service

type APIKey struct {
	ID        string
	Key       string // only set on creation
	Prefix    string
	Name      string
	Scopes    []string
	ExpiresAt *time.Time
}

type BootstrapRequest struct {
	CellName, ServerURL, BaseDomain, CellMode string
	OrgSlug, OrgName, Template                string
	Platform                                  bool
	ParentSlug                                string
	HeadscaleUsers                            []string
}

type BootstrapResult struct {
	CellID, OrgID, OrgShort string
	AdminKey                *APIKey
}

type CompleteRequest struct {
	EnrollmentID     string
	CompletionSecret string
	NodeID           uint64
}

type Device struct {
	ID         string
	ShortID    string
	Name       string
	GivenName  string
	Kind       string
	Roles      []string
	IPv4, IPv6 string
	Online     bool
	State      string
}

type EnrollRequest struct {
	Token    string
	Hostname string
	OS       string
	Arch     string
	ClientIP *netip.Addr
}

type EnrollResponse struct {
	EnrollmentID     string
	DeviceID         string
	LoginServer      string
	AuthKey          string
	Hostname         string
	Tags             []string
	ExpiresAt        time.Time
	CompletionSecret string
}

type Grant struct {
	ID          string
	GrantorOrg  string
	GranteeOrg  string
	DstDeviceID string
	Ports       []string
	StartsAt    time.Time
	ExpiresAt   time.Time
	Revoked     bool
	ExternalRef string
	// Enforced is true when the cell confirmed the resulting policy is live.
	Enforced bool
}

type GrantRequest struct {
	GranteeOrg  string // short id of the org receiving access
	Src         store.SelectorJSON
	DstDeviceID string
	Ports       []string
	StartsAt    *time.Time
	ExpiresAt   time.Time
	Reason      string
	ExternalRef string // idempotency key, for example a rental id
}

type Hub interface {
	Refresh(ctx context.Context, cell string) error
	RefreshAndWait(ctx context.Context, cell string) error
	Do(ctx context.Context, cell string, op *cellv1.Op) (*cellv1.OpResult, error)
}

type Principal struct {
	KeyID    pgtype.UUID
	OrgID    pgtype.UUID
	OrgShort string
	Scopes   []string
}

type RecoveryHub interface {
	Connected(cell string) bool
	RefreshAndWait(ctx context.Context, cell string) error
}

type Service struct {
	Store *store.Store
	Hub   Hub
	Now   func() time.Time
	// MaxGrantTTL caps grant lifetimes unless an org setting is lower (default 30 days).
	MaxGrantTTL time.Duration
	// PublicURL is the API's external base URL, used in join links (for example https://api.headmesh.dev).
	PublicURL string
	// InstallURL is where the install script is served (for example https://get.headmesh.dev).
	InstallURL string
}

type TokenRequest struct {
	Roles            []string
	DeviceKind       string
	MaxUses          int32
	TTL              time.Duration
	Ephemeral        bool
	ApprovalRequired bool
}

type TokenResponse struct {
	ID        string
	Token     string
	JoinURL   string
	Commands  map[string]string
	ExpiresAt time.Time
}