storage

type BootstrapToken struct {
	ID          string
	TokenHash   string
	Role        string
	OwnerID     string
	MaxUsages   int
	UsagesCount int
	Description string
	CreatedAt   time.Time
	ExpiresAt   time.Time
}

type EnrolledNode struct {
	PeerID         string
	PublicKey      []byte
	Biscuit        []byte
	Role           string
	EnrollmentType string
	ClaimsJSON     string
	OwnerID        string
	EnrolledAt     time.Time
	ExpiresAt      time.Time
	Banned         bool
}

type EnrollmentRequest struct {
	ID           string
	PeerID       string
	PublicKey    []byte
	TokenID      string
	Status       api.EnrollmentStatus
	BiscuitToken []byte
	CreatedAt    time.Time
	ResolvedAt   *time.Time
	ResolvedBy   string
}

type KeyPair struct {
	Private    ed25519.PrivateKey
	Public     ed25519.PublicKey
	Expiration time.Time
}

type RouterLease struct {
	PeerID         string
	Addresses      []string
	LastRenewal    time.Time
	ExpiresAt      time.Time
	ConnectedPeers []string
	DHTSize        int
}

type SQLStore struct {
	// contains filtered or unexported fields
}

type Store interface {
	// GetCurrentKey retrieves the active key pair for biscuit signing.
	GetCurrentKey(ctx context.Context) (ed25519.PrivateKey, ed25519.PublicKey, error)

	// GetAllValidKeys retrieves the active key pair and any non-expired historical key pairs.
	GetAllValidKeys(ctx context.Context) ([]KeyPair, error)

	// RotateKeys rotates the current key to a new key pair and sets the expiration of the old key.
	RotateKeys(ctx context.Context, newPriv ed25519.PrivateKey, newPub ed25519.PublicKey, gracePeriod time.Duration) error

	// SaveInitialKey sets the initial key pair if no keys exist yet.
	SaveInitialKey(ctx context.Context, priv ed25519.PrivateKey, pub ed25519.PublicKey) error

	// SaveUser creates or updates a User.
	SaveUser(ctx context.Context, user *User) error

	// GetUser retrieves a User by ID.
	GetUser(ctx context.Context, id string) (*User, error)

	// ListUsers retrieves all registered users.
	ListUsers(ctx context.Context) ([]User, error)

	// EnrollNode registers or updates a node enrollment.
	EnrollNode(ctx context.Context, node *EnrolledNode) error

	// GetNode retrieves node enrollment details.
	GetNode(ctx context.Context, peerID string) (*EnrolledNode, error)

	// SetNodeBanned updates the banned status of a node.
	SetNodeBanned(ctx context.Context, peerID string, banned bool) error

	// IsNodeBanned checks if a node is currently banned.
	IsNodeBanned(ctx context.Context, peerID string) (bool, error)

	// UpsertRouterLease updates or creates a lease for a sam-router.
	UpsertRouterLease(ctx context.Context, lease *RouterLease) error

	// GetActiveRouters retrieves all routers whose leases are still valid.
	GetActiveRouters(ctx context.Context) ([]RouterLease, error)

	// SaveMeshPolicy persists the mesh configurations.
	SaveMeshPolicy(ctx context.Context, roles []*api.PolicyRole, bindings []*api.PolicyBinding) error

	// GetMeshPolicy loads the mesh configurations.
	GetMeshPolicy(ctx context.Context) ([]*api.PolicyRole, []*api.PolicyBinding, error)

	// SaveBootstrapToken persists a new bootstrap token.
	SaveBootstrapToken(ctx context.Context, token *BootstrapToken) error

	// GetBootstrapToken retrieves a bootstrap token by its ID (sha256 hash).
	GetBootstrapToken(ctx context.Context, id string) (*BootstrapToken, error)

	// IncrementBootstrapTokenUsage increments the usage count of a token.
	IncrementBootstrapTokenUsage(ctx context.Context, id string) error

	// CreateEnrollmentRequest saves a new pending enrollment request.
	CreateEnrollmentRequest(ctx context.Context, req *EnrollmentRequest) error

	// GetEnrollmentRequest retrieves an enrollment request by PeerID.
	GetEnrollmentRequest(ctx context.Context, peerID string) (*EnrollmentRequest, error)

	// GetEnrollmentRequestByID retrieves an enrollment request by ID.
	GetEnrollmentRequestByID(ctx context.Context, id string) (*EnrollmentRequest, error)

	// ListEnrollmentRequests retrieves all enrollment requests.
	ListEnrollmentRequests(ctx context.Context) ([]EnrollmentRequest, error)

	// UpdateEnrollmentRequest updates status, resolved details, and stored Biscuit of a request.
	UpdateEnrollmentRequest(ctx context.Context, id string, status api.EnrollmentStatus, biscuit []byte, resolvedBy string) error

	// ListNodes retrieves all enrolled nodes.
	ListNodes(ctx context.Context) ([]EnrolledNode, error)

	// ListBootstrapTokens retrieves all bootstrap tokens.
	ListBootstrapTokens(ctx context.Context) ([]BootstrapToken, error)

	// Close closes the underlying database connection.
	Close() error
}

type User struct {
	ID        string
	Email     string
	Role      string
	CreatedAt time.Time
}