)
	Region string

	// Endpoint for the remote service
	Endpoint string

	// SLSA holds SLSA verification configuration
	SLSA *SLSAConfig `yaml:"slsa,omitempty" json:"slsa,omitempty"`
}

type SLSAConfig struct {
	// Verification enables SLSA verification for cached artifacts
	Verification bool `yaml:"verification" json:"verification"`

	// SourceURI is the expected source URI for SLSA verification
	SourceURI string `yaml:"source_uri" json:"source_uri"`

	// TrustedRoots contains the trusted root certificates for SLSA verification
	TrustedRoots []string `yaml:"trusted_roots" json:"trusted_roots"`

	// RequireAttestation determines behavior when SLSA attestations are missing.
	// When true: missing attestation → skip download, allow local build fallback
	// When false: missing attestation → download without verification (with warning)
	// Default: false (for backward compatibility and graceful degradation)
	RequireAttestation bool `yaml:"require_attestation" json:"require_attestation"`
}