policy

type Compiled struct {
	HuJSON   []byte
	SHA256   string
	Document Document
	Stats    Stats
}

type Device struct {
	Short string
	Org   string
	Roles []string
	User  string // non-empty for user-owned nodes in adopted cells
	State DeviceState
	// Registered is true once the device has a Headscale node. Only registered devices resolve to addresses, and
	// Headscale rejects policy tests whose principals resolve to none, so canaries consider only these.
	Registered bool
}

type DeviceState int

type Document struct {
	TagOwners map[string][]string `json:"tagOwners"`
	Grants    []GrantRule         `json:"grants"`
	SSH       []SSHRule           `json:"ssh,omitempty"`
	Tests     []PolicyTest        `json:"tests,omitempty"`
}

type Grant struct {
	ID        string
	Grantor   string
	Grantee   string
	Src       Selector // within Grantee
	Dst       string   // device Short within Grantor
	Ports     []Port
	StartsAt  time.Time
	ExpiresAt time.Time
	Revoked   bool
}

type GrantRule struct {
	Src []string `json:"src"`
	Dst []string `json:"dst"`
	IP  []string `json:"ip"`
}

type Options struct {
	// TagOwners is the owner list emitted for every Headmesh tag. Headmesh assigns tags through the Headscale API,
	// so no user needs to own them; the default (empty) means "only the API may assign".
	TagOwners []string
	// Canaries is the number of other orgs each org's deny test samples. Zero means the default (5); negative
	// disables policy tests entirely.
	Canaries int
	// CanaryPort is the port the canary tests probe. Defaults to tcp 22.
	CanaryPort int
}

type Org struct {
	Short    string   // 10-char base32 id used in tags; immutable
	Template Template // intra-org baseline
	Parent   string   // Short of the platform org that owns this child org, if any
	Platform bool     // true when this org may own child orgs and define PlatformRules
	SSH      bool     // emit an intra-org Tailscale SSH rule for non-root users
	// Users are Headscale users whose personal (untagged) nodes belong to this org. Only used for cells that
	// were adopted with existing user-owned nodes; Headmesh-enrolled nodes are always tagged.
	Users []string
}

type PlatformRule struct {
	ID       string
	Platform string
	Src, Dst PlatformSelector
	Ports    []Port
}

type PlatformSelector struct {
	Scope Scope
	Role  string // empty means every device in scope
}

type PolicyTest struct {
	Src    string   `json:"src"`
	Accept []string `json:"accept,omitempty"`
	Deny   []string `json:"deny,omitempty"`
}

type Port string

type Revision struct {
	EffectiveAt time.Time
	Compiled    *Compiled
}

type Rule struct {
	ID        string
	Org       string
	Src, Dst  Selector
	Ports     []Port
	StartsAt  time.Time
	ExpiresAt time.Time
}

type SSHRule struct {
	Action string   `json:"action"`
	Src    []string `json:"src"`
	Dst    []string `json:"dst"`
	Users  []string `json:"users"`
}

type Scope int

type Selector struct {
	Kind   SelectorKind
	Role   string // for SelectRole
	Device string // device Short, for SelectDevice
}

type SelectorKind int

type Snapshot struct {
	Cell          string
	Orgs          []Org
	Devices       []Device
	Rules         []Rule
	Grants        []Grant
	PlatformRules []PlatformRule
}

type Stats struct {
	Orgs, Devices, Rules, Grants, PlatformRules, Tags, Tests int
}

type Template string